vlambda博客
学习文章列表

 1 from flask import Flask, session, request, Response 2 import urllib 3  4 app = Flask(__name__) 5 app.secret_key = '*********************' # censored 6 url_prefix = '/d5afe1f66147e857' 7  8  9 def FLAG(): 10 return '*********************' # censored 11  12  13 def trigger_event(event): #trigger_event：标识触发事件，取值为 INSERT、UPDATE 或 DELETE； 14 session['log'].append(event) 15 if len(session['log']) > 5: 16 session['log'] = session['log'][-5:] 17 if type(event) == type([]): 18 request.event_queue += event 19 else: 20 request.event_queue.append(event) 21  22  23 def get_mid_str(haystack, prefix, postfix=None): 24 haystack = haystack[haystack.find(prefix)+len(prefix):] 25 if postfix is not None: 26 haystack = haystack[:haystack.find(postfix)] 27 return haystack 28  29  30 class RollBackException: 31 pass 32  33  34 def execute_event_loop(): 35 valid_event_chars = set( 36 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_0123456789:;#') 37 resp = None 38 while len(request.event_queue) > 0: 39 # `event` is something like "action:ACTION;ARGS0#ARGS1#ARGS2......" 40 event = request.event_queue[0] 41 request.event_queue = request.event_queue[1:] 42 if not event.startswith(('action:', 'func:')): 43 continue 44 for c in event: 45 if c not in valid_event_chars: 46 break 47 else: 48 is_action = event[0] == 'a' 49 action = get_mid_str(event, ':', ';') 50 args = get_mid_str(event, action+';').split('#') 51 try: 52 event_handler = eval( 53 action + ('_handler' if is_action else '_function')) 54 ret_val = event_handler(args) 55 except RollBackException: 56 if resp is None: 57 resp = '' 58 resp += 'ERROR! All transactions have been cancelled. <br />' 59 resp += '<a href="./?action:view;index">Go back to index.html</a><br />' 60 session['num_items'] = request.prev_session['num_items'] 61 session['points'] = request.prev_session['points'] 62 break 63 except Exception, e: 64 if resp is None: 65 resp = '' 66 # resp += str(e) # only for debugging 67 continue 68 if ret_val is not None: 69 if resp is None: 70 resp = ret_val 71 else: 72 resp += ret_val 73 if resp is None or resp == '': 74 resp = ('404 NOT FOUND', 404) 75 session.modified = True 76 return resp 77  78  79 @app.route(url_prefix+'/') 80 def entry_point(): 81 querystring = urllib.unquote(request.query_string) 82 request.event_queue = [] 83 if querystring == '' or (not querystring.startswith('action:')) or len(querystring) > 100: 84 querystring = 'action:index;False#False' 85 if 'num_items' not in session: 86 session['num_items'] = 0 87 session['points'] = 3 88 session['log'] = [] 89 request.prev_session = dict(session) 90 trigger_event(querystring) 91 return execute_event_loop() 92  93 # handlers/functions below -------------------------------------- 94  95  96 def view_handler(args): 97 page = args[0] 98 html = '' 99 html += '[INFO] you have {} diamonds, {} points now.<br />'.format(100 session['num_items'], session['points'])101 if page == 'index':102 html += '<a href="./?action:index;True%23False">View source code</a><br />'103 html += '<a href="./?action:view;shop">Go to e-shop</a><br />'104 html += '<a href="./?action:view;reset">Reset</a><br />'105 elif page == 'shop':106 html += '<a href="./?action:buy;1">Buy a diamond (1 point)</a><br />'107 elif page == 'reset':108 del session['num_items']109 html += 'Session reset.<br />'110 html += '<a href="./?action:view;index">Go back to index.html</a><br />'111 return html112 113 114 def index_handler(args):115 bool_show_source = str(args[0])116 bool_download_source = str(args[1])117 if bool_show_source == 'True':118 119 source = open('eventLoop.py', 'r')120 html = ''121 if bool_download_source != 'True':122 html += '<a href="./?action:index;True%23True">Download this .py file</a><br />'123 html += '<a href="./?action:view;index">Go back to index.html</a><br />'124 125 for line in source:126 if bool_download_source != 'True':127 html += line.replace('&', '&amp;').replace('\t', '&nbsp;'*4).replace(128 ' ', '&nbsp;').replace('<', '&lt;').replace('>', '&gt;').replace('\n', '<br />')129 else:130 html += line131 source.close()132 133 if bool_download_source == 'True':134 headers = {}135 headers['Content-Type'] = 'text/plain'136 headers['Content-Disposition'] = 'attachment; filename=serve.py'137 return Response(html, headers=headers)138 else:139 return html140 else:141 trigger_event('action:view;index')142 143 144 def buy_handler(args):145 num_items = int(args[0])146 if num_items <= 0:147 return 'invalid number({}) of diamonds to buy<br />'.format(args[0])148 session['num_items'] += num_items149 trigger_event(['func:consume_point;{}'.format(150 num_items), 'action:view;index'])151 152 153 def consume_point_function(args):154 point_to_consume = int(args[0])155 if session['points'] < point_to_consume:156 raise RollBackException()157 session['points'] -= point_to_consume158 159 160 def show_flag_function(args):161 flag = args[0]162 # return flag # GOTCHA! We noticed that here is a backdoor planted by a hacker which will print the flag, so we disabled it.163 return 'You naughty boy! ;) <br />'164 165 166 def get_flag_handler(args):167 if session['num_items'] >= 5:168 # show_flag_function has been disabled, no worries169 trigger_event('func:show_flag;' + FLAG())170 trigger_event('action:view;index')171 172 173 if __name__ == '__main__':174 app.run(debug=False, host='0.0.0.0')

