{"id":2111,"date":"2025-03-18T21:30:34","date_gmt":"2025-03-18T13:30:34","guid":{"rendered":"http:\/\/gzxingyu.cloud\/?p=2111"},"modified":"2025-03-18T21:30:35","modified_gmt":"2025-03-18T13:30:35","slug":"nisactf-2022babyupload","status":"publish","type":"post","link":"http:\/\/gzxingyu.cloud\/index.php\/2025\/03\/18\/nisactf-2022babyupload\/","title":{"rendered":"NISACTF 2022babyupload"},"content":{"rendered":"

\"Pasted<\/p>\n

\u4e00\u3001\u8bbf\u95ee\u7f51\u5740<\/h1>\n

\"Pasted<\/p>\n

\u4e8c\u3001\u67e5\u770b\u6e90\u4ee3\u7801<\/h1>\n

\"Pasted<\/div>
\n\u53d1\u73b0\/source<\/code><\/p>\n

\u4e09\u3001\u8bbf\u95ee\uff0c\u4e0b\u8f7d\u538b\u7f29\u6587\u4ef6<\/h1>\n

\"Pasted<\/div>
\n\u89e3\u538b\u540e\uff0c\u53d1\u73b0\u662fpython\u4ee3\u7801<\/p>\n
from flask import Flask, request, redirect, g, send_from_directory  \nimport sqlite3  \nimport os  \nimport uuid  \n  \napp = Flask(__name__)  \n  \nSCHEMA = """CREATE TABLE files (  \nid text primary key,  \npath text  \n);  \n"""  \n  \n  \ndef db():  \n    g_db = getattr(g, '_database', None)  \n    if g_db is None:  \n        g_db = g._database = sqlite3.connect("database.db")  \n    return g_db  \n  \n  \n@app.before_first_request  \ndef setup():  \n    os.remove("database.db")  \n    cur = db().cursor()  \n    cur.executescript(SCHEMA)  \n  \n  \n@app.route('\/')  \ndef hello_world():  \n    return """<!DOCTYPE html>  \n<html>  \n<body>  \n<form action="\/upload" method="post" enctype="multipart\/form-data">  \n    Select image to upload:    <input type="file" name="file">    <input type="submit" value="Upload File" name="submit"><\/form>  \n<!-- \/source -->  \n<\/body>  \n<\/html>"""  \n  \n  \n@app.route('\/source')  \ndef source():  \n    return send_from_directory(directory="\/var\/www\/html\/", path="www.zip", as_attachment=True)  \n  \n  \n@app.route('\/upload', methods=['POST'])  \ndef upload():  \n    if 'file' not in request.files:  \n        return redirect('\/')  \n    file = request.files['file']  \n    if "." in file.filename:  \n        return "Bad filename!", 403  \n    conn = db()  \n    cur = conn.cursor()  \n    uid = uuid.uuid4().hex  \n    try:  \n        cur.execute("insert into files (id, path) values (?, ?)", (uid, file.filename,))  \n    except sqlite3.IntegrityError:  \n        return "Duplicate file"  \n    conn.commit()  \n  \n    file.save('uploads\/' + file.filename)  \n    return redirect('\/file\/' + uid)  \n  \n  \n@app.route('\/file\/<id>')  \ndef file(id):  \n    conn = db()  \n    cur = conn.cursor()  \n    cur.execute("select path from files where id=?", (id,))  \n    res = cur.fetchone()  \n    if res is None:  \n        return "File not found", 404  \n  \n    # print(res[0])  \n  \n    with open(os.path.join("uploads\/", res[0]), "r") as f:  \n        return f.read()  \n  \n  \nif __name__ == '__main__':  \n    app.run(host='0.0.0.0', port=80)\n<\/code><\/pre>\n
\u56db\u3001\u5206\u6790\u4ee3\u7801<\/h1>\n
