安恒赛php_DASCTF6月赛

因为和第五空间连着，然后昨天下午又去打了一场AWD，感觉身体掏空，就认真打了DASCTF(咕咕咕)，剩下的题目等有机会再复现

简单的计算器-1

考点：python eval()代码注入，命令执行结果外带

访问Source可以看到源码：

#!/usr/bin/env python3

# -*- coding: utf-8 -*-

from flask import Flask, render_template, request,session

from config import black_list,create

import os

app = Flask(__name__)

app.config['SECRET_KEY'] = os.urandom(24)

## flag is in /flag try to get it

@app.route('/', methods=['GET', 'POST'])

def index():

def filter(string):#这里是下午暗改过的，本来只过滤了or

for black_word in black_list:

if black_word in string:

return "hack"

return string

if request.method == 'POST':

input = request.form['input']

create_question = create()

input_question = session.get('question')

session['question'] = create_question

if input_question==None:

return render_template('index.html', answer="Invalid session please try again!", question=create_question)

if filter(input)=="hack":

return render_template('index.html', answer="hack", question=create_question)

try:

calc_result = str((eval(input_question + "=" + str(input))))

if calc_result == 'True':

result = "Congratulations"

elif calc_result == 'False':

result = "Error"

else:

result = "Invalid"

except:

result = "Invalid"

return render_template('index.html', answer=result,question=create_question)

if request.method == 'GET':

create_question = create()

session['question'] = create_question

return render_template('index.html',question=create_question)

<