from catimportcat flag =""app = Flask( __name__, static_url_path='/', static_folder='static') app.config['SECRET_KEY'] = str(uuid.uuid4()).replace("-","") +"*abcdefgh"ifos.path.isfile("/flag"): flag = cat("/flag") os.remove("/flag")@app.route('/', methods=['GET...
将/proc/self/maps 中内容存储在 test.txt 中,用来执行脚本: import reimport requestsmaps = open('攻防世界-catcat-new/test.txt') # 打开名为 'test.txt' 的文件并赋值给变量 mapsb = maps.read() # 读取文件内容并赋值给变量 blst = b.split('\\n') # 根据换行符 '\n' 将文件内容拆分为列表...
复制文本内容,将字符串f-string格式化输出美化一下。 importosimportuuidfromflaskimportFlask, request, session, render_template, Markupfromcatimportcat flag=""app=Flask(__name__, static_url_path='/', static_folder='static') app.config['SECRET_KEY'] = str(uuid.uuid4()).replace("-","") +...
这里刻意的*abcdefgh是在提示我们secret key的格式ifos.path.isfile("/flag"):flag=cat("/flag")os.remove("/flag")#这里读取flag后删掉了flag,防止之前任意文件读取出非预期解@app.route('/',methods=['GET'])defindex():detailtxt=os.listdir('./details/')cats_list=[]foriindetailtxt:cats_list....