Код решения:

php:

//bruteforse.php

<?php

$target_url = "http://10.10.121.168/";
error_reporting(0);
ini_set('display_errors', '0');


$charset = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ}{!@#$%^&*)(_-=+';
$user_agent = str_repeat("A", 256);
$known_prefix = "guest:" . $user_agent . ":";
$test_string = substr($known_prefix, -8);

function get_secure_cookie($user_agent) {
    global $target_url;

    $context = stream_context_create([
        "http" => [
            "method" => "GET",
            "header" =>
                "Host: 10.10.121.168\r\n" .
                "User-Agent: $user_agent\r\n" .
                "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\n" .
                "Accept-Language: en-US,en;q=0.5\r\n" .
                "Accept-Encoding: gzip, deflate, br\r\n" .
                "Connection: close\r\n" .
                "Upgrade-Insecure-Requests: 1\r\n"
        ]
    ]);

    $response = file_get_contents($target_url, false, $context);

    foreach ($http_response_header as $header) {
        if (stripos($header, "Set-Cookie: secure_cookie=") !== false) {
            preg_match('/secure_cookie=([^;]+)/', $header, $matches);

            if (!isset($matches[1])) {
                return null;
            }

            $decoded_cookie = urldecode($matches[1]);

            if (preg_match('/%[0-9A-Fa-f]{2}/', $decoded_cookie)) {
                die("URL-encoded characters detected in secure_cookie!\n");
            }

            return $decoded_cookie;
        }
    }
    return null;
}

$found_text = "";
while (true) {
    echo "Current key: {$found_text}\r";

    $secure_cookie = get_secure_cookie($user_agent);
    $user_agent = str_repeat("A", strlen($user_agent) + 7);
    if (!$secure_cookie) {
        die("Failed to retrieve secure_cookie!\n");
    }


    $salt = substr($secure_cookie, 0, 2);

    $found_char = null;
    foreach (str_split($charset) as $char) {
        $test_string_temp = substr($test_string, 1) . $char;

        $hashed_test = crypt($test_string_temp, $salt);
        if (str_contains($secure_cookie, $hashed_test)) {
            $found_text .= $char;
            $test_string = $test_string_temp;
            break;
        }
    }
}

?>

python:

import requests
from passlib.hash import des_crypt
import sys

target_url = "http://10.10.212.174/"
charset = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ}{!@#$%^&*)(_-=+'
user_agent = "A" * 256
known_prefix = f"guest:{user_agent}:"
test_string = known_prefix[-8:]
found_text = ""

def get_secure_cookie(user_agent):
    headers = {
        "Host": "10.10.212.174",
        "User-Agent": user_agent,
        "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8",
        "Accept-Language": "en-US,en;q=0.5",
        "Connection": "close",
        "Upgrade-Insecure-Requests": "1"
    }

    try:
        response = requests.get(target_url, headers=headers, allow_redirects=False)
        cookie_header = response.headers.get('Set-Cookie', '')

        if 'secure_cookie=' in cookie_header:
            cookie = cookie_header.split('secure_cookie=')[1].split(';')[0]
            return requests.utils.unquote(cookie)
    except Exception as e:
        print(f"Error: {e}")
        return None

while True:
    sys.stdout.write(f"\rCurrent key: {found_text}")
    sys.stdout.flush()

    secure_cookie = get_secure_cookie(user_agent)
    user_agent = "A" * (len(user_agent) + 7) 

    if not secure_cookie:
        print("\nFailed to retrieve secure_cookie!")
        break

    salt = secure_cookie[:2]  

    for char in charset:
        test_string_temp = test_string[1:] + char  


        hashed_test = des_crypt.hash(test_string_temp, salt=salt)


        if hashed_test in secure_cookie:
            found_text += char
            test_string = test_string_temp
            break

    else:
        print("\nNo more characters found!")
        break




# ААААААААААА ОН РАБОТАЕТ УРА

Видео выполнения:

• Оригинал:
• YouTube