{"id":139980,"date":"2025-08-03T11:11:54","date_gmt":"2025-08-03T09:11:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/dostizhenie-vypolneniya-koda-pri-kontrole-nad-tekstom-kommentariya-v-python-skripte"},"modified":"2025-08-03T11:11:54","modified_gmt":"2025-08-03T09:11:56","slug":"dostizhenie-vypolneniya-koda-pri-kontrole-nad-tekstom-kommentariya-v-python-skripte","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/dostizhenie-vypolneniya-koda-pri-kontrole-nad-tekstom-kommentariya-v-python-skripte","title":{"rendered":"Koodi t\u00e4itmine kommentaariteksti kontrollimise kaudu Python skriptis","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00dcks UIUCTF 2025 v\u00f5istluse osalejatest selgitas p\u00f5hjalikult, kuidas tal \u00f5nnestus t\u00e4ita \u00fclesanne, milleks oli koodi k\u00e4ivitamine serveris, muutes vaid koodikommentaari teksti sisu. <\/p>\n

Osalejad said saida v\u00f5rgu p\u00e4ring Python-skriptile, mis genereeris uue Python-skripti juhuslikuga nimega, lisades kasutajalt saadud andmed kommentaaride tekstis, l\u00f5igates v\u00e4lja s\u00fcmbolid «\n» ja «\r», ning k\u00e4ivitas selle skripti k\u00e4suga «python3 nimi.py». Kontrollides ainult kommentaari sisu, pidi osaleja faili «\\\/home\\\/ctfuser\\\/flag» rea v\u00e4lja v\u00f5tmise. Skript loodi j\u00e4rgmise koodiga: comment = input(«> «).replace(«\n», «»).replace(«\r», «») code = f»»»print(«hello world!») # See on kommentaar. Siin on teine: # {comment} print(«Thanks for playing!»)»»» <\/p>\n

Kohaldati andmed, mis said {comment} koha, ja l\u00f5puks k\u00e4ivitati j\u00e4rgmine kood: print(«hello world!») # See on kommentaar. Siin on teine: # Osalejalt saadud andmed print(«Thanks for playing!») <\/p>\n

\u00dclesanne p\u00f5hines haavatavusel CPython'i parseris, mis t\u00f6\u00f6tles nullkoodiga s\u00fcmbolit reae l\u00f5petamisena (n\u00e4iteks, seda haavatavust v\u00f5is kasutada pahatahtlike toimingute peitmiseks kommentaari tekstis). Probleem lahendati CPython versioonides 3.12.0 ja 3.11.4. V\u00f5istlusel kasutatav t\u00f6\u00f6tleja l\u00f5ikas v\u00e4lja ainult s\u00fcmbolid «\n» ja «\r», kuid haavatava CPython versiooni kasutamisel v\u00f5is osaleja kasutada s\u00fcmbolit «\0» jakoht. Siiski see trikk ei \u00f5nnestunud, kuna v\u00f5istlusel kasutati juba parendatud versiooni CPythonist, oodates, et parseris v\u00f5ivad olla veel sarnased vead, mida osalejad saavad avastada. <\/p>\n

\u00dclesandega edukalt toime tulnud osaleja ei hakanud otsima uusi haavatavusi parseris, mis v\u00f5imaldaks jagada ridasid osadeks, vaid kasutas Python'i t\u00f6\u00f6tluse erip\u00e4ra failide t\u00fc\u00fcbist sisu j\u00e4rgi. N\u00e4iteks, algse koodi asemel v\u00f5ib failiga, millel on laiend «.py», paigutada vahem\u00e4lus olevat baitkoodi, mis on salvestatud failides, millel on laiend «.pyc», ning sellist faili t\u00f6\u00f6deldakse. Vaadeldavas konkursis sai osaleja kontrollida ainult sisu failide keskel, seet\u00f5ttu ei suutnud ta oma pealkirja lisada MIME-t\u00fc\u00fcbi moonutamiseks. <\/p>\n

Probleemi \u00f5nnestus lahendada, kasutades seda, et Python alates versioonist 2.6 suudab t\u00e4ita ZIP-arhiivide sisu, et esitada Python-pakette komprimeeritud kujul. Nagu ka bytecode'i vahem\u00e4lu puhul, m\u00e4\u00e4ratakse ZIP-arhiivi olemasolu sisu, mitte faili laiuse j\u00e4rgi, st failisse «fail.py» v\u00f5ib paigutada ZIP-arhiivi ja k\u00e4ivitamisel k\u00e4suga «python fail.py» t\u00f6\u00f6deldakse seda nagu komprimeeritud Python-paketti. Samuti indekseeritakse ZIP-arhiive Pythoni puhul mitte faili alguses oleva pealkirja, vaid faili l\u00f5pus oleva EOCD (End of Central Directory Record) sektsiooni j\u00e4rgi. Kui arhiivis on fail «__main__.py», k\u00e4ivitatakse see automaatselt, kui arhiivi k\u00e4ivitatakse k\u00e4suga «python arhiiv». <\/p>\n

