Haketilo

#!/usr/bin/env python3

from cryptography.hazmat.primitives.kdf import hkdf

from cryptography.hazmat.backends import openssl

from cryptography.hazmat.primitives import hashes, hmac

import base64, json, librecaptcha, random, requests, sys, time

s, offset = requests.Session(), 0

s.headers.update({'user-agent': 'Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0'})

def get(varname):

	if varname not in options:

		options[varname] = input('Please enter ' + varname.replace('_', ' ') + ': ')

	if varname not in options:

		raise Exception('Could not obtain a value for ' + varname + '.')

	return options[varname]

def hawk_header(payload, *request): # request = (method, path, host, port)~ all str

	hasher, hmacer = hashes.Hash(hashes.SHA256(), openssl.backend), hmac.HMAC(key, hashes.SHA256(), openssl.backend)

	hasher.update(('hawk.1.payload\napplication/json\n' + payload + '\n').encode('utf-8'))

	payload_hash, time_stamp = base64.b64encode(hasher.finalize()).decode('utf-8'), str(int(time.time() + offset))

	nonce = ''.join([ random.choice('0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz') for i in range(6) ])

	hmacer.update(('hawk.1.header\n' + time_stamp + '\n' + nonce + '\n' + '\n'.join(request) + '\n' + payload_hash + '\n\n').encode('utf-8'))

	mac = base64.b64encode(hmacer.finalize()).decode('utf-8')

	return 'Hawk id="' + key_id + '", ts="' + time_stamp + '", nonce="' + nonce + '", hash="' + payload_hash + '", mac="' + mac + '"'

def jwt_header():

	# "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9" below is the base-64 encoding of the header {"alg":"HS256","typ":"JWT"}

	time_stamp, hmacer = int(time.time() + offset), hmac.HMAC(jwtsec, hashes.SHA256(), openssl.backend)

	payload = '{"iss":"' + jwtkey + '","iat":' + str(time_stamp) + ',"jti":"'

	payload += ''.join([ random.choice('0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz') for i in range(9) ])

	payload +=  '","exp":' + str(time_stamp + 60) + '}'

	body = b'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.' + base64.b64encode(payload.encode('utf-8'), b'-_').rstrip(b'=')

	hmacer.update(body)

	body += b'.' + base64.b64encode(hmacer.finalize(), b'-_').rstrip(b'=')

	return 'JWT ' + body.decode('utf-8')

def req(method, *args, **kwargs):

	r = getattr(s, method)(*args, **kwargs)

	if r.status_code < 200 or r.status_code >= 300:

		raise Exception(str(r.status_code) + ':\n' + r.text)

	return r

aliases = {

	'name': 'display_name',

	'display-name': 'display_name',

	'n': 'display_name',

	'p': 'stretched_password',

	'e': 'e-mail',

	'email': 'e-mail',

	'stretched-password': 'stretched_password',

	'password': 'stretched_password',

	'i': 'info',

	'k': 'keys',

	'key': 'keys',

	'c': 'create',

	'd': 'delete',

	'del': 'delete',

	'v': 'verify',

	'u': 'unblock',

	'j': 'json_key_pair',

	'json-key-pair': 'json_key_pair',

	'json-keys': 'json_key_pair',

	'key-pair': 'json_key_pair',

	'keypair': 'json_key_pair',

	'h': 'help'

}

long_args = {

	'display_name': True,

	'stretched_password': True,

	'info': True,

	'keys': False,

	'create': False,

	'delete': False,

	'verify': True,

	'unblock': False,

	'json_key_pair': True,

	'e-mail': True,

	'help': False

}

options, current_arg = {}, None

for arg in sys.argv[1:]:

	if current_arg:

		options[current_arg], current_arg = arg, None

	elif not arg.startswith('-') and len(arg) > 1:

		raise Exception('Positional argument found: positional arguments are not allowed.')

