Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-11-26 00:37 EST Warning: 10.10.11.134 giving up on port because retransmission cap hit (10). Stats: 0:00:38 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan SYN Stealth Scan Timing: About 48.37% done; ETC: 00:38 (0:00:39 remaining) Stats: 0:00:58 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan SYN Stealth Scan Timing: About 71.68% done; ETC: 00:39 (0:00:23 remaining) Nmap scan report for 10.10.11.134 Host is up (0.34s latency). Not shown: 60386 closed tcp ports (reset), 5146 filtered tcp ports (no-response) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 5000/tcp open upnp
defverify_jwt(token,key): try: username=jwt.decode(token,key,algorithms=['HS256',])['username'] if username: returnTrue else: returnFalse except: returnFalse
@app.route("/", methods=["GET","POST"]) defindex(): if request.method=="POST": if request.form['username']=="admin"and request.form['password']=="admin": res = make_response() username=request.form['username'] token=jwt.encode({"username":"admin"},secret,algorithm="HS256") res.set_cookie("auth",token) res.headers['location']='/home' return res,302 else: return render_template('index.html') else: return render_template('index.html')
@app.route("/home") defhome(): if verify_jwt(request.cookies.get('auth'),secret): return render_template('home.html') else: return redirect('/',code=302)
@app.route("/track",methods=["GET","POST"]) deftrack(): if request.method=="POST": if verify_jwt(request.cookies.get('auth'),secret): return render_template('track.html',message=True) else: return redirect('/',code=302) else: return render_template('track.html')
@app.route('/order',methods=["GET","POST"]) deforder(): if verify_jwt(request.cookies.get('auth'),secret): if request.method=="POST": costume=request.form["costume"] message = ''' Your order of "{}" has been placed successfully. '''.format(costume) tmpl=render_template_string(message,costume=costume) return render_template('order.html',message=tmpl) else: return render_template('order.html') else: return redirect('/',code=302) app.run(debug='true')
deffiles_to_zip(path): for root, dirs, files in os.walk(path): for f in files: full_path = os.path.join(root, f) archive_name = full_path[len(path) + len(os.sep):] yield full_path, archive_name
defmake_zip_file_bytes(path): buf = io.BytesIO() with ZipFile(buf, 'w') as z: for full_path, archive_name in files_to_zip(path=path): z.write(full_path, archive_name) return buf.getvalue()
defupdate_lambda(lambda_name, lambda_code_path): ifnot os.path.isdir(lambda_code_path): raise ValueError('Lambda directory does not exist: {0}'.format(lambda_code_path)) aws_lambda.update_function_code( FunctionName=lambda_name, ZipFile=make_zip_file_bytes(path=lambda_code_path))
@app.route("/home") defhome(): if verify_jwt(request.cookies.get('auth'),secret): return render_template('home.html') else: return redirect('/',code=302) -------------- defverify_jwt(token,key): try: username=jwt.decode(token,key,algorithms=['HS256',])['username'] if username: returnTrue else: returnFalse except: returnFalse
这里jwt.io直接给个username就行,secert给我们有的
直接拿来加上cookie的auth，就进来了
这里进来之后，/order很明显存在ssti
1 2 3 4 5 6 7 8 9 10 11 12 13
@app.route('/order',methods=["GET","POST"]) deforder(): if verify_jwt(request.cookies.get('auth'),secret): if request.method=="POST": costume=request.form["costume"] message = ''' Your order of "{}" has been placed successfully. '''.format(costume) tmpl=render_template_string(message,costume=costume) return render_template('order.html',message=tmpl) else: return render_template('order.html') else:
这里其实他写的代码写的有些车轱辘了
1
render_template_string(message,costume=costume)
直接看作下面就好，Tmpl完全没必要
1 2 3 4
message = ''' Your order of "{}" has been placed successfully. '''.format(costume) return render_template('order.html',message=message)