166 def get_flag_handler(args):167 if session['num_items'] >= 5:168 # show_flag_function has been disabled, no worries169 trigger_event('func:show_flag;' + FLAG())170 trigger_event('action:view;index')

153 def consume_point_function(args):154 point_to_consume = int(args[0])155 if session['points'] < point_to_consume:156 raise RollBackException()157 session['points'] -= point_to_consume

@app.route(url_prefix+'/')#使用 route() 装饰器告诉 Flask 什么样的URL 能触发我们的函数def entry_point():  querystring = urllib.unquote(request.query_string)  #urllib.unquote ：urlencode逆向，就是把%40转化为@（字符串被当作url提交时会被自动进行url编码处理，在python里也有个urllib.urlencode的方法，可以很方便的把字典形式的参数进行url编码） #request.query_string：它得到的是，url中？后面所有的值，最为一个字符串，比如action:index;False#False request.event_queue = [] #定义一个数组 if querystring == '' or (not querystring.startswith('action:')) or len(querystring) > 100:  #如果这个url？后面的值为空 或者 这个url？后面的值不是以action开头 或者 这个url？后面的值长度大于100  querystring = 'action:index;False#False'  if 'num_items' not in session: #如果session里面还没有num_items这个key session['num_items'] = 0 #钻石数量 session['points'] = 3 #积分数量 session['log'] = []  request.prev_session = dict(session) #新建一个字典request.prev_session使其的值为字典session的值 trigger_event(querystring) #调用了trigger_event return execute_event_loop() #进入到execute_event_loop函数

def trigger_event(event): session['log'].append(event)#将event添加到session['log']这个列表中 if len(session['log']) > 5: #如果列表session['log']中的元素数量大于等于5 session['log'] = session['log'][-5:]#session['log']取后五个元素 if type(event) == type([]): #如果event的类型是列表 request.event_queue += event #两个列表相加，在列表request.event_queue中添加一个元素 event else: request.event_queue.append(event) #在列表request.event_queue中添加一个元素 event

 else: is_action = event[0] == 'a' action = get_mid_str(event, ':', ';') args = get_mid_str(event, action+';').split('#')

event_handler = eval(action + ('_handler' if is_action else '_function')) ret_val = event_handler(args) 

?action:trigger_event%23;action:buy;5%23action:get_flag;

#!/usr/bin/env python3import sysimport zlibfrom base64 import b64decodefrom flask.sessions import session_json_serializerfrom itsdangerous import base64_decode def decryption(payload): payload, sig = payload.rsplit(b'.', 1) payload, timestamp = payload.rsplit(b'.', 1)  decompress = False if payload.startswith(b'.'): payload = payload[1:] decompress = True  try: payload = base64_decode(payload) except Exception as e: raise Exception('Could not base64 decode the payload because of ' 'an exception')  if decompress: try: payload = zlib.decompress(payload) except Exception as e: raise Exception('Could not zlib decompress the payload before ' 'decoding the payload')  return session_json_serializer.loads(payload) if __name__ == '__main__': print(decryption(sys.argv[1].encode()))