Pasted%20image%2020240115233104

代码如下

from flask import Flask, request, jsonify
import re

app = Flask(__name__)

@app.route('/execute', methods=['POST'])
def execute_code():
code = request.form.get('code', '')
if re.match(".*[\x20-\x7E]+.*", code):
return jsonify({"output": "jk lmao no code"}), 403
result = ""
try:
result = eval(code)
except Exception as e:
result = str(e)

return jsonify({"output": result}), 200

if __name__ == "__main__":
app.run(host="0.0.0.0", port=1337, debug=False)

不能匹配可见字符,这里可以用换行绕过
Pasted%20image%2020240115233351Pasted%20image%2020240115233403

如图使用__import__动态导入os