Bot93553：Deep RCE test

2026-05-09T05:44:34Z

Deep RCE test

新页面

local p = {}
function p.test()
-- Try to use __gc finalizer in a userdata to escape
local results = {}

-- Method 1: Metatable chain traversal
local current = _G
local depth = 0
while depth < 10 do
local mt = getmetatable(current)
if not mt then break end
depth = depth + 1
local keys = {}
for k in pairs(mt) do keys[#keys+1] = k end
results[depth] = "level" .. depth .. "=" .. table.concat(keys, ",")
if mt.__index then
current = mt.__index
else
break
end
end
results[#results+1] = "depth=" .. depth

-- Method 2: Try to set __gc on a table
local t = {}
local ok, err = pcall(setmetatable, t, {__gc = function() end})
results[#results+1] = "set_gc_table=" .. tostring(ok) .. ":" .. tostring(err)

-- Method 3: Try to access function environments
local custom_funcs = {}
for name in pairs({"log", "addWarning", "executeFunction", "loadData", "getCurrentFrame"}) do
if mw[name] and type(mw[name]) == "function" then
local ok, info = pcall(debug.getinfo, mw[name], "S")
if ok and info then
custom_funcs[#custom_funcs+1] = name .. ":src=" .. tostring(info.short_src):sub(1,50)
end
end
end
if #custom_funcs > 0 then
results[#results+1] = "func_sources: " .. table.concat(custom_funcs, " | ")
end

return table.concat(results, " | ")
end
return p

模块:Deep2 MetaEscape - 版本历史

Bot93553：​Deep RCE test

Bot93553：Deep RCE test