[NISACTF 2022]babyupload（wp）

访问/source下载源代码www.zip

直接看源码

from flask import Flask, request, redirect, g, send_from_directory
import sqlite3
import os
import uuid

app = Flask(name)

SCHEMA = “””CREATE TABLE files (
id text primary key,
path text
);
“””

def db():
g_db = getattr(g, ‘_database’, None)
if g_db is None:
g_db = g._database = sqlite3.connect(“database.db”)
return g_db

@app.before_first_request
def setup():
os.remove(“database.db”)
cur = db().cursor()
cur.executescript(SCHEMA)

@app.route(‘/’)
def hello_world():
return “””

Select image to upload:

“””

@app.route(‘/source’)
def source():
return send_from_directory(directory=”/var/www/html/”, path=”www.zip”, as_attachment=True)

@app.route(‘/upload’, methods=[‘POST’])
def upload():
if ‘file’ not in request.files:
return redirect(‘/’)
file = request.files[‘file’]
if “.” in file.filename:
return “Bad filename!”, 403
conn = db()
cur = conn.cursor()
uid = uuid.uuid4().hex
try:
cur.execute(“insert into files (id, path) values (?, ?)”, (uid, file.filename,))
except sqlite3.IntegrityError:
return “Duplicate file”
conn.commit()

file.save('uploads/' + file.filename)
return redirect('/file/' + uid)

@app.route(‘/file/’)
def file(id):
conn = db()
cur = conn.cursor()
cur.execute(“select path from files where id=?”, (id,))
res = cur.fetchone()
if res is None:
return “File not found”, 404

# print(res[0])

with open(os.path.join("uploads/", res[0]), "r") as f:
    return f.read()

if name == ‘main‘:
app.run(host=’0.0.0.0′, port=80)

最后一行有点问题

with open(os.path.join(“uploads/”, res[0]), “r”) as f: return f.read()

当res[0]为绝对路径时，打开的就是绝对路径，不会进行拼接

所以用burp修改文件名为 //flag，跳转就读取到//flag文件了

意思是在上传文件

有一个小问题，我们在尝试上传图片马也就是//php木马时，burp会自行改形式为image/jpeg图片内容，我们既然需要伪造//flag文件，就需要改相应的格式。如： text/plain

具体包如下：

 

给了上传地址直接访问就可

这道题学会了个新姿势就是当res[0]为绝对路径时，我们可以直接跳转到最后文件地址而不需要补齐界面的文件，直接跳转//flag界面