{"id":139980,"date":"2025-08-03T11:11:54","date_gmt":"2025-08-03T09:11:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/dostizhenie-vypolneniya-koda-pri-kontrole-nad-tekstom-kommentariya-v-python-skripte"},"modified":"2025-08-03T11:11:54","modified_gmt":"2025-08-03T09:11:56","slug":"dostizhenie-vypolneniya-koda-pri-kontrole-nad-tekstom-kommentariya-v-python-skripte","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/dostizhenie-vypolneniya-koda-pri-kontrole-nad-tekstom-kommentariya-v-python-skripte","title":{"rendered":"K\u00f3d v\u00e9grehajt\u00e1s\u00e1nak el\u00e9r\u00e9se a komment sz\u00f6veg\u00e9nek ellen\u0151rz\u00e9s\u00e9vel a Python szkriptben","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

A UIUCTF 2025 verseny egyik r\u00e9sztvev\u0151je r\u00e9szletesen elmagyar\u00e1zta, hogyan siker\u00fclt v\u00e9grehajtania a feladatot, amely megk\u00f6vetelte, hogy a k\u00f3d kommentj\u00e9nek tartalm\u00e1nak megv\u00e1ltoztat\u00e1s\u00e1val el\u00e9rje a k\u00f3d v\u00e9grehajt\u00e1s\u00e1t a szerveren. <\/p>\n

A r\u00e9sztvev\u0151k h\u00e1l\u00f3zati k\u00e9r\u00e9st k\u00fcldhettek egy Python-szkripthez, amely \u00faj Python-szkriptet hozott l\u00e9tre v\u00e9letlenszer\u0171 n\u00e9vvel, hozz\u00e1adta a felhaszn\u00e1l\u00f3t\u00f3l \u00e9rkez\u0151 adatokat a megjegyz\u00e9s sz\u00f6veg\u00e9hez, elt\u00e1vol\u00edtva a «\n» \u00e9s «\r» karaktereket, majd a «python3 n\u00e9v.py» paranccsal futtatta ezt a szkriptet. Csak a megjegyz\u00e9s tartalm\u00e1t ir\u00e1ny\u00edtva a r\u00e9sztvev\u0151nek le kellett vonnia egy sort a «\/home\/ctfuser\/flag» f\u00e1jlb\u00f3l. A szkript a k\u00f6vetkez\u0151 k\u00f3d seg\u00edts\u00e9g\u00e9vel k\u00e9sz\u00fclt: comment = input(«> «).replace(«\n», «»).replace(«\r», «») code = f»»»print(«hello world!») # Ez egy megjegyz\u00e9s. Itt egy m\u00e1sik: # {comment} print(«K\u00f6sz\u00f6nj\u00fck a j\u00e1t\u00e9kot!»)»»» <\/p>\n

A «{comment}» hely\u00e9re a r\u00e9sztvev\u0151t\u0151l \u00e9rkez\u0151 adatok ker\u00fcltek, \u00e9s v\u00e9g\u00fcl a k\u00f6vetkez\u0151 k\u00f3d futott: print(«hello world!») # Ez egy megjegyz\u00e9s. Itt egy m\u00e1sik: # A verseny r\u00e9sztvev\u0151j\u00e9t\u0151l kapott adatok print(«K\u00f6sz\u00f6nj\u00fck a j\u00e1t\u00e9kot!») <\/p>\n

A feladat a CPython parser\u00e9ben felfedezett s\u00e9r\u00fcl\u00e9kenys\u00e9g alapj\u00e1n k\u00e9sz\u00fclt, amely a null\u00e1s karaktert vonalk\u00e9nt kezelte (a s\u00e9r\u00fcl\u00e9kenys\u00e9gr\u0151l p\u00e9ld\u00e1ul el lehetett rejteni rosszindulat\u00fa tev\u00e9kenys\u00e9geket a megjegyz\u00e9s sz\u00f6veg\u00e9ben). A probl\u00e9m\u00e1t a CPython 3.12.0 \u00e9s 3.11.4 kiad\u00e1s\u00e1ban orvosolt\u00e1k. A versenyben alkalmazott feldolgoz\u00f3 csak a «\n» \u00e9s «\r» karaktereket v\u00e1gta ki, de a s\u00e9r\u00fcl\u00e9keny v\u00e1ltozat haszn\u00e1latakor a r\u00e9sztvev\u0151 a «» karaktert oszt\u00f3k\u00e9nt haszn\u00e1lhatta. Ennek ellen\u00e9re ez a tr\u00fckk nem m\u0171k\u00f6d\u00f6tt, mivel a verseny m\u00e1r jav\u00edtott verzi\u00f3t haszn\u00e1lt, figyelembe v\u00e9ve, hogy a parserben m\u00e9g lehetnek hasonl\u00f3 hib\u00e1k, \u00e9s a r\u00e9sztvev\u0151k k\u00e9pesek lesznek ezeket azonos\u00edtani. <\/p>\n