@app.route('\/upload', methods=['POST'])  \ndef upload():  \n    if 'file' not in request.files:  \n        return redirect('\/')  \n    file = request.files['file']  \n    if "." in file.filename:  \n        return "Bad filename!", 403  \n    conn = db()  \n    cur = conn.cursor()  \n    uid = uuid.uuid4().hex  \n    try:  \n        cur.execute("insert into files (id, path) values (?, ?)", (uid, file.filename,))  \n    except sqlite3.IntegrityError:  \n        return "Duplicate file"  \n    conn.commit()  \n  \n    file.save('uploads\/' + file.filename)  \n    return redirect('\/file\/' + uid)  \n<\/code><\/pre>\n
\u5982\u679c\u6587\u4ef6\u540d\u4e2d\u6709.<\/code>\uff0c\u5219\u8fd4\u56de403<\/p>\n
@app.route('\/file\/<id>')  \ndef file(id):  \n    conn = db()  \n    cur = conn.cursor()  \n    cur.execute("select path from files where id=?", (id,))  \n    res = cur.fetchone()  \n    if res is None:  \n        return "File not found", 404  \n  \n    # print(res[0])  \n  \n    with open(os.path.join("uploads\/", res[0]), "r") as f:  \n        return f.read()  \n<\/code><\/pre>\n
os.path.join("uploads\/", res[0])<\/code>\u00a0\u7528\u4e8e\u5c06\u00a0uploads\/<\/code>\u00a0\u76ee\u5f55\u548c\u67e5\u8be2\u7ed3\u679c\u4e2d\u7684\u00a0path<\/code>\u00a0\u5b57\u6bb5\u503c\u62fc\u63a5\u6210\u5b8c\u6574\u7684\u6587\u4ef6\u8def\u5f84\u3002<\/p>\n
os.path.join(path,*paths)<\/code>\u51fd\u6570\u7279\u6027\u5982\u679c\u62fc\u63a5\u7684\u67d0\u4e2a\u8def\u5f84\u4ee5 \/ \u5f00\u5934\uff0c\u90a3\u4e48\u5305\u62ec\u57fa\u7840\u8def\u5f84\u5728\u5185\u7684\u6240\u6709\u524d\u7f00\u8def\u5f84\u90fd\u5c06\u88ab\u5220\u9664\uff0c\u8be5\u8def\u5f84\u5c06\u89c6\u4e3a\u7edd\u5bf9\u8def\u5f84<\/p>\n
\u4e94\u3001\u83b7\u53d6flag<\/h1>\n
\"Pasted<\/div>
\n\"Pasted<\/p>\n
\u603b\u7ed3<\/h1>\n
    \n
  • os.path.join(path,*paths)<\/code>\u51fd\u6570\u7279\u6027\uff1a\u5982\u679c\u62fc\u63a5\u7684\u67d0\u4e2a\u8def\u5f84\u4ee5 \/ \u5f00\u5934\uff0c\u90a3\u4e48\u5305\u62ec\u57fa\u7840\u8def\u5f84\u5728\u5185\u7684\u6240\u6709\u524d\u7f00\u8def\u5f84\u90fd\u5c06\u88ab\u5220\u9664\uff0c\u8be5\u8def\u5f84\u5c06\u89c6\u4e3a\u7edd\u5bf9\u8def\u5f84<\/li>\n
  • python\u7684flask\u6846\u67b6<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"
    \u4e00\u3001\u8bbf\u95ee\u7f51\u5740 \u4e8c\u3001\u67e5\u770b\u6e90\u4ee3\u7801 \u53d1\u73b0\/source \u4e09\u3001\u8bbf\u95ee\uff0c\u4e0b\u8f7d\u538b\u7f29\u6587\u4ef6 \u89e3\u538b\u540e\uff0c\u53d1\u73b0\u662fpython\u4ee3\u7801 fr […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8,22,23],"tags":[39],"class_list":["post-2111","post","type-post","status-publish","format-standard","hentry","category-ctf","category-ctf-web","category-nssctf","tag-39"],"_links":{"self":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/2111","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/comments?post=2111"}],"version-history":[{"count":1,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/2111\/revisions"}],"predecessor-version":[{"id":2112,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/2111\/revisions\/2112"}],"wp:attachment":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/media?parent=2111"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/categories?post=2111"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/tags?post=2111"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}