Nmap [root@Hacking] /home/kali/CodeTwo ❯ nmap codetwo.htb -A PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.13 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 a0:47:b4:0c:69:67:93:3a:f9:b4:5d:b3:2f:bc:9e:23 (RSA) | 256 7d:44:3f:f1:b1:e2:bb:3d:91:d5:da:58:0f:51:e5:ad (ECDSA) |_ 256 f1:6b:1d:36:18:06:7a:05:3f:07:57:e1:ef:86:b4:85 (ED25519) 8000/tcp open http Gunicorn 20.0.4 |_http-title: Welcome to CodeTwo |_http-server-header: gunicorn/20.0.4 Device type: general purpose CVE-2024-28397 发现存在/download路由可以下载源码
from flask import Flask, render_template, request, redirect, url_for, session, jsonify, send_from_directory from flask_sqlalchemy import SQLAlchemy import hashlib import js2py import os import json js2py.disable_pyimport() app = Flask(__name__) app.secret_key = 'S3cr3tK3yC0d3Tw0' app.config['SQLALCHEMY_DATABASE_URI'] = 'sqlite:///users.db' app.config['SQLALCHEMY_TRACK_MODIFICATIONS'] = False db = SQLAlchemy(app) class User(db.Model): id = db.Column(db.Integer, primary_key=True) username = db.Column(db.String(80), unique=True, nullable=False) password_hash = db.Column(db.String(128), nullable=False) class CodeSnippet(db.Model): id = db.Column(db.Integer, primary_key=True) user_id = db.Column(db.Integer, db.ForeignKey('user.id'), nullable=False) code = db.Column(db.Text, nullable=False) @app.route('/') def index(): return render_template('index.html') @app.route('/dashboard') def dashboard(): if 'user_id' in session: user_codes = CodeSnippet.query.filter_by(user_id=session['user_id']).all() return render_template('dashboard.html', codes=user_codes) return redirect(url_for('login')) @app.route('/register', methods=['GET', 'POST']) def register(): if request.method == 'POST': username = request.form['username'] password = request.form['password'] password_hash = hashlib.md5(password.encode()).hexdigest() new_user = User(username=username, password_hash=password_hash) db.session.add(new_user) db.session.commit() return redirect(url_for('login')) return render_template('register.html') @app.route('/login', methods=['GET', 'POST']) def login(): if request.method == 'POST': username = request.form['username'] password = request.form['password'] password_hash = hashlib.md5(password.encode()).hexdigest() user = User.query.filter_by(username=username, password_hash=password_hash).first() if user: session['user_id'] = user.id session['username'] = username; return redirect(url_for('dashboard')) return "Invalid credentials" return render_template('login.html') @app.route('/logout') def logout(): session.pop('user_id', None) return redirect(url_for('index')) @app.route('/save_code', methods=['POST']) def save_code(): if 'user_id' in session: code = request.json.get('code') new_code = CodeSnippet(user_id=session['user_id'], code=code) db.session.add(new_code) db.session.commit() return jsonify({"message": "Code saved successfully"}) return jsonify({"error": "User not logged in"}), 401 @app.route('/download') def download(): return send_from_directory(directory='/home/app/app/static/', path='app.zip', as_attachment=True) @app.route('/delete_code/<int:code_id>', methods=['POST']) def delete_code(code_id): if 'user_id' in session: code = CodeSnippet.query.get(code_id) if code and code.user_id == session['user_id']: db.session.delete(code) db.session.commit() return jsonify({"message": "Code deleted successfully"}) return jsonify({"error": "Code not found"}), 404 return jsonify({"error": "User not logged in"}), 401 @app.route('/run_code', methods=['POST']) def run_code(): try: code = request.json.get('code') result = js2py.eval_js(code) return jsonify({'result': result}) except Exception as e: return jsonify({'error': str(e)}) if __name__ == '__main__': with app.app_context(): db.create_all() app.run(host='0.0.0.0', debug=True) 注意到/run_code接收参数，然后传递到js2py.eval_js，搜索可以得知如何逃逸
...