A sikeresen v\u00e9grehajt\u00f3 r\u00e9sztvev\u0151 nem keresett \u00faj s\u00e9r\u00fcl\u00e9kenys\u00e9geket a parserben, amelyek lehet\u0151v\u00e9 tett\u00e9k volna, hogy a sz\u00f6veget r\u00e9szekre bontsa, hanem kihaszn\u00e1lta a Python t\u00edpus\u00fa f\u00e1jlok tartalma szerinti futtathat\u00f3s\u00e1g\u00e1nak saj\u00e1toss\u00e1g\u00e1t. P\u00e9ld\u00e1ul a .py kiterjeszt\u00e9s\u0171 f\u00e1jlnak a forr\u00e1sk\u00f3dja helyett a .pyc kiterjeszt\u00e9s\u0171 f\u00e1jlokban t\u00e1rolt el\u0151t\u00e1rolt b\u00e1jt-k\u00f3dot is be lehet helyezni, \u00e9s egy ilyen f\u00e1jlt v\u00e9gre fognak hajtani. A vizsg\u00e1lt versenyben a r\u00e9sztvev\u0151 csak a f\u00e1jl k\u00f6z\u00e9ps\u0151 tartalm\u00e1t ir\u00e1ny\u00edthatta, ez\u00e9rt nem tudott saj\u00e1t fejl\u00e9cet hozz\u00e1adni a MIME-t\u00edpus eltorz\u00edt\u00e1s\u00e1hoz. <\/p>\n

A feladat megoldhat\u00f3 volt, mivel a Python 2.6-t\u00f3l kezdve a ZIP-arch\u00edvumok tartalm\u00e1t k\u00e9pes futtatni, lehet\u0151v\u00e9 t\u00e9ve Python csomagok t\u00f6m\u00f6r\u00edtett form\u00e1ban t\u00f6rt\u00e9n\u0151 sz\u00e1ll\u00edt\u00e1s\u00e1t. Ahogyan a bytecode gyors\u00edt\u00f3t\u00e1raz\u00e1s eset\u00e9ben is, a ZIP-arch\u00edvumok megl\u00e9t\u00e9t a tartalmuk, nem pedig a f\u00e1jl kiterjeszt\u00e9se hat\u00e1rozza meg, teh\u00e1t a \u201ef\u00e1jl.py\u201d-be ZIP-arch\u00edvum is helyezhet\u0151, \u00e9s a \u201epython f\u00e1jl.py\u201d parancs futtat\u00e1sakor t\u00f6m\u00f6r\u00edtett Python-csomagk\u00e9nt kezelik. A Pythonban a ZIP-arch\u00edvumokat nem a f\u00e1jl elej\u00e9n tal\u00e1lhat\u00f3 fejl\u00e9c, hanem a f\u00e1jl v\u00e9g\u00e9n l\u00e9v\u0151 EOCD (End of Central Directory Record) szakasz alapj\u00e1n indexelik. Ha az arch\u00edvumban tal\u00e1lhat\u00f3 egy \u201e__main__.py\u201d f\u00e1jl, ez automatikusan lefut a parancs \u201epython arch\u00edvum\u201d v\u00e9grehajt\u00e1sakor. <\/p>\n

A versenyk\u00e9pess\u00e9gi feladatot egy hasonl\u00f3 ZIP-arch\u00edvum gener\u00e1l\u00e1s\u00e1val \u00e9s annak behelyettes\u00edt\u00e9s\u00e9vel oldott\u00e1k meg a komment\u00e1r sz\u00f6veg\u00e9be. A f\u00e1jl strukt\u00far\u00e1j\u00e1nak helyess\u00e9ge \u00e9rdek\u00e9ben, tekintettel arra, hogy a forr\u00e1sf\u00e1jl v\u00e9g\u00e9n l\u00e9v\u0151 \u2018print(\u2018Thanks for playing!\u2019)\u2019 h\u00edv\u00e1s jelen van, az EOCD-szakasz v\u00e9g\u00e9n elhelyezett megjegyz\u00e9s ter\u00fclet\u00e9nek lehet\u0151s\u00e9geit haszn\u00e1ltuk.

