[De1CTF 2019]SSRF Me 1
#! /usr/bin/env python
#encoding=utf-8
from flask import Flask
from flask import request
import socket
import hashlib
import urllib
import sys
import os
import json
reload(sys)
sys.setdefaultencoding('latin1')
app = Flask(__name__)
secert_key = os.urandom(16)
class Task:
def __init__(self, action, param, sign, ip):
self.action = action
self.param = param
self.sign = sign
self.sandbox = md5(ip)
if(not os.path.exists(self.sandbox)): #SandBox For Remote_Addr
os.mkdir(self.sandbox)
def Exec(self):
result = {}
result['code'] = 500
if (self.checkSign()):
if "scan" in self.action:
tmpfile = open("./%s/result.txt" % self.sandbox, 'w')
resp = scan(self.param)
if (resp == "Connection Timeout"):
result['data'] = resp
else:
print resp
tmpfile.write(resp)
tmpfile.close()
result['code'] = 200
if "read" in self.action:
f = open("./%s/result.txt" % self.sandbox, 'r')
result['code'] = 200
result['data'] = f.read()
if result['code'] == 500:
result['data'] = "Action Error"
else:
result['code'] = 500
result['msg'] = "Sign Error"
return result
def checkSign(self):
if (getSign(self.action, self.param) == self.sign):
return True
else:
return False
#generate Sign For Action Scan.
@app.route("/geneSign", methods=['GET', 'POST'])
def geneSign():
param = urllib.unquote(request.args.get("param", ""))
action = "scan"
return getSign(action, param)
@app.route('/De1ta',methods=['GET','POST'])
def challenge():
action = urllib.unquote(request.cookies.get("action"))
param = urllib.unquote(request.args.get("param", ""))
sign = urllib.unquote(request.cookies.get("sign"))
ip = request.remote_addr
if(waf(param)):
return "No Hacker!!!!"
task = Task(action, param, sign, ip)
return json.dumps(task.Exec())
@app.route('/')
def index():
return open("code.txt","r").read()
def scan(param):
socket.setdefaulttimeout(1)
try:
return urllib.urlopen(param).read()[:50]
except:
return "Connection Timeout"
def getSign(action, param):
return hashlib.md5(secert_key + param + action).hexdigest()
def md5(content):
return hashlib.md5(content).hexdigest()
def waf(param):
check=param.strip().lower()
if check.startswith("gopher") or check.startswith("file"):
return True
else:
return False
if __name__ == '__main__':
app.debug = False
app.run(host='0.0.0.0')
题目一上来就扔给我们一串源码，发现本关是ssti的注入漏洞，但我感觉本质上还是代码审计。
让我们以 route 不同来进行python的代码审计
@app.route('/')
def index():
return open("code.txt","r").read()
def scan(param):
socket.setdefaulttimeout(1) #从url上下载图片
try:
return urllib.urlopen(param).read()[:50]
except:
return "Connection Timeout"
def getSign(action, param): # 获得签名 函数
return hashlib.md5(secert_key + param + action).hexdigest()
#对secert_key + param + action进行MD5加密，同时利用hexdigest() 函数将加密后的MD5字符串转化为十六进制数据字符串值
#获得的字符串就是 cookie需要的Sign
def md5(content): #
return hashlib.md5(content).hexdigest()
def waf(param):
#判断我们传入的文件是否含有以gopher或者file开头
这里过滤掉了两个协议，使得我们无法通过gopher协议和php伪协议对flag.txt进行读取hexdigest()
check=param.strip().lower()
if check.startswith("gopher") or check.startswith("file"):
return True
else:
return False
if __name__ == '__main__':
app.debug = False
app.run(host='0.0.0.0')
@app.route("/geneSign", methods=['GET', 'POST'])
def geneSign():
param = urllib.unquote(request.args.get("param", ""))
action = "scan"
return getSign(action, param)
GET方式接受 param参数值
令action = "scan"
同时将action和param，返回到 getSign()函数 生成一段签名
urllib.unquote()字符串被当作url提交时会被自动进行url编码处理
class Task:
def __init__(self, action, param, sign, ip): #__init__ 初始化类，返回的类型是function
self.action = action
self.param = param
self.sign = sign
self.sandbox = md5(ip)
if(not os.path.exists(self.sandbox)): #SandBox For Remote_Addr
os.mkdir(self.sandbox)
def Exec(self):
result = {}
result['code'] = 500
if (self.checkSign()):
if "scan" in self.action:
tmpfile = open("./%s/result.txt" % self.sandbox, 'w')
resp = scan(self.param)
if (resp == "Connection Timeout"):
result['data'] = resp
else:
print resp
tmpfile.write(resp)
tmpfile.close()
result['code'] = 200
if "read" in self.action:
f = open("./%s/result.txt" % self.sandbox, 'r')
result['code'] = 200
result['data'] = f.read()
if result['code'] == 500:
result['data'] = "Action Error"
else:
result['code'] = 500
result['msg'] = "Sign Error"
return result
def checkSign(self):
if (getSign(self.action, self.param) == self.sign):
return True
else:
return False
@app.route('/De1ta',methods=['GET','POST'])
def challenge():
action = urllib.unquote(request.cookies.get("action"))
param = urllib.unquote(request.args.get("param", ""))
sign = urllib.unquote(request.cookies.get("sign"))
ip = request.remote_addr
if(waf(param)):
return "No Hacker!!!!"
task = Task(action, param, sign, ip)
return json.dumps(task.Exec())
以GET方法接受 接受 param 参数
cookie接收 sign 和 action
使用 waf函数进行判断 我们传入的参数中是否含有 gopher 和 file 着两个敏感词汇
将action, param, sign, ip 四个参数转到tast函数中，
将我们在tast.Exec()转变为 json的格式，
从而实现我们进行读取的目的
tast函数中，先初始化类 之后进行一个签名的判断
调用getSign()函数 与我们输入的签名进行对比
相同，继续进行判断
若"scan" in self.action:则将读取到的内容写入result.txt;
若"read" in self.action:则将result.txt的内容显示出来
payload：
本关的是要签名的判断
我们可以利用前面 oute"/geneSign"来生成我们需要的sign
同时我们要让cookie中含有 scan 和 read 以便后续对flag的文件进行读取
scan的话，在geneSign函数里面,action是等于scan，而getsign函数将param和action拼接起来，所以我们无需将scan加入到我们所需要查询文件的后面，仅仅只需要将read添加到后面即可
同时，本题提示我们flag is in ./flag.txt
创建 sign
/geneSign?param=flag.txtread
访问 flag文件
/De1ta?param=flag.txt
Cookie:action=readscan;sign=e8cc6f64f9ba46acf8e5266c4707f0f2
