文章目录

• • • ACTF upload
    • not so web 1
    • not so web 2

      ACTF upload

      前面登录随便输入可以进入文件上传页面, 随便上传一张图片, 发现路由存在file_path参数, 尝试路径穿越读取文件

      发现可以成功读取

      

      

      读取源码

      /upload?file_path=../app.py
      

      import uuid
      import os
      import hashlib
      import base64
      from flask import Flask, request, redirect, url_for, flash, session
      app = Flask(__name__)
      app.secret_key = os.getenv('SECRET_KEY')
      @app.route('/')
      def index():
          if session.get('username'):
              return redirect(url_for('upload'))
          else:
              return redirect(url_for('login'))
      @app.route('/login', methods=['POST', 'GET'])
      def login():
          if request.method == 'POST':
              username = request.form['username']
              password = request.form['password']
              if username == 'admin':
                  if hashlib.sha256(password.encode()).hexdigest() == '32783cef30bc23d9549623aa48aa8556346d78bd3ca604f277d63d6e573e8ce0':
                      session['username'] = username
                      return redirect(url_for('index'))
                  else:
                      flash('Invalid password')
              else:
                  session['username'] = username
                  return redirect(url_for('index'))
          else:
              return '''
              
      Login
              
      No need to register.
              
                  Username:
                  
                  
      
                  Password:
                  
                  
      
                  
              
              '''
      @app.route('/upload', methods=['POST', 'GET'])
      def upload():
          if not session.get('username'):
              return redirect(url_for('login'))
          
          if request.method == 'POST':
              f = request.files['file']
              file_path = str(uuid.uuid4()) + '_' + f.filename
              f.save('./uploads/' + file_path)
              return redirect(f'/upload?file_path=https://blog.csdn.net/2302_80472909/article/details/{file_path}')
          
          else:
              if not request.args.get('file_path'):
                  return '''
                  
      Upload Image
                  
                  
                      
                      
                  
                  '''
                  
              else:
                  file_path = './uploads/' + request.args.get('file_path')
                  if session.get('username') != 'admin':
                      with open(file_path, 'rb') as f:
                          content = f.read()
                          b64 = base64.b64encode(content)
                          return f'