[Python知识库]web buuctf [De1CTF 2019]SSRF Me

打开是一团代码，

整理后：

! /usr/bin/env python
#encoding=utf-8
from flask import Flask
from flask import request
import socket
import hashlib
import urllib
import sys
import os
import json reload(sys)
sys.setdefaultencoding('latin1')
app = Flask(__name__)
secert_key = os.urandom(16)

class Task:
   def __init__(self, action, param, sign, ip):
       self.action = action
       self.param = param
       self.sign = sign
       self.sandbox = md5(ip)
       if(not os.path.exists(self.sandbox)):   #SandBox For Remote_Addr
         os.mkdir(self.sandbox)

   def Exec(self):
       result = {}
       result['code'] = 500
       if (self.checkSign()):
          if "scan" in self.action:
             tmpfile = open("./%s/result.txt" % self.sandbox, 'w')
             resp = scan(self.param)
             if (resp == "Connection Timeout"):
                 result['data'] = resp
             else:
                 print resp
                 tmpfile.write(resp)
                 tmpfile.close()
                 result['code'] = 200
          if "read" in self.action:
             f = open("./%s/result.txt" % self.sandbox, 'r')
             result['code'] = 200
             result['data'] = f.read()
          if result['code'] == 500:
             result['data'] = "Action Error"
        else:
           result['code'] = 500
           result['msg'] = "Sign Error"
        return result

    def checkSign(self):
        if (getSign(self.action, self.param) == self.sign):
            return True
        else:
            return False #generate Sign For Action Scan.

//返回secert_key+scan+param的md5加密值
@app.route("/geneSign", methods=['GET', 'POST'])
def geneSign():
    param = urllib.unquote(request.args.get("param", ""))
    action = "scan"
    return getSign(action, param)

//返回类对象处理后结果（类对象的处理包含文件读取）
@app.route('/De1ta',methods=['GET','POST'])
def challenge():
    action = urllib.unquote(request.cookies.get("action"))
    param = urllib.unquote(request.args.get("param", ""))
    sign = urllib.unquote(request.cookies.get("sign"))
    ip = request.remote_addr
    if(waf(param)):
       return "No Hacker!!!!"
       task = Task(action, param, sign, ip)
       return json.dumps(task.Exec())

//返回代码（主页代码）
@app.route('/')
def index():
    return open("code.txt","r").read()


def scan(param):
    socket.setdefaulttimeout(1)
    try:
      return urllib.urlopen(param).read()[:50]
    except:
      return "Connection Timeout"

def getSign(action, param):
    return hashlib.md5(secert_key + param + action).hexdigest()

def md5(content):
    return hashlib.md5(content).hexdigest()

def waf(param):
    check=param.strip().lower()
    if check.startswith("gopher") or check.startswith("file"):
       return True
    else:
       return False

if __name__ == '__main__':
   app.debug = False
   app.run(host='0.0.0.0',port=80)

python代码审计emo

题目有个提示flag is in ./flag.txt，也就是我们需要读取这个文件

1.看代码是flask框架，先看路由文件

@app.route('/De1ta',methods=['GET','POST'])
def challenge():
    action = urllib.unquote(request.cookies.get("action"))     //读cookie传参action
    param = urllib.unquote(request.args.get("param", ""))      //读传参param
    sign = urllib.unquote(request.cookies.get("sign"))         //读cookie传参sign
    ip = request.remote_addr
    if(waf(param)):                                            //对传参param进行绕过
       return "No Hacker!!!!"
       task = Task(action, param, sign, ip)
       return json.dumps(task.Exec())                          //调用类函数

只有访问/De1ta页面像是会出结果，我们看这个文件的内容

需要传递三个参数action、param、sign

只有一个绕过param的开头不能是gopher和file

2.看Exec()

def Exec(self):
       result = {}
       result['code'] = 500
       if (self.checkSign()):
          if "scan" in self.action:
             tmpfile = open("./%s/result.txt" % self.sandbox, 'w')
             resp = scan(self.param)
             if (resp == "Connection Timeout"):
                 result['data'] = resp
             else:
                 print resp
                 tmpfile.write(resp)
                 tmpfile.close()
                 result['code'] = 200
          if "read" in self.action:
             f = open("./%s/result.txt" % self.sandbox, 'r')
             result['code'] = 200
             result['data'] = f.read()
          if result['code'] == 500:
             result['data'] = "Action Error"
        else:
           result['code'] = 500
           result['msg'] = "Sign Error"
        return result

根据代码，

大if为真的情况下

第一个if语句判断均为真的情况下，打开result.txt文件，利用scan函数，将param文件打开，读取到resp中，再将resp写入result.txt文件，

第二个if为真的条件下，将result.txt文件读取，并回显

这样我们可以得到：

? ? 1.必须同时满足三个if均为真

? ? 2.param=flag.txt

3.self.checkSign()为真：

def checkSign(self):
        if (getSign(self.action, self.param) == self.sign):
            return True
        else:
            return False #generate Sign For Action Scan.

def getSign(action, param):
    return hashlib.md5(secert_key + param + action).hexdigest()

要使传进来的参数sign=hashlib.md5(secert_key+param+action).hexdigest()

action和param都是可控，已知的，需要知道secert_key

secert_key = os.urandom(16)

//返回secert_key+scan+param的md5加密值
@app.route("/geneSign", methods=['GET', 'POST'])
def geneSign():
    param = urllib.unquote(request.args.get("param", ""))
    action = "scan"
    return getSign(action, param)

这是和secert_key有关的代码部分，可以知道这个数是动态随机生成的，但是我们可以通过访问/geneSign获取secert_key+scan+param的getSign值，这样我们先看确定一下action的值

4.

if "scan" in self.action:
if "read" in self.action:

下面这两个判断要求action包含scan和read，所以

action=scanread或者是readscan都行

5.结合第三步

? ?sign=hashlib.md5(secert_key+param+action).hexdigest()

=>sign=hashlib.md5(secert_key+flag.txt+readscan).hexdigest()

读取/geneSign，可获取

sign2=hashlib.md5(secert_key+param+scan),

所以我们可以在读取的时候传参令param=flag.txtread，此时的sign=sign2

?

6.构造payload:

/De1ta?action=readscan&param=flag.txt&sign=c7565e2d3a3a8cec4fdd05a70133f71a

报错，忘了，在路由文件中标明了

    action = urllib.unquote(request.cookies.get("action"))
    param = urllib.unquote(request.args.get("param", ""))
    sign = urllib.unquote(request.cookies.get("sign"))

所以sign和action,要加到cookie里

flag{a25f2989-d43e-4988-89a8-c9ca4988923c}?