{"id":139980,"date":"2025-08-03T11:11:54","date_gmt":"2025-08-03T09:11:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/dostizhenie-vypolneniya-koda-pri-kontrole-nad-tekstom-kommentariya-v-python-skripte"},"modified":"2025-08-03T11:11:54","modified_gmt":"2025-08-03T09:11:56","slug":"dostizhenie-vypolneniya-koda-pri-kontrole-nad-tekstom-kommentariya-v-python-skripte","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/news\/dostizhenie-vypolneniya-koda-pri-kontrole-nad-tekstom-kommentariya-v-python-skripte","title":{"rendered":"Postizanje izvr\u0161enja koda pod kontrolom teksta komentara u Python skripti.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Eden od udele\u017eencev tekmovanja UIUCTF 2025 je podrobno razlo\u017eil, kako mu je uspelo izpolniti nalogo, ki je zahtevala izvr\u0161itev njegove kode na stre\u017eniku, pri \u010demer je imel le mo\u017enost spreminjanja vsebine besedila komentarja v kodi. <\/p>\n

Udele\u017eenci so lahko poslali omre\u017eni zahtevek Python skriptu, ki je ustvaril nov Python skript s slu\u010dajnim imenom, dodal prejete podatke uporabnika v besedilo komentarja, odstranil znake «\n» in «\r», ter zagnal ta skript z ukazom «python3 ime.py». Ob nadzoru le vsebine komentarja je udele\u017eenec moral izvle\u010di vrstico iz datoteke «\\\/home\\\/ctfuser\\\/flag». Skript je bil ustvarjen z naslednjim kodo: comment = input(«> «).replace(«\n», «»).replace(«\r», «») code = f»»»print(«hello world!») # To je komentar. Tukaj je \u0161e en: # {comment} print(«Hvala za igranje!»)»»» <\/p>\n

Namesto «{comment}» so bili vstavljeni podatki, ki so prispeli od udele\u017eenca, in na koncu je bil zagnan naslednji koda: print(«hello world!») # To je komentar. Tukaj je \u0161e en: # Podatki, ki so prispeli od udele\u017eenca tekmovanja print(«Hvala za igranje!») <\/p>\n

Naloga je bila oblikovana po motivih ranljivosti v parserju CPython, ki je obdeloval znak z ni\u010delno kodo kot konec vrstice (ranljivost se lahko uporablja za skrivanje zlonamernih dejanj v besedilu komentarja). Problem je bil odpravljjen v razli\u010dicah CPython 3.12.0 in 3.11.4. V obdelovalniku, ki je bil uporabljen v tekmovanju, so bili odstranjeni le znaki «\n» in «\r», vendar je udele\u017eenec z uporabo ranljive razli\u010dice CPython lahko uporabil znak «\0» kot lo\u010dilo. Kljub temu ta trik ni deloval, saj je bilo v tekmovanju uporabljeno \u017ee odpravljeno razli\u010dico CPython ob predpostavki, da bi lahko v parserju ostale \u0161e druge podobne napake, ki bi jih udele\u017eenci mogli odkriti. <\/p>\n

Udele\u017eenec, ki je uspe\u0161no opravil nalogo, se ni trudil iskati novih ranljivosti v parserju, ki bi omogo\u010dile delitev vrstice na dele, temve\u010d je izkoristil poseben postopek izvajanja v Pythonu na podlagi vrste vsebine datoteke. Na primer, namesto izvorne kode lahko v datoteko z raz\u0161iritvijo «.py» vstavimo predpomnjen bajtkod, shranjen v datotekah z raz\u0161iritvijo «.pyc», in tak\u0161na datoteka bo izvedena. V obravnavanem tekmovanju je udele\u017eenec lahko nadziral le vsebino v sredini datoteke, zato ni mogel dodati svojega naslova za zavajanje MIME-tipa. <\/p>\n

Nalogo je bilo mogo\u010de re\u0161iti z uporabo dejstva, da Python od razli\u010dice 2.6 naprej omogo\u010da izvajanje vsebine ZIP arhivov za dostavo Python paketov v stisnjeni obliki. Tako kot pri predpomnjenju bajtkod so ZIP arhivi dolo\u010deni po vsebini, ne po kon\u010dnici datoteke, to pomeni, da lahko v 'datoteko.py' vstavite ZIP arhiv in z zagonom ukaza 'python datoteka.py' bo obdelana kot stisnjeni Python paket. Pri tem se ZIP arhivi v Pythonu indeksirajo ne po naslovu na za\u010detku datoteke, temve\u010d po sekciji EOCD (End of Central Directory Record) na koncu datoteke. \u010ce je v arhivu datoteka '__main__.py', se ta datoteka samodejno za\u017eene pri neposrednem zagonu arhiva z ukazom 'python arhiv'. <\/p>\n

Konkuren\u010dna naloga je bila re\u0161ena z generiranjem podobnega ZIP arhiva in njegovo vstavljanjem v besedilo komentarja. Za ohranjanje pravilnosti strukture datoteke ob pozivu 'print('Thanks for playing!')' na koncu izvorne datoteke, je bilo uporabljeno prisotnost komentarnega obmo\u010dja v sekciji EOCD, postavljenega na sam konec.

