前言
在8月25日的安恒杯月赛题出现了一道flask debug配合任意文件读取的题，当时没有搞出来，作为萌新没见过这种题目，所以赛后经过讲解，自己本地复现了一波，收益良多。
0x01
此漏洞主要是利用Flask在debug会生成一个pin码。
E:\1待处理\123\flaskfuxianaaa\venv\Scripts\python.exe -m flask run
* Serving Flask app "app.py" (lazy loading)
* Environment: development
* Debug mode: on
* Restarting with stat
* Debugger is active!
* Debugger PIN: 229-992-815
* Running on http://127.0.0.1:5000/ (Press CTRL+C to quit)
image.png
问题出在这个pin码的生成，在同一台机子上多次启动同一个Flask应用时，会发现这个pin码是固定的。
0x02
漏洞测试环境：
windows
python3.6
Flask 1.0.2
0x03
现在来分析pin码是如何生成的，本人是用pycharm单步debug，下面只给出重要代码段。
from flask import Flask
app = Flask(__name__)
@app.route('/')
def hello_world():
return 'Hellso World!'
if __name__ == '__main__':
app.run()
跟进app.run函数。
image.png
跟进run_simple函数
image.png
image.png
跟进DebuggedApplication类
image.png
跟进__init__函数，可以看到两个跟pin相关的参数
image.png
可以看到_get_pin函数钟有对pin赋值的地方。
image.png
跟进get_pin_and_cppkie_name函数
image.png
看到注释，可以肯定这个函数就是跟pin的生成有关，下面贴出源码。
def get_pin_and_cookie_name(app):
"""Given an application object this returns a semi-stable 9 digit pin
code and a random key. The hope is that this is stable between
restarts to not make debugging particularly frustrating. If the pin
was forcefully disabled this returns `None`.
Second item in the resulting tuple is the cookie name for remembering.
"""
pin = os.environ.get('WERKZEUG_DEBUG_PIN')
rv = None
num = None
# Pin was explicitly disabled
if pin == 'off':
return None, None
# Pin was provided explicitly
if pin is not None and pin.replace('-', '').isdigit():
# If there are separators in the pin, return it directly
if '-' in pin:
rv = pin
else:
num = pin
modname = getattr(app, '__module__',
getattr(app.__class__, '__module__'))
try:
# `getpass.getuser()` imports the `pwd` module,
# which does not exist in the Google App Engine sandbox.
username = getpass.getuser()
except ImportError:
username = None
mod = sys.modules.get(modname)
# This information only exists to make the cookie unique on the
# computer, not as a security feature.
probably_public_bits = [
username,
modname,
getattr(app, '__name__', getattr(app.__class__, '__name__')),
getattr(mod, '__file__', None),
]
# This information is here to make it harder for an attacker to
# guess the cookie name. They are unlikely to be contained anywhere
# within the unauthenticated debug page.
private_bits = [
str(uuid.getnode()),
get_machine_id(),
]
h = hashlib.md5()
for bit in chain(probably_public_bits, private_bits):
if not bit:
continue
if isinstance(bit, text_type):
bit = bit.encode('utf-8')
h.update(bit)
h.update(b'cookiesalt')
cookie_name = '__wzd' + h.hexdigest()[:20]
# If we need to generate a pin we salt it a bit more so that we don't
# end up with the same value and generate out 9 digits
if num is None:
h.update(b'pinsalt')
num = ('%09d' % int(h.hexdigest(), 16))[:9]
# Format the pincode in groups of digits for easier remembering if
# we don't have a result yet.
if rv is None:
for group_size in 5, 4, 3:
if len(num) % group_size == 0:
rv = '-'.join(num[x:x + group_size].rjust(group_size, '0')
for x in range(0, len(num), group_size))
break
else:
rv = num
return rv, cookie_name
可以看到，计算pin码时，是通过向本机取一下东西，经过md5等操作算出来的。
image.png
看看debug调试结果
image.png
分析出六个值分别位：
wuli丶Decade
flask.cli
DispatchingApp------------------>run函数所属的类
E:\\1待处理\\123\\flask11\\venv\\Lib\\site-packages\\flask\\cli.py------>根据报错信息得出路径
xxxxx5457141305 ------->某网卡的mac地址的十进制
xxxxxx-8fcb-44d5-be62-36049d2db881 分linux、windows、mac，Windows是从注册表中取一个值。
image.png
下面改脚本，在本地计算出pin值
image.png
回到题目本身
由于pycharm版本的原因，构造的六个值稍微有点不同，下面直接给出路径和值。
username ------>/etc/passwd
中间两个一般固定
路径（根据报错）
网卡的mac地址一般存在 /sys/class/net/网卡/address
linux---> /etc/machine-id or /proc/sys/kernel/random/boot_id
'ctf'
'flask.app'
'Flask'
'/usr/local/lib/python2.7/dist-packages/flask/app.pyc'
'2485377892354'
''
但是这里有两个坑
1、路径报错是pyc。
2、/etc/machine-id路径下的值确实是空的。
image.png
image.png
image.png