SSTI模板注入

[护网杯 2018]easy_tornado

ssti 注入点在 msg
注入49出现 orz 应该是有过滤

1正常

hint 里缺 cookie_secret
该项在 handler.settings

Handler 这个对象，Handler 指向的处理当前这个页面的 RequestHandler 对象
RequestHandler 中并没有 settings 这个属性，与 RequestHandler 关联的 Application 对象（Requestion.application）才有 setting 这个属性
handler 指向 RequestHandler
而 RequestHandler.settings 又指向 self.application.settings
所有 handler.settings 就指向 RequestHandler.application.settings 了！

然后按 hint 里的 MD5 加密过后传参

1

?filename=/fllllllllllllag&filehash=ff92d5623223cadc00efabfc7676f9fe

filehash 不同 请自行加密

[BJDCTF2020]The mystery of ip

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

<?php
	require_once('header.php');
	require_once('./libs/Smarty.class.php');
	$smarty = new Smarty();
	if (!empty($_SERVER['HTTP_CLIENT_IP']))
	{
		   $ip=$_SERVER['HTTP_CLIENT_IP'];
	}
	elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR']))
	{
	    $ip=$_SERVER['HTTP_X_FORWARDED_FOR'];
	}
	else
	{
	    $ip=$_SERVER['REMOTE_ADDR'];
	}
	//$your_ip = $smarty->display("string:".$ip);
	echo "<div class=\"container panel1\">
				<div class=\"row\">
				<div class=\"col-md-4\">
				</div>
				<div class=\"col-md-4\">
				<div class=\"jumbotron pan\">
					<div class=\"form-group log\">
						<label><h2>Your IP is : ";
	$smarty->display("string:".$ip);
	echo "				</h2></label>
					</div>
				</div>
				</div>
				<div class=\"col-md-4\">
				</div>
				</div>
			</div>";
	?>

[BJDCTF2020]Cookie is so stable