\"Postizanje<\/center>
\"Postizanje<\/center>
\n
Izvor: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u0434\u0438\u043d \u0438\u0437 \u0443\u0447\u0430\u0441\u0442\u043d\u0438\u043a\u043e\u0432 \u0441\u043e\u0440\u0435\u0432\u043d\u043e\u0432\u0430\u043d\u0438\u044f UIUCTF 2025, \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u0440\u0430\u0437\u043e\u0431\u0440\u0430\u043b, \u043a\u0430\u043a \u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0437\u0430\u0434\u0430\u043d\u0438\u0435, \u0442\u0440\u0435\u0431\u0443\u044e\u0449\u0435\u0435 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435, \u0438\u043c\u0435\u044f \u043b\u0438\u0448\u044c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u0442\u0435\u043a\u0441\u0442\u0430 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f \u0432 \u043a\u043e\u0434\u0435. \u0423\u0447\u0430\u0441\u0442\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u043b\u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0437\u0430\u043f\u0440\u043e\u0441 \u043a Python-\u0441\u043a\u0440\u0438\u043f\u0442\u0443, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u043b \u043d\u043e\u0432\u044b\u0439 Python-\u0441\u043a\u0440\u0438\u043f\u0442 c\u043e \u0441\u043b\u0443\u0447\u0430\u0439\u043d\u044b\u043c\u0438 \u0438\u043c\u0435\u043d\u0435\u043c, \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u043b \u043f\u043e\u0441\u0442\u0443\u043f\u0438\u0432\u0448\u0438\u0435 \u043e\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u0442\u0435\u043a\u0441\u0442 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f, \u0432\u044b\u0440\u0435\u0437\u0430\u0432 \u0441\u0438\u043c\u0432\u043e\u043b\u044b «\n» \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":139981,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-139980","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Postizanje izvr\u0161avanja koda uz kontrolu nad tekstom komentara u Python skriptu | ProHoster","description":"Jedan od u\u010desnika takmi\u010denja UIUCTF 2025, detaljno je objasnio kako je uspeo da izvr\u0161i zadatak koji zahteva da se njegov kod izvr\u0161i na serveru, imaju\u0107i samo mogu\u0107nost promene sadr\u017eaja teksta komentara.","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/news\/dostizhenie-vypolneniya-koda-pri-kontrole-nad-tekstom-kommentariya-v-python-skripte","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0414\u043e\u0441\u0442\u0438\u0436\u0435\u043d\u0438\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0435 \u043d\u0430\u0434 \u0442\u0435\u043a\u0441\u0442\u043e\u043c \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f \u0432 Python-\u0441\u043a\u0440\u0438\u043f\u0442\u0435 | ProHoster","og:description":"\u041e\u0434\u0438\u043d \u0438\u0437 \u0443\u0447\u0430\u0441\u0442\u043d\u0438\u043a\u043e\u0432 \u0441\u043e\u0440\u0435\u0432\u043d\u043e\u0432\u0430\u043d\u0438\u044f UIUCTF 2025, \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e \u0440\u0430\u0437\u043e\u0431\u0440\u0430\u043b, \u043a\u0430\u043a \u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0437\u0430\u0434\u0430\u043d\u0438\u0435, \u0442\u0440\u0435\u0431\u0443\u044e\u0449\u0435\u0435 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435, \u0438\u043c\u0435\u044f \u043b\u0438\u0448\u044c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u0442\u0435\u043a\u0441\u0442\u0430 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f.","og:url":"https:\/\/prohoster.info\/sl\/blog\/news\/dostizhenie-vypolneniya-koda-pri-kontrole-nad-tekstom-kommentariya-v-python-skripte","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-08-03T09:11:56+00:00","article:modified_time":"2025-08-03T09:11:56+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"139980","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 14:07:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 14:07:19","updated":"2026-01-23 14:07:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/139980","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=139980"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/139980\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media\/139981"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=139980"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=139980"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=139980"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}