# -*- encoding: utf-8 -*-
'''
@File    :   main.py
@Time    :   2025/03/28 22:20:49
@Author  :   LamentXU 
'''
'''
flag in /flag_{uuid4}
'''
from bottle import Bottle, request, response, redirect, static_file, run, route
with open('../../secret.txt', 'r') as f:
    secret = f.read()

app = Bottle()
@route('/')
def index():
    return '''HI'''
@route('/download')
def download():
    name = request.query.filename
    if '../../' in name or name.startswith('/') or name.startswith('../') or '\\' in name:
        response.status = 403
        return 'Forbidden'
    with open(name, 'rb') as f:
        data = f.read()
    return data

@route('/secret')
def secret_page():
    try:
        session = request.get_cookie("name", secret=secret)
        if not session or session["name"] == "guest":
            session = {"name": "guest"}
            response.set_cookie("name", session, secret=secret)
            return 'Forbidden!'
        if session["name"] == "admin":
            return 'The secret has been deleted!'
    except:
        return "Error!"
run(host='0.0.0.0', port=8080, debug=False)

路径穿越

@route('/download')
def download():
    name = request.query.filename
    if '../../' in name or name.startswith('/') or name.startswith('../') or '\\' in name:
        response.status = 403
        return 'Forbidden'
    with open(name, 'rb') as f:
        data = f.read()
    return data

下载文件的接口，过滤了../../和 \\,../和/开头，这里考的的路径穿越 bypass，只过滤两个../并排，那么./../=../，适当绕过一下就好了。

结合../../secret.txt，给/download传参?filename=./.././../secret.txt，得到：

我们得到了 secret.txt 的内容：Hell0_H@cker_Y0u_A3r_Sm@r7

pickle反序列化

[LilCTF 2025]ez_bottle

from bottle import route, run, template, post, request, static_file, error
import os
import zipfile
import hashlib
import time

# hint: flag in /flag , have a try

UPLOAD_DIR = os.path.join(os.path.dirname(__file__), 'uploads')
os.makedirs(UPLOAD_DIR, exist_ok=True)

STATIC_DIR = os.path.join(os.path.dirname(__file__), 'static')
MAX_FILE_SIZE = 1 * 1024 * 1024

BLACK_DICT = ["{", "}", "os", "eval", "exec", "sock", "<", ">", "bul", "class", "?", ":", "bash", "_", "globals",
              "get", "open"]


def contains_blacklist(content):
    return any(black in content for black in BLACK_DICT)


def is_symlink(zipinfo):
    return (zipinfo.external_attr >> 16) & 0o170000 == 0o120000


def is_safe_path(base_dir, target_path):
    return os.path.realpath(target_path).startswith(os.path.realpath(base_dir))


@route('/')
def index():
    return static_file('index.html', root=STATIC_DIR)


@route('/static/<filename>')
def server_static(filename):
    return static_file(filename, root=STATIC_DIR)


@route('/upload')
def upload_page():
    return static_file('upload.html', root=STATIC_DIR)


@post('/upload')
def upload():
    zip_file = request.files.get('file')
    if not zip_file or not zip_file.filename.endswith('.zip'):
        return 'Invalid file. Please upload a ZIP file.'

    if len(zip_file.file.read()) > MAX_FILE_SIZE:
        return 'File size exceeds 1MB. Please upload a smaller ZIP file.'

    zip_file.file.seek(0)

    current_time = str(time.time())
    unique_string = zip_file.filename + current_time
    md5_hash = hashlib.md5(unique_string.encode()).hexdigest()
    extract_dir = os.path.join(UPLOAD_DIR, md5_hash)
    os.makedirs(extract_dir)

    zip_path = os.path.join(extract_dir, 'upload.zip')
    zip_file.save(zip_path)

    try:
        with zipfile.ZipFile(zip_path, 'r') as z:
            for file_info in z.infolist():
                if is_symlink(file_info):
                    return 'Symbolic links are not allowed.'

                real_dest_path = os.path.realpath(os.path.join(extract_dir, file_info.filename))
                if not is_safe_path(extract_dir, real_dest_path):
                    return 'Path traversal detected.'

            z.extractall(extract_dir)
    except zipfile.BadZipFile:
        return 'Invalid ZIP file.'

    files = os.listdir(extract_dir)
    files.remove('upload.zip')

    return template("文件列表: {{files}}\n访问: /view/{{md5}}/{{first_file}}",
                    files=", ".join(files), md5=md5_hash, first_file=files[0] if files else "nofile")


