2024矩阵杯战队攻防对抗赛WP WEB&MISC篇

文章预览

Web v_You_a_shell 看到根目录有个start.sh，没有权限读取flag 可以看到启动了两个python，一个是py用户，一个是root用户 app.py import base64 import hashlib import pickle import random import threading import time import dbus import dbus.service import dbus.mainloop.glib from gi.repository import GLib from flask import Flask, session, request app = Flask(__name__) secretKey = "" def setSecretKet () : global secretKey secretKey = hashlib.md5(random.randbytes( 16 )).hexdigest() setSecretKet() app.secret_key = secretKey loginList = {} login_fail_times = 0 class MyDBusService (dbus.service.Object) : def __init__ (self, bus_name, object_path) : dbus.service.Object.__init__(self, bus_name, object_path) @dbus.service.method("ctf.syncServer", in_signature='', out_signature='s') def ping (self) : return "pong" @dbus.service.method("ctf.syncServer", in_signature='ss', out_signature='s') def ………………………………