{"id":139980,"date":"2025-08-03T11:11:54","date_gmt":"2025-08-03T09:11:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/dostizhenie-vypolneniya-koda-pri-kontrole-nad-tekstom-kommentariya-v-python-skripte"},"modified":"2025-08-03T11:11:54","modified_gmt":"2025-08-03T09:11:56","slug":"dostizhenie-vypolneniya-koda-pri-kontrole-nad-tekstom-kommentariya-v-python-skripte","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/dostizhenie-vypolneniya-koda-pri-kontrole-nad-tekstom-kommentariya-v-python-skripte","title":{"rendered":"Realizarea execut\u0103rii codului cu control asupra textului comentariului \u00een scriptul Python.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Unul dintre participan\u021bii la competi\u021bia UIUCTF 2025 a explicat \u00een detaliu cum a reu\u0219it s\u0103 finalizeze o sarcin\u0103 care necesita executarea codului s\u0103u pe server, av\u00e2nd doar posibilitatea de a modifica con\u021binutul textului comentariului din cod. <\/p>\n

Participan\u021bii au putut trimite o cerere de re\u021bea c\u0103tre un script Python, care crea un nou script Python cu un nume aleator, ad\u0103uga datele primite de la utilizator \u00een textul comentariului, t\u0103ind caracterele \u0219i , \u0219i rula acest script cu comanda . Control\u00e2nd doar con\u021binutul comentariului, participan\u021bii trebuiau s\u0103 extrag\u0103 un \u0219ir din fi\u0219ierul . Scriptul era creat cu urm\u0103torul cod: comment = input(><).replace(, <).replace(, <) code = f'''print() # Acesta este un comentariu. Iat\u0103 un alt: # {comment} print()''' <\/p>\n

\u00cen loc de erau \u00eenlocuite datele primite de la participant, iar \u00een cele din urm\u0103 se rula urm\u0103torul cod: print() # Acesta este un comentariu. Iat\u0103 un alt: # Datele primite de la participantul competi\u021biei print() <\/p>\n

Sarcina a fost formulat\u0103 pe baza unei vulnerabilit\u0103\u021bi din parserul CPython, care procesa caracterul cu cod zero ca sf\u00e2r\u0219itul unui \u0219ir (vulnerabilitatea, de exemplu, putea fi utilizat\u0103 pentru a masca ac\u021biuni mali\u021bioase \u00een textul comentariului). Problema a fost rezolvat\u0103 \u00een versiunile CPython 3.12.0 \u0219i 3.11.4. \u00cen handler-ul utilizat \u00een competi\u021bie, doar caracterele \u0219i erau t\u0103iate, dar utiliz\u00e2nd o versiune vulnerabil\u0103 a CPython, participantul putea folosi caracterul ca separator. Totu\u0219i, acest truc nu a func\u021bionat deoarece \u00een competi\u021bie era utilizat\u0103 deja o versiune corectat\u0103 a CPython, av\u00e2nd \u00een vedere c\u0103 \u00een parser ar putea r\u0103m\u00e2ne \u00eenc\u0103 unele erori asem\u0103n\u0103toare \u0219i participan\u021bii ar putea s\u0103 le identifice. <\/p>\n

Participantul care a reu\u0219it sarcina nu a c\u0103utat noi vulnerabilit\u0103\u021bi \u00een parser care ar permite divizarea \u0219irurilor \u00een p\u0103r\u021bi, ci a folosit o caracteristic\u0103 a execu\u021biei \u00een Python a fi\u0219ierelor \u00een func\u021bie de tipul lor de con\u021binut. De exemplu, \u00een loc de codul surs\u0103, \u00een fi\u0219ierul cu extensia se putea introduce bytecode cached, salvat \u00een fi\u0219iere cu extensia , iar un astfel de fi\u0219ier ar fi fost executat. \u00cen competi\u021bia respectiv\u0103, participantul putea controla doar con\u021binutul din mijlocul fi\u0219ierului, a\u0219a c\u0103 nu putea ad\u0103uga un header al s\u0103u pentru a denatura tipul MIME. <\/p>\n

Problema a fost rezolvat\u0103 folosind faptul c\u0103 Python, \u00eencep\u00e2nd cu rama 2.6, poate executa con\u021binutul arhivelor ZIP pentru livrarea pachetelor Python \u00eentr-o form\u0103 comprimat\u0103. La fel ca \u00een cazul cache-ului de bytecode, prezen\u021ba arhivei ZIP se determin\u0103 \u00een func\u021bie de con\u021binutul s\u0103u \u0219i nu de extensia fi\u0219ierului, adic\u0103 \u00een \u00abfile.py\u00bb se poate introduce o arhiv\u0103 ZIP \u0219i la rularea comenzii \u00abpython file.py\u00bb aceasta va fi procesat\u0103 ca un pachet Python comprimat. Arhivele ZIP \u00een Python sunt indexate nu dup\u0103 antetul din \u00eenceputul fi\u0219ierului, ci dup\u0103 sec\u021biunea EOCD (End of Central Directory Record) de la sf\u00e2r\u0219itul fi\u0219ierului. C\u00e2nd exist\u0103 un fi\u0219ier \u00ab__main__.py\u00bb \u00een arhiv\u0103, acest fi\u0219ier este rulat automat la executarea direct\u0103 a arhivei cu comanda \u00abpython archive\u00bb. <\/p>\n

