HTB-Emdee five for life

一开始扫了一下端口，发现了30951端口，浏览器打开后没有什么特别的，然后就按照题目提示写了，跟以前做的一个叫秋名山神的题目很像，就拿python跑了一个

lao@laolao:~$ sudo nmap -sS -Pn -A 188.166.173.208
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower.
Starting Nmap 7.91 ( https://nmap.org ) at 2021-08-16 23:48 CST
Nmap scan report for 188.166.173.208
Host is up (0.28s latency).
Not shown: 908 filtered ports, 91 closed ports
PORT      STATE SERVICE VERSION
30951/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-title: HTB Academy
Aggressive OS guesses: Linux 2.6.32 or 3.10 (90%), Synology DiskStation Manager 5.1 (89%), Linux 3.10 (89%), Linux 2.6.35 (89%), Linux 4.9 (89%), Linux 2.6.32 (89%), Linux 2.6.39 (89%), Linux 3.10 - 3.12 (89%), Linux 3.4 (89%), Linux 4.4 (89%)

脚本如下，好久没写了，有点手生，修修补补了蛮久的，中间注释掉的是多线程，开了10个线程跑，然后网站就崩了？后来发现不用多线程也行😅

import threading

import requests
import re
import hashlib
def A():
    while 1:
        s = requests.session()
        url = "http://188.166.173.208:32449/"
        r = s.post(url).text
        t = re.search("<h3 align=\\'center\\'>(.*?)</h3>",r).group(1)
        print(t)
        print(hashlib.md5(t.encode("utf-8")).hexdigest())
        rq = s.post(url,data={"hash":hashlib.md5(t.encode("utf-8")).hexdigest()}).text
        if "Too slow!" not in rq:
            print(rq)
        else:
            print(">>"+t)
if __name__ == '__main__':
    # q=[]
    # for i in range(1):
    #     q.append(threading.Thread(target=A))
    # for i in q:
    #     i.start()
    A()

获得的答案如下：

KWwe9oo7EHAIVDO6mcs5
472ac57e01139823e7a798bfde363ac2
<html>
<head>
<title>emdee five for life</title>
</head>
<body style="background-color:powderblue;">
<h1 align='center'>MD5 encrypt this string</h1><h3 align='center'>KWwe9oo7EHAIVDO6mcs5</h3><p align='center'>HTB{N1c3_ScrIpt1nG_B0i!}</p><center><form action="" method="post">
<input type="text" name="hash" placeholder="MD5" align='center'></input>
</br>
<input type="submit" value="Submit"></input>
</form></center>
</body>
</html>

XUvIDeqjtFfo58G0rB6m
287cdc8bd200c2f0928b3c7a88a99280

 

posted @ 2021-08-17 01:41  东坡肉肉君  阅读(126)  评论(0)  编辑  收藏  举报