@route('/view/<md5>/<filename>')
def view_file(md5, filename):
    file_path = os.path.join(UPLOAD_DIR, md5, filename)
    if not os.path.exists(file_path):
        return "File not found."

    with open(file_path, 'r', encoding='utf-8') as f:
        content = f.read()

    if contains_blacklist(content):
        return "you are hacker!!!nonono!!!"

    try:
        return template(content)
    except Exception as e:
        return f"Error rendering template: {str(e)}"


@error(404)
def error404(error):
    return "bbbbbboooottle"


@error(403)
def error403(error):
    return "Forbidden: You don't have permission to access this resource."


if __name__ == '__main__':
    run(host='0.0.0.0', port=5000, debug=False)

UPLOAD_DIR = .../uploads  # 上传的文件存放目录
STATIC_DIR = .../static   # 静态文件目录
MAX_FILE_SIZE = 1 * 1024 * 1024  # 1MB 限制
BLACK_DICT = ["{", "}", "os", "eval", "exec", "sock", "<", ">", "bul", "class", "?", ":", "bash", "_", "globals", "get", "open"]

黑名单基本杜绝了 SSTI 的可能。

检查软链接 & 路径穿越

1 2	def is_symlink(zipinfo): return (zipinfo.external_attr >> 16) & 0o170000 == 0o120000

防止 zip 文件里有软链接。

1 2	def is_safe_path(base_dir, target_path): return os.path.realpath(target_path).startswith(os.path.realpath(base_dir))

防止解压 zip 的时候用 ../ 跳出目录（路径穿越攻击）。

路由功能

`/upload` 上传页面（GET）

返回 upload.html（上传表单）

`/upload` 上传处理（POST）

必须是 .zip 文件
文件大小不能超过 1MB
用 zipfile.ZipFile 解压时：
- 禁止软链接
- 禁止路径穿越
解压到一个用 md5(文件名 + 时间) 生成的唯一目录里
返回文件列表，并提示访问路径 /view/<md5>/<filename>

`/view/<md5>/<filename>`

读取文件内容（纯文本）
如果命中黑名单 → 返回 “you are hacker!!!”
否则调用

1	return template(content)

- **这里的 **`**template()**`** 是 Bottle 框架的模板渲染函数**
- 如果文件内容里是模板语法（类似 `{{...}}`），它会直接执行 **SSTI**

打的过程

% x = “hello world”

输出 x，忽略行尾纯变量，无法利用行尾表达式

过滤花括号和下划线，无法获取对象

一些尝试

underscore = chr(95) 
builtins = underscore*2 + "builtins" + underscore*2
dict = underscore*2 + "builtins" + underscore*2
fn = getattr(import_name, len)
print(fn([1,2,3,4]))  # 应该输出 4

builtins = underscore*2 + "builtins" + underscore*2
dict = underscore*2 + "builtins" + underscore*2
fn = builtins.dict["len"]
print(fn([1,2,3]))

正确思路

一个页面可以上传压缩包，会把他解压放在另一个目录里，并且这个目录可知。

禁止了软链接，路径穿越和 SSTI。

如果总结成这样看，确实是做不出来。但是题目里禁止做的事情，我们一般有两个思路，一是换别的方法做，但是更多情况我们要绕过 bypass 继续用这个事情。当我们上传压缩包的时候，只要是软链接，路径穿越直接上传不上去，那就没办法了。但是我们重新看查看文件的路由：

@route('/view/<md5>/<filename>')
def view_file(md5, filename):
    file_path = os.path.join(UPLOAD_DIR, md5, filename)
    if not os.path.exists(file_path):
        return "File not found."

    with open(file_path, 'r', encoding='utf-8') as f:
        content = f.read()

    if contains_blacklist(content):
        return "you are hacker!!!nonono!!!"

    try:
        return template(content)
    except Exception as e:
        return f"Error rendering template: {str(e)}"

这里包含了黑名单，查看到的是"you are hacker!!!nonono!!!"，但是实际上他还是渲染了，只是不给你看。所以我们通过别的文件看就可以了。

bottle 框架里面%可以执行 python 代码。

也就是我们先上传一个名为 1.tpl 的文件，内容是{{! open('/flag').read()}}，来获得 flag。

在 /upload 处理函数里：

current_time = str(time.time())
unique_string = zip_file.filename + current_time
md5_hash = hashlib.md5(unique_string.encode()).hexdigest()
extract_dir = os.path.join(UPLOAD_DIR, md5_hash)
os.makedirs(extract_dir)