189 lines
6.3 KiB
PHP
Executable File
189 lines
6.3 KiB
PHP
Executable File
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
|
|
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
|
<html xmlns="http://www.w3.org/1999/xhtml">
|
|
<head>
|
|
<title>Password Fetch tool</title>
|
|
<style type="text/css">
|
|
body{
|
|
padding: 32px;
|
|
}
|
|
</style>
|
|
</head>
|
|
<body style="width: 500px; margin: auto; font-family: Verdana, Geneva, sans-serif; font-size: 14px;">
|
|
<br /><br />
|
|
<div align="center" style="width: 500px">
|
|
<div style="border: 1px solid #000000; text-align: center; background: #486b92; font-size: 20px; color: #ffffff;">
|
|
<strong>One Time Password Retrieval Tool</strong>
|
|
</div>
|
|
<div style="border: 1px solid #000000; text-align: left; padding: 8px;">
|
|
<?php
|
|
require_once '/var/www/html/creds.inc';
|
|
try {
|
|
$pdo = new PDO(
|
|
"mysql:host=$sqlhost;dbname=pwtool;charset=utf8",
|
|
"$sqluser",
|
|
"$sqlpass",
|
|
[PDO::ATTR_EMULATE_PREPARES => false,
|
|
PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]
|
|
);
|
|
} catch (PDOException $failure) {
|
|
echo "Connection failed: " . $failure->getMessage();
|
|
};
|
|
|
|
require 'CaptchasDotNet.php';
|
|
$captchas = new CaptchasDotNet ("$captcahsdotnetuser", "$captcahsdotnetpass",
|
|
'/tmp/captchasnet-random-strings','3600',
|
|
'abcdefghkmnopqrstuvwxyz','6',
|
|
'240','80','000088');
|
|
|
|
if(isset($_GET['key']))
|
|
{ //Key set in URL
|
|
$MyKey = preg_replace('/[^a-f0-9]/', '', trim($_GET['key']));
|
|
|
|
if(($MyKey != '') and (strlen($MyKey) == 32) || (strlen($MyKey) == 64)) {
|
|
|
|
$MyLookup = $pdo->prepare("SELECT password, retrieved_ip, retireved_time FROM pwtool.mypasswd WHERE code = '$MyKey'");
|
|
$MyLookup->execute();
|
|
$count = $MyLookup->rowCount();
|
|
|
|
if($count == 1){
|
|
|
|
$myRow = $MyLookup->fetch(PDO::FETCH_OBJ);
|
|
$MyIP = $myRow->retrieved_ip;
|
|
|
|
if($MyIP != ''){
|
|
|
|
$MyTime = $myRow->retireved_time;
|
|
|
|
print '<p><strong>Error:</strong> This key was valid for one-time '
|
|
.'use and is no longer valid.</p><p>It was already delivered to IP address '
|
|
.'<strong>'.$MyIP.'</strong> on <strong>'.$MyTime.'</strong>. Please contact '
|
|
.'support immediately to have your password reset if you feel your key '
|
|
.'might have been intercepted.</p>';
|
|
} else {
|
|
|
|
$MyPassword = $myRow->password;
|
|
$MyIP = $_SERVER['REMOTE_ADDR'];
|
|
$myUpdate = $pdo->prepare("UPDATE pwtool.mypasswd SET retrieved_ip = '$MyIP',retireved_time = now(),password = ''
|
|
WHERE code = '$MyKey'");
|
|
$myUpdate->execute();
|
|
|
|
print '<p>Your password is:</p><p style="font-size: 18px; text-align: center;">';
|
|
|
|
if(strlen($MyPassword) > 20){
|
|
print '<pre>'.$MyPassword.'</pre></p>';
|
|
} else {
|
|
print '<strong>'.$MyPassword.'</strong></p>';
|
|
}
|
|
print '<p>Do not hit reload on your browser. This URL is one-time use and will not show your passsword again.<p>';
|
|
}
|
|
}
|
|
else{
|
|
print '<p><strong>Error:</strong> You need to supply a valid key.</p>';
|
|
}
|
|
}
|
|
else{
|
|
print '<p><strong>Error:</strong> You need to supply a valid key.</p>';
|
|
}
|
|
}
|
|
elseif(isset($_REQUEST['random']))
|
|
