mxrch / GHunt

🕵️‍♂️ Offensive Google framework.
Other
15.83k stars 1.32k forks source link

can't login (`ghunt.errors.GHuntAndroidMasterAuthError`) - 403 from auth endpoint #537

Open maxgerman opened 1 month ago

maxgerman commented 1 month ago

Describe the bug There's the following error on attempt to use ghunt login.

[+] Got OAuth2 token => oauth2_4/0AV... Traceback (most recent call last): File "/home/username/.local/bin/ghunt", line 8, in sys.exit(main()) ^^^^^^ File "/home/username/.local/share/pipx/venvs/ghunt/lib/python3.11/site-packages/ghunt/ghunt.py", line 18, in main parse_and_run() File "/home/username/.local/share/pipx/venvs/ghunt/lib/python3.11/site-packages/ghunt/cli.py", line 55, in parse_and_run process_args(args) File "/home/username/.local/share/pipx/venvs/ghunt/lib/python3.11/site-packages/ghunt/cli.py", line 62, in process_args asyncio.run(login.check_and_login(None, args.clean)) File "/usr/lib/python3.11/asyncio/runners.py", line 190, in run return runner.run(main) ^^^^^^^^^^^^^^^^ File "/usr/lib/python3.11/asyncio/runners.py", line 118, in run return self._loop.run_until_complete(task) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3.11/asyncio/base_events.py", line 653, in run_until_complete return future.result() ^^^^^^^^^^^^^^^ File "/home/username/.local/share/pipx/venvs/ghunt/lib/python3.11/site-packages/ghunt/modules/login.py", line 68, in check_and_login master_token, services, owner_email, owner_name = await auth.android_master_auth(as_client, oauth_token) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/home/username/.local/share/pipx/venvs/ghunt/lib/python3.11/site-packages/ghunt/helpers/auth.py", line 39, in android_master_auth raise GHuntAndroidMasterAuthError(f'Expected "{keyword}" in the response of the Android Master Authentication.\nThe oauth_token may be expired.') ghunt.errors.GHuntAndroidMasterAuthError: Expected "Token" in the response of the Android Master Authentication. The oauth_token may be expired.

To Reproduce Steps to reproduce the behavior:

  1. Enter ghunt login
  2. Select option 1 or 2 or 3
  3. See the error

Expected behavior Successful login and saving credentials to the creds.m file.

System (please complete the following information):

Additional context

The attempts were made using companion app (both in listening mode or copy-paste) with multiple accounts and after trying chrome/firefox and cleaning all cookies, nothing helped.

The actual response from the https://android.googleapis.com/auth endpoint is Error=BadAuthentication with status code 403 and consequently the parsed response is {'Error': 'BadAuthentication'}

The app version is latest (2.2.2)