Problema concursului a fost rezolvat\u0103 prin generarea unei arhive ZIP similare \u0219i introducerea acesteia \u00een textul comentariului. Pentru a p\u0103stra corectitudinea structurii fi\u0219ierului \u00een condi\u021biile prezen\u021bei apelului \u00abprint(\u00abThanks for playing!\u00bb)\u00bb la sf\u00e2r\u0219itul fi\u0219ierului surs\u0103, a fost folosit\u0103 prezen\u021ba \u00een sec\u021biunea EOCD a unei zone de comentariu plasate la sf\u00e2r\u0219itul acestuia.

\"Realizarea<\/center>
\"Realizarea<\/center>
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u0434\u0438\u043d \u0438\u0437 \u0443\u0447\u0430\u0441\u0442\u043d\u0438\u043a\u043e\u0432 \u0441\u043e\u0440\u0435\u0432\u043d\u043e\u0432\u0430\u043d\u0438\u044f UIUCTF 2025, \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u0440\u0430\u0437\u043e\u0431\u0440\u0430\u043b, \u043a\u0430\u043a \u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0437\u0430\u0434\u0430\u043d\u0438\u0435, \u0442\u0440\u0435\u0431\u0443\u044e\u0449\u0435\u0435 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435, \u0438\u043c\u0435\u044f \u043b\u0438\u0448\u044c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u0442\u0435\u043a\u0441\u0442\u0430 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f \u0432 \u043a\u043e\u0434\u0435. \u0423\u0447\u0430\u0441\u0442\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u043b\u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0437\u0430\u043f\u0440\u043e\u0441 \u043a Python-\u0441\u043a\u0440\u0438\u043f\u0442\u0443, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u043b \u043d\u043e\u0432\u044b\u0439 Python-\u0441\u043a\u0440\u0438\u043f\u0442 c\u043e \u0441\u043b\u0443\u0447\u0430\u0439\u043d\u044b\u043c\u0438 \u0438\u043c\u0435\u043d\u0435\u043c, \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u043b \u043f\u043e\u0441\u0442\u0443\u043f\u0438\u0432\u0448\u0438\u0435 \u043e\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u0442\u0435\u043a\u0441\u0442 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f, \u0432\u044b\u0440\u0435\u0437\u0430\u0432 \u0441\u0438\u043c\u0432\u043e\u043b\u044b «\n» \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":139981,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-139980","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Realizarea execu\u0103rii codului prin controlul textului comentariului \u00een scriptul Python | ProHoster","description":"Unul dintre participan\u021bii la competi\u021bia UIUCTF 2025 a explicat \u00een detaliu cum a reu\u0219it s\u0103 finalizeze sarcina care necesita execu\u021bia codului s\u0103u pe server, av\u00e2nd doar posibilitatea de a modifica con\u021binutul textului comentariului.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/dostizhenie-vypolneniya-koda-pri-kontrole-nad-tekstom-kommentariya-v-python-skripte","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0414\u043e\u0441\u0442\u0438\u0436\u0435\u043d\u0438\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0435 \u043d\u0430\u0434 \u0442\u0435\u043a\u0441\u0442\u043e\u043c \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f \u0432 Python-\u0441\u043a\u0440\u0438\u043f\u0442\u0435 | ProHoster","og:description":"\u041e\u0434\u0438\u043d \u0438\u0437 \u0443\u0447\u0430\u0441\u0442\u043d\u0438\u043a\u043e\u0432 \u0441\u043e\u0440\u0435\u0432\u043d\u043e\u0432\u0430\u043d\u0438\u044f UIUCTF 2025, \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u0440\u0430\u0437\u043e\u0431\u0440\u0430\u043b, \u043a\u0430\u043a \u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0437\u0430\u0434\u0430\u043d\u0438\u0435, \u0442\u0440\u0435\u0431\u0443\u044e\u0449\u0435\u0435 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435, \u0438\u043c\u0435\u044f \u043b\u0438\u0448\u044c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u0442\u0435\u043a\u0441\u0442\u0430 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/dostizhenie-vypolneniya-koda-pri-kontrole-nad-tekstom-kommentariya-v-python-skripte","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-08-03T09:11:56+00:00","article:modified_time":"2025-08-03T09:11:56+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"139980","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 14:07:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 14:07:19","updated":"2026-01-23 14:07:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/139980","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=139980"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/139980\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/139981"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=139980"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=139980"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=139980"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}