{ //captcah was used, process it
|
|
|
|
$captchas = new CaptchasDotNet ('demo', 'secret',
|
|
'/tmp/captchasnet-random-strings','3600',
|
|
'abcdefghkmnopqrstuvwxyz','6',
|
|
'240','80','000088');
|
|
|
|
// Read the form values
|
|
$password = $_REQUEST['password'];
|
|
$random_string = $_REQUEST['random'];
|
|
|
|
$newPassword = str_replace("'", '', trim($_POST['newPassword']));
|
|
|
|
if (!$captchas->validate ($random_string))
|
|
{ // captcah error
|
|
echo 'The session key (random) does not exist, please go back and reload form.<br/>';
|
|
echo 'In case you are the administrator of this page, ';
|
|
echo 'please check if random keys are stored correct.<br/>';
|
|
echo 'See http://captchas.net/sample/php/ "Problems with save mode"';
|
|
}
|
|
elseif ($captchas->verify ($password))
|
|
{ //captcah passes, add password to DB
|
|
$displayForm = false;
|
|
|
|
//$pdo->query($dbConnection, "START TRANSACTION;;");
|
|
$myLookup = $pdo->prepare("INSERT INTO pwtool.mypasswd (code, password) VALUES(sha2(CONCAT(rand(),rand(),rand()),256), '$newPassword');");
|
|
$myLookup->execute();
|
|
|
|
$myLookup = $pdo->prepare("SELECT code FROM pwtool.mypasswd WHERE id = LAST_INSERT_ID();");
|
|
$myLookup->execute();
|
|
|
|
$myKey = $myLookup->fetch(PDO::FETCH_OBJ);
|
|
//pg_fetch_result($myLookup, 0, 0);
|
|
//$pdo->query($dbConnection, "COMMIT");
|
|
|
|
print '<p>Password insert succeeded. Here\'s the URL to fetch it:</p>';
|
|
print '<p><a href="'.dirname($_SERVER['PHP_SELF']).'?key='.$myKey->code.'">link</a></p>';
|
|
|
|
}
|
|
else
|
|
{ //captcah worng
|
|
//print '<p>Nope, not here: '.$adminPassword.'</p>';
|
|
echo 'You entered the wrong captcah. Aren\'t you human?';
|
|
}
|
|
}
|
|
else
|
|
{ //Display New password entry form
|
|
?>
|
|
<form method="post" >
|
|
<table border="0" cellspacing="2" cellpadding="2">
|
|
<?php /*<tr>
|
|
<td>Admin Password:</td><td><input type="password" name="adminPassword" value="" /></td>
|
|
</tr> */ ?>
|
|
<tr>
|
|
<td>
|
|
<input type="hidden" name="random" value="<?= $captchas->random () ?>" />
|
|
<?php //Your message:</td><td><input name="message" value="Hello World" size="60" /> ?>
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>
|
|
</td>
|
|
<td>
|
|
<?= $captchas->image () ?> </br><a href="javascript:captchas_image_reload('captchas.net')">Reload Image</a>
|
|
<?php /*<br> <a href="<?= $captchas->audio_url () ?>">Phonetic spelling (mp3)</a>
|
|
<br> <a href="<?= $captchas->audio_url () ?>&language=de">Buchstabieren (mp3)</a>
|
|
<br> <a href="<?= $captchas->audio_url () ?>&language=it">Compitare (mp3)</a>
|
|
<br> <a href="<?= $captchas->audio_url () ?>&language=nl">Spellen (mp3)</a>
|
|
<br> <a href="<?= $captchas->audio_url () ?>&language=fr">Epeler (mp3)</a> */ ?>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>
|
|
The CAPTCHA:
|
|
</td>
|
|
<td>
|
|
<input name="password" size="6" />
|
|
</td>
|
|
</tr>
|
|
|
|
<tr>
|
|
<td>New Password:</td><td><input type="text" name="newPassword" value="" /></td>
|
|
</tr>
|
|
<tr>
|
|
<td colspan="2"><input type="submit" name="submit" value="Submit" /></td>
|
|
</tr>
|
|
</table>
|
|
</form>
|
|
<?php
|
|
}
|
|
|
|
|
|
?>
|
|
</div>
|
|
</div>
|
|
<br /><br />
|
|
</body>
|
|
</html>
|