{"id":139980,"date":"2025-08-03T11:11:54","date_gmt":"2025-08-03T09:11:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/dostizhenie-vypolneniya-koda-pri-kontrole-nad-tekstom-kommentariya-v-python-skripte"},"modified":"2025-08-03T11:11:54","modified_gmt":"2025-08-03T09:11:56","slug":"dostizhenie-vypolneniya-koda-pri-kontrole-nad-tekstom-kommentariya-v-python-skripte","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/dostizhenie-vypolneniya-koda-pri-kontrole-nad-tekstom-kommentariya-v-python-skripte","title":{"rendered":"Dosa\u017eenie vykonania k\u00f3du pri kontrole nad textom koment\u00e1ra v skripte Python","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Jeden z \u00fa\u010dastn\u00edkov s\u00fa\u0165a\u017ee UIUCTF 2025 podrobne rozobral, ako sa mu podarilo splni\u0165 \u00falohu, ktor\u00e1 si vy\u017eiadala dosiahnu\u0165 vykonanie jeho k\u00f3du na serveri, pri\u010dom mal len mo\u017enos\u0165 zmeni\u0165 obsah textu koment\u00e1ra v k\u00f3de. <\/p>\n

\u00da\u010dastn\u00edci mohli posla\u0165 sie\u0165ov\u00fd pr\u00edkaz k Python skriptu, ktor\u00fd vytv\u00e1ral nov\u00fd Python skript s n\u00e1hodn\u00fdm n\u00e1zvom, prid\u00e1val \u00fadaje od pou\u017e\u00edvate\u013ea do textu koment\u00e1ra, odstr\u00e1nil znaky «\n» a «\r», a spustil tento skript pr\u00edkazom «python3 meno.py». Ovl\u00e1daj\u00fac len obsah koment\u00e1ra, \u00fa\u010dastn\u00edk mal za \u00falohu extrahova\u0165 re\u0165azec z s\u00faboru «\\\/home\\\/ctfuser\\\/flag». Skript bol vytvoren\u00fd nasleduj\u00facim k\u00f3dom: comment = input(«> «).replace(«\n», «»).replace(«\r», «») code = f»»»print(«hello world!») # Toto je koment\u00e1r. Tu je \u010fal\u0161\u00ed: # {comment} print(«Thanks for playing!»)»»» <\/p>\n

Namiesto «{comment}» boli dosaden\u00e9 \u00fadaje od \u00fa\u010dastn\u00edka, a nakoniec sa spustil nasleduj\u00faci k\u00f3d: print(«hello world!») # Toto je koment\u00e1r. Tu je \u010fal\u0161\u00ed: # \u00dadaje, ktor\u00e9 pri\u0161li od \u00fa\u010dastn\u00edka s\u00fa\u0165a\u017ee print(«Thanks for playing!») <\/p>\n

\u00daloha bola formulovan\u00e1 na z\u00e1klade zranite\u013enosti v parseri CPython, ktor\u00fd spracov\u00e1val znak s nulov\u00fdm k\u00f3dom ako koniec riadku (zranite\u013enos\u0165 sa mohla pou\u017ei\u0165 na skrytie \u0161kodliv\u00fdch akci\u00ed v texte koment\u00e1ra). Probl\u00e9m bol vyrie\u0161en\u00fd v vydaniach CPython 3.12.0 a 3.11.4. V pou\u017eitom spracov\u00e1va\u010di na s\u00fa\u0165a\u017ei boli odstr\u00e1nen\u00e9 len znaky «\n» a «\r», ale pri pou\u017eit\u00ed zranite\u013enej verzie CPython mohol \u00fa\u010dastn\u00edk pou\u017ei\u0165 znak «\0» ako odde\u013eova\u010d. Napriek tomu tento trik nevy\u0161iel, preto\u017ee v s\u00fa\u0165a\u017ei bola pou\u017eit\u00e1 u\u017e opraven\u00e1 verzia CPython s predpokladom, \u017ee v parseri m\u00f4\u017eu zosta\u0165 e\u0161te nejak\u00e9 podobn\u00e9 chyby a \u00fa\u010dastn\u00edci ich bud\u00fa schopn\u00ed odhali\u0165. <\/p>\n

\u00daspe\u0161ne sa zaoberaj\u00faci \u00falohou \u00fa\u010dastn\u00edk neh\u013eadal nov\u00e9 zranite\u013enosti v parseri, ktor\u00e9 by umo\u017enili rozdeli\u0165 re\u0165azec na \u010dasti, ale vyu\u017eil \u0161peci\u00e1lnos\u0165 vykon\u00e1vania s\u00faborov v Pythone pod\u013ea typu ich obsahu. Napr\u00edklad, namiesto p\u00f4vodn\u00e9ho k\u00f3du do s\u00faboru s pr\u00edponou «.py» je mo\u017en\u00e9 vlo\u017ei\u0165 predcached bytecode, ulo\u017een\u00fd v s\u00faboroch s pr\u00edponou «.pyc», a tak\u00fdto s\u00fabor bude vykonan\u00fd. V posudzovanej s\u00fa\u0165a\u017ei mohol \u00fa\u010dastn\u00edk ovl\u00e1da\u0165 iba obsah vo vn\u00fatri s\u00faboru, a preto nemohol prida\u0165 svoj hlavi\u010dku na skreslenie MIME typu. <\/p>\n