\"K\u00f3d<\/center>
\"K\u00f3d<\/center>
\n
Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u0434\u0438\u043d \u0438\u0437 \u0443\u0447\u0430\u0441\u0442\u043d\u0438\u043a\u043e\u0432 \u0441\u043e\u0440\u0435\u0432\u043d\u043e\u0432\u0430\u043d\u0438\u044f UIUCTF 2025, \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u0440\u0430\u0437\u043e\u0431\u0440\u0430\u043b, \u043a\u0430\u043a \u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0437\u0430\u0434\u0430\u043d\u0438\u0435, \u0442\u0440\u0435\u0431\u0443\u044e\u0449\u0435\u0435 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435, \u0438\u043c\u0435\u044f \u043b\u0438\u0448\u044c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u0442\u0435\u043a\u0441\u0442\u0430 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f \u0432 \u043a\u043e\u0434\u0435. \u0423\u0447\u0430\u0441\u0442\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u043b\u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0437\u0430\u043f\u0440\u043e\u0441 \u043a Python-\u0441\u043a\u0440\u0438\u043f\u0442\u0443, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u043b \u043d\u043e\u0432\u044b\u0439 Python-\u0441\u043a\u0440\u0438\u043f\u0442 c\u043e \u0441\u043b\u0443\u0447\u0430\u0439\u043d\u044b\u043c\u0438 \u0438\u043c\u0435\u043d\u0435\u043c, \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u043b \u043f\u043e\u0441\u0442\u0443\u043f\u0438\u0432\u0448\u0438\u0435 \u043e\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u0442\u0435\u043a\u0441\u0442 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f, \u0432\u044b\u0440\u0435\u0437\u0430\u0432 \u0441\u0438\u043c\u0432\u043e\u043b\u044b «\n» \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":139981,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-139980","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Achievement of code execution by controlling the comment text in a Python script | ProHoster","description":"One of the participants of the UIUCTF 2025 competition detailed how they managed to accomplish a task requiring execution of their code on the server, having only the ability to change the content of the comment text.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/dostizhenie-vypolneniya-koda-pri-kontrole-nad-tekstom-kommentariya-v-python-skripte","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0414\u043e\u0441\u0442\u0438\u0436\u0435\u043d\u0438\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0435 \u043d\u0430\u0434 \u0442\u0435\u043a\u0441\u0442\u043e\u043c \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f \u0432 Python-\u0441\u043a\u0440\u0438\u043f\u0442\u0435 | ProHoster","og:description":"\u041e\u0434\u0438\u043d \u0438\u0437 \u0443\u0447\u0430\u0441\u0442\u043d\u0438\u043a\u043e\u0432 \u0441\u043e\u0440\u0435\u0432\u043d\u043e\u0432\u0430\u043d\u0438\u044f UIUCTF 2025, \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u0440\u0430\u0437\u043e\u0431\u0440\u0430\u043b, \u043a\u0430\u043a \u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0437\u0430\u0434\u0430\u043d\u0438\u0435, \u0442\u0440\u0435\u0431\u0443\u044e\u0449\u0435\u0435 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435, \u0438\u043c\u0435\u044f \u043b\u0438\u0448\u044c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u0442\u0435\u043a\u0441\u0442\u0430 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/dostizhenie-vypolneniya-koda-pri-kontrole-nad-tekstom-kommentariya-v-python-skripte","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-08-03T09:11:56+00:00","article:modified_time":"2025-08-03T09:11:56+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"139980","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 14:07:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 14:07:19","updated":"2026-01-23 14:07:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/139980","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=139980"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/139980\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media\/139981"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=139980"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=139980"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=139980"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}