Unicode的危害(HCTF_admin) - 《学习笔记》

Unicode的危害(HCTF_admin) - 图1

题目的大致思路就应该让我们成为admin吧

随便注册了一个后，发现有一个更改密码

Unicode的危害(HCTF_admin) - 图2

之前题目的经验，那应该找回密码有漏洞的。抓包后发现，我们用户名买这个id参数修改不了

Unicode的危害(HCTF_admin) - 图3

session到是有，那我们进去以后源码就出来了

Unicode的危害(HCTF_admin) - 图4

Unicode的危害(HCTF_admin) - 图5

将所给地址源码下载下来,便是这道题的源码了,使用flask框架写的,先看看routes.py,看看都允许访问哪些路径吧

@app.route('/code')
...//生成验证码
@app.route('/')
@app.route('/index')
...
@app.route('/register', methods = ['GET', 'POST'])
def register():
    if current_user.is_authenticated:
        return redirect(url_for('index'))
    form = RegisterForm()
    if request.method == 'POST':
        name = strlower(form.username.data)
        if session.get('image').lower() != form.verify_code.data.lower():
            flash('Wrong verify code.')
            return render_template('register.html', title = 'register', form=form)
        if User.query.filter_by(username = name).first():
            flash('The username has been registered')
            return redirect(url_for('register'))
        user = User(username=name)
        user.set_password(form.password.data)
        db.session.add(user)
        db.session.commit()
        flash('register successful')
        return redirect(url_for('login'))
    return render_template('register.html', title = 'register', form = form)
@app.route('/login', methods = ['GET', 'POST'])
def login():
    if current_user.is_authenticated:
        return redirect(url_for('index'))
    form = LoginForm()
    if request.method == 'POST':
        name = strlower(form.username.data)
        session['name'] = name
        user = User.query.filter_by(username=name).first()
        if user is None or not user.check_password(form.password.data):
            flash('Invalid username or password')
            return redirect(url_for('login'))
        login_user(user, remember=form.remember_me.data)
        return redirect(url_for('index'))
    return render_template('login.html', title = 'login', form = form)
@app.route('/logout')
...
@app.route('/change', methods = ['GET', 'POST'])
def change():
    if not current_user.is_authenticated:
        return redirect(url_for('login'))
    form = NewpasswordForm()
    if request.method == 'POST':
        name = strlower(session['name'])
        user = User.query.filter_by(username=name).first()
        user.set_password(form.newpassword.data)
        db.session.commit()
        flash('change successful')
        return redirect(url_for('index'))
    return render_template('change.html', title = 'change', form = form)
@app.route('/edit', methods = ['GET', 'POST'])
.....
@app.errorhandler(404)
.....
def strlower(username):
    username = nodeprep.prepare(username)
    return username