\u00dalohu sa podarilo vyrie\u0161i\u0165 vyu\u017eit\u00edm toho, \u017ee Python od verzie 2.6 m\u00f4\u017ee vykon\u00e1va\u0165 obsah ZIP arch\u00edvov na dodanie Python bal\u00edkov v komprimovanej forme. Rovnako ako v pr\u00edpade s cache byte k\u00f3dom, existencia zip arch\u00edvu sa ur\u010duje pod\u013ea obsahu, nie pod\u013ea pr\u00edpony s\u00faboru, teda do \u201e s\u00fabor.py \u201c je mo\u017en\u00e9 umiestni\u0165 zip arch\u00edv a pri spusten\u00ed pr\u00edkazom \u201epython s\u00fabor.py\u201c bude spracovan\u00fd ako komprimovan\u00fd Python bal\u00edk. Pri tom ZIP arch\u00edvy v Pythone sa neindexuj\u00fa pod\u013ea hlavi\u010dky na za\u010diatku s\u00faboru, ale pod\u013ea sekcie EOCD (End of Central Directory Record) na konci s\u00faboru. Ak sa v arch\u00edve nach\u00e1dza s\u00fabor \u201e__main__.py\u201c, tento s\u00fabor sa spust\u00ed automaticky pri priamom spusten\u00ed arch\u00edvu pr\u00edkazom \u201epython arch\u00edv\u201c. <\/p>\n

S\u00fa\u0165a\u017en\u00e1 \u00faloha bola vyrie\u0161en\u00e1 generovan\u00edm podobn\u00e9ho ZIP arch\u00edvu a jeho vlo\u017een\u00edm do textu koment\u00e1ra. Na zachovanie spr\u00e1vnosti \u0161trukt\u00fary s\u00faboru v podmienkach pr\u00edtomnosti v konci p\u00f4vodn\u00e9ho s\u00faboru v\u00fdzvy \u2018print(\u2018Thanks for playing!\u2019)\u2019, bola vyu\u017eit\u00e1 pr\u00edtomnos\u0165 v EOCD sekcii oblasti koment\u00e1ra, umiestnenej na samotnom konci.

\"Dosa\u017eenie<\/center>
\"Dosa\u017eenie<\/center>
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u0434\u0438\u043d \u0438\u0437 \u0443\u0447\u0430\u0441\u0442\u043d\u0438\u043a\u043e\u0432 \u0441\u043e\u0440\u0435\u0432\u043d\u043e\u0432\u0430\u043d\u0438\u044f UIUCTF 2025, \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u0440\u0430\u0437\u043e\u0431\u0440\u0430\u043b, \u043a\u0430\u043a \u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0437\u0430\u0434\u0430\u043d\u0438\u0435, \u0442\u0440\u0435\u0431\u0443\u044e\u0449\u0435\u0435 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435, \u0438\u043c\u0435\u044f \u043b\u0438\u0448\u044c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u0442\u0435\u043a\u0441\u0442\u0430 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f \u0432 \u043a\u043e\u0434\u0435. \u0423\u0447\u0430\u0441\u0442\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u043b\u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0437\u0430\u043f\u0440\u043e\u0441 \u043a Python-\u0441\u043a\u0440\u0438\u043f\u0442\u0443, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u043b \u043d\u043e\u0432\u044b\u0439 Python-\u0441\u043a\u0440\u0438\u043f\u0442 c\u043e \u0441\u043b\u0443\u0447\u0430\u0439\u043d\u044b\u043c\u0438 \u0438\u043c\u0435\u043d\u0435\u043c, \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u043b \u043f\u043e\u0441\u0442\u0443\u043f\u0438\u0432\u0448\u0438\u0435 \u043e\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u0442\u0435\u043a\u0441\u0442 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f, \u0432\u044b\u0440\u0435\u0437\u0430\u0432 \u0441\u0438\u043c\u0432\u043e\u043b\u044b «\n» \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":139981,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-139980","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Dosiahnutie vykon\u00e1vania k\u00f3du pri kontrole nad textom koment\u00e1ra v Python skripte | ProHoster","description":"Jeden z \u00fa\u010dastn\u00edkov s\u00fa\u0165a\u017ee UIUCTF 2025 podrobne op\u00edsal, ako sa mu podarilo dokon\u010di\u0165 \u00falohu, ktor\u00e1 vy\u017eadovala dosiahnu\u0165 vykonanie svojho k\u00f3du na serveri s jedinou mo\u017enos\u0165ou zmeny obsahu textu koment\u00e1ra.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/dostizhenie-vypolneniya-koda-pri-kontrole-nad-tekstom-kommentariya-v-python-skripte","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0414\u043e\u0441\u0442\u0438\u0436\u0435\u043d\u0438\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0435 \u043d\u0430\u0434 \u0442\u0435\u043a\u0441\u0442\u043e\u043c \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f \u0432 Python-\u0441\u043a\u0440\u0438\u043f\u0442\u0435 | ProHoster","og:description":"\u041e\u0434\u0438\u043d \u0438\u0437 \u0443\u0447\u0430\u0441\u0442\u043d\u0438\u043a\u043e\u0432 \u0441\u043e\u0440\u0435\u0432\u043d\u043e\u0432\u0430\u043d\u0438\u044f UIUCTF 2025, \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u0440\u0430\u0437\u043e\u0431\u0440\u0430\u043b, \u043a\u0430\u043a \u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0437\u0430\u0434\u0430\u043d\u0438\u0435, \u0442\u0440\u0435\u0431\u0443\u044e\u0449\u0435\u0435 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435, \u0438\u043c\u0435\u044f \u043b\u0438\u0448\u044c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u0442\u0435\u043a\u0441\u0442\u0430 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/dostizhenie-vypolneniya-koda-pri-kontrole-nad-tekstom-kommentariya-v-python-skripte","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-08-03T09:11:56+00:00","article:modified_time":"2025-08-03T09:11:56+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"139980","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 14:07:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 14:07:19","updated":"2026-01-23 14:07:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/139980","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=139980"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/139980\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/139981"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=139980"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=139980"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=139980"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}