NSS [NISACTF 2022]babyupload
源码给了提示，/source路径
访问后得到一个文件，是源码
from flask import Flask, request, redirect, g, send_from_directory import sqlite3 import os import uuid app = Flask(__name__) SCHEMA = """CREATE TABLE files ( id text primary key, path text ); """ def db(): g_db = getattr(g, '_database', None) if g_db is None: g_db = g._database = sqlite3.connect("database.db") return g_db @app.before_first_request def setup(): os.remove("database.db") cur = db().cursor() cur.executescript(SCHEMA) @app.route('/') 【#返回源码】 def hello_world(): return """<!DOCTYPE html> <html> <body> <form action="/upload" method="post" enctype="multipart/form-data"> Select image to upload: <input type="file" name="file"> <input type="submit" value="Upload File" name="submit"> </form> <!-- /source --> </body> </html>""" @app.route('/source') 【#访问时下载文件】 def source(): return send_from_directory(directory="/var/www/html/", path="www.zip", as_attachment=True) @app.route('/upload', methods=['POST']) def upload(): if 'file' not in request.files: return redirect('/') file = request.files['file'] if "." in file.filename: 【#过滤了带文件名中带 . 的文件。】 return "Bad filename!", 403 conn = db() cur = conn.cursor() uid = uuid.uuid4().hex 【#这个代码是进行一个sql语句，表示增加一个数据，数据为uid和文件名。】 【#因此我们只需要传输一个文件名为/flag的文件就可以得到flag的uid。然后再访问对应路径就可以得到flag】 try: cur.execute("insert into files (id, path) values (?, ?)", (uid, file.filename,)) except sqlite3.IntegrityError: return "Duplicate file" conn.commit() file.save('uploads/' + file.filename) return redirect('/file/' + uid) @app.route('/file/<id>') def file(id): conn = db() cur = conn.cursor() cur.execute("select path from files where id=?", (id,)) res = cur.fetchone() if res is None: return "File not found", 404 # print(res[0]) with open(os.path.join("uploads/", res[0]), "r") as f: return f.read() if __name__ == '__main__': app.run(host='0.0.0.0', port=80)
1、随便选择一个文件 
2、抓包，修改文件名字为/flag
3、访问返回的文件路径即得flag
![NSS [NISACTF 2022]popchains](https://ucc.alicdn.com/pic/developer-ecology/hx2ljjpnymv5w_f6e2bcd783b64f37987dbb4509637e95.png?x-oss-process=image/resize,h_160,m_lfit)