[SECCON -Anfänger CTF 2024] Webschreiben

$ find ./ ./ ./docker-compose.yml ./.env ./app ./app/app.py ./app/requirements.txt ./app/dockerfile ./app/uwsgi.ini ./nginx ./nginx/dockerfile ./nginx/nginx.confs

Dienstleistungen: UWSGI: Build: ./app env_file: - .env expose: - "7777" neu starten: immer nginx: bauen:.

Kopieren 

Benutzer nginx; Worker_Processes 1; error_log /var/log/nginx/error.log warn; pid /var/run/nginx.pid; Ereignisse {Worker_Connections 1024; } http {include /etc/nginx/mime.types; Default_type Application/Oktettstrom; log_format main '$ remote_addr - $ remote_user [$ time_local] "$ request"' $ status $ body_bytes_sent "$ http_referer" '"$ http_user_agent" "$ http_x_forwarded_ford_ford_For"'; access_log /var/log/nginx/access.log main; sendFile on; keepalive_timeout 65; Upstream UWSGI {Server UWSGI: 7777; } server {listen 80; Merge_Slashes aus; Ort / {include uwsgi_params; uwsgi_pass uwsgi; }}}

Von Ubuntu: 22.04 env debian_frontend nichtinteraktiven Run APT-Get -y-Update--Fix-Missing && apt-Get -y-Upgrade Run Apt-Get -y-Installation Python3 Python3-Pip-Curl Run Mkdir/var/www workdir/var/www copy. /var/www adduser -U 1000 ssrforlfi user ssrforlfi cmd ["uwsgi", "---ini", "/var/www/uwsgi.ini"]  

Flask == 3.0.0 UWSGI == 2.0.23

[uwsgi] WSGI-file = app.py CALLABLE = APP Master = True Processes = 4 Threads = 4 Socket =: 7777 CHMOD-SOCKET = 666 VACUUM = TRUE Die-auf-Term = True py-autoreload = 1 

OS importieren. Importieren Sie Subprozess aus Flask Import -Flask, app = Flask (__ name__) @app.route ("/") def ssrforlfi (): url = request.args.get ("url") Wenn nicht url: return "Willkommen auf Website -Viewer.<br> <code>?url=http://example.com/</code> " # nur az zulassen", (,),. Wenn nicht re.match ('^[az "() ./:; <>@|]*$', url): Return" Ungültige url; (" # ssrf & lfi Schutz, wenn url.startswith (" http: // ") oder url.startswith (" https: // "):" örtlich "in url: retektiert" in url: retektiert wurde ") (" örtlich "in url:" in url: "in url:" in url: "in url:" in url: "in url:" in url: "in url:" in url: "in url:" in url: "in url. url.startswith("file://"): path = url[7:] if os.path.exists(path) or ".." in path: return "Detected LFI ;(" else: # Block other schemes return "Invalid Scheme ;(" try: # RCE ? proc = subprocess.run( f"curl '{url}'", capture_output=True, shell=True, text=True, timeout=1, ) außer subprocess.timeoutexpired: return "timeout; (" if proc.returncode!

# Ssrf & lfi Schutz Wenn url.startswith ("http: //") oder url.startswith ("https: //"): Wenn "localhost" in url: return "erfasst SSRF; Lfi; ("else: # andere Schemata blockieren zurück" ungültiges Schema; ("