Konkursi \u00fclesanne lahendati sarnase ZIP-arhiivi genereerimise ja selle substitutsiooniga kommentaari tekstis. Faili struktuuri \u00f5igsuse tagamiseks, arvestades, et algfaili l\u00f5pus on k\u00e4su ‘print(«Thanks for playing!»)’ kutse, kasutati EOCD-sektsiooni kommenteerimisala olemasolu, mis paikneb faili l\u00f5pus.

\"Koodi<\/center>
\"Koodi<\/center>
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u0434\u0438\u043d \u0438\u0437 \u0443\u0447\u0430\u0441\u0442\u043d\u0438\u043a\u043e\u0432 \u0441\u043e\u0440\u0435\u0432\u043d\u043e\u0432\u0430\u043d\u0438\u044f UIUCTF 2025, \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u0440\u0430\u0437\u043e\u0431\u0440\u0430\u043b, \u043a\u0430\u043a \u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0437\u0430\u0434\u0430\u043d\u0438\u0435, \u0442\u0440\u0435\u0431\u0443\u044e\u0449\u0435\u0435 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435, \u0438\u043c\u0435\u044f \u043b\u0438\u0448\u044c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u0442\u0435\u043a\u0441\u0442\u0430 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f \u0432 \u043a\u043e\u0434\u0435. \u0423\u0447\u0430\u0441\u0442\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u043b\u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0437\u0430\u043f\u0440\u043e\u0441 \u043a Python-\u0441\u043a\u0440\u0438\u043f\u0442\u0443, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u043b \u043d\u043e\u0432\u044b\u0439 Python-\u0441\u043a\u0440\u0438\u043f\u0442 c\u043e \u0441\u043b\u0443\u0447\u0430\u0439\u043d\u044b\u043c\u0438 \u0438\u043c\u0435\u043d\u0435\u043c, \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u043b \u043f\u043e\u0441\u0442\u0443\u043f\u0438\u0432\u0448\u0438\u0435 \u043e\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u0442\u0435\u043a\u0441\u0442 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f, \u0432\u044b\u0440\u0435\u0437\u0430\u0432 \u0441\u0438\u043c\u0432\u043e\u043b\u044b «\n» \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":139981,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-139980","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Koodi t\u00e4itmise saavutamine, kui kontroll on kommentaariteksti \u00fcle Python-skripti | ProHoster","description":"\u00dcks UIUCTF 2025 v\u00f5istluse osalejatest kirjeldas \u00fcksikasjalikult, kuidas tal \u00f5nnestus \u00fclesanne lahendada, mis n\u00f5udis oma koodi t\u00e4itmist serveris, olles ainus, kes sai muuta kommentaariteksti.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/dostizhenie-vypolneniya-koda-pri-kontrole-nad-tekstom-kommentariya-v-python-skripte","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0414\u043e\u0441\u0442\u0438\u0436\u0435\u043d\u0438\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0435 \u043d\u0430\u0434 \u0442\u0435\u043a\u0441\u0442\u043e\u043c \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f \u0432 Python-\u0441\u043a\u0440\u0438\u043f\u0442\u0435 | ProHoster","og:description":"\u041e\u0434\u0438\u043d \u0438\u0437 \u0443\u0447\u0430\u0441\u0442\u043d\u0438\u043a\u043e\u0432 \u0441\u043e\u0440\u0435\u0432\u043d\u043e\u0432\u0430\u043d\u0438\u044f UIUCTF 2025, \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u0440\u0430\u0437\u043e\u0431\u0440\u0430\u043b, \u043a\u0430\u043a \u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0437\u0430\u0434\u0430\u043d\u0438\u0435, \u0442\u0440\u0435\u0431\u0443\u044e\u0449\u0435\u0435 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435, \u0438\u043c\u0435\u044f \u043b\u0438\u0448\u044c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u0442\u0435\u043a\u0441\u0442\u0430 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/dostizhenie-vypolneniya-koda-pri-kontrole-nad-tekstom-kommentariya-v-python-skripte","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-08-03T09:11:56+00:00","article:modified_time":"2025-08-03T09:11:56+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"139980","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 14:07:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 14:07:19","updated":"2026-01-23 14:07:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/139980","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=139980"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/139980\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/139981"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=139980"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=139980"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=139980"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}