	else:

		if arg.startswith('--'):

			arg = arg[2:].lower()

		else:

			args = list(arg[1:])

			arg = args.pop()

			for arg2 in args:

				if arg2 not in aliases:

					raise Exception('Invalid short argument -' + arg2 + '.')

				long_arg = aliases[arg2]

				if long_args[long_arg]:

					raise Exception('Short argument -' + arg2 + ' must take an argument.')

				options[long_arg] = True

		if arg in aliases:

			arg = aliases[arg]

		elif arg not in long_args:

			raise Exception('Invalid argument -(-)' + arg + '.')

		if long_args[arg]:

			current_arg = arg

		else:

			options[arg] = True

if current_arg:

	raise Exception('Terminated with option name.')

if 'help' in options:

	print('''Usage:', sys.argv[0], '[OPTIONS]')

Available options:

-c, --create

	Generate an account or (with -k) a keypair

-d, --delete

	Delete an account (use with -k unsupported)

-k, --keys

	Perform an action on API keypair; if not specified, print the current keypair

-h, --help

	Print this help text

 -n, --name [DISPLAY NAME]

	Set the display to use when creating an account

 -e, --email, --e-mail [E-MAIL ADDRESS]

	Account e-mail address

-p, --stretched-password, --stretched_password [STRING]

	Stretched account password (a 64-character hex string)

-u, --unblock

	Unblock the account before logging in

''')

	sys.exit(0)

elif 'info' in options:

	with open(options['info'], mode='r') as f:

		line = f.readline()

		while line:

			if ':' in line:

				key, value = line.split(':', maxsplit=1)

				key, value = key.lower(), value[:-1]

				if key in aliases:

					key = aliases[key]

				if key not in options and long_args.get(key):

					long_args[key] = value

			line = f.readline()

if 'delete' in options or 'create' in options or 'keys' in options:

	email, pwd = get('e-mail'), get('stretched_password')

	if '@' not in email:

		raise Exception('Invalid e-mail address.')

	if len(pwd) != 64 or pwd.lstrip('1234567890abcdef'):

		raise Exception('Invalid stretched password: should be a 64-character hex string.')

	unblock = None

	if 'create' in options and 'keys' not in options:

		endpoint, verify = 'create', 'email-otp'

	else:

		endpoint, verify = 'login', None

		if 'verify' in options:

			verify = options['verify']

		elif 'unblock' in options:

			print('[Making unblock request]')

			req('post', 'https://api.accounts.firefox.com/v1/account/login/send_unblock_code',

				json={'email': email, 'metricsContent': {}})

			print('A code should have been sent to your e-mail address.')

			unblock = input('Please enter code: ')

			if len(unblock) != 8 or not unblock.isupper() or not unblock.isalnum():

				raise Exception('Invalid unblock code: should be 8 characters, either uppercase letters or digits')

	data = {'email': email, 'authPW': pwd, 'service': 'a4907de5fa9d78fc', 'metricsContext': {}}

	if verify:

		data['verificationMethod'] = verify

	if unblock:

		data['unblockCode'] = unblock

	print('[Signing in]')

	data = req('post', 'https://api.accounts.firefox.com/v1/account/' + endpoint, json=data).json()

	uid, offset = data['uid'], data['authAt'] - time.time()

	session_token = int(data['sessionToken'], 16)

	session_token = session_token.to_bytes((session_token.bit_length() + 7) // 8, 'big')

	key_block = hkdf.HKDF(hashes.SHA256(), 32*3*8, b'', b'identity.mozilla.com/picl/v1/sessionToken', openssl.backend).derive(session_token)

	# algorithm, length, salt, info, backend

	key_id, key = key_block[:32].hex(), key_block[32:64]

	# Handle verification

	if verify == 'email-otp':

		print('A six-digit verification code should have been sent to your e-mail address.')

		code = input('Please enter verification code: ')

		if not (len(code) == 6 and code.isdigit()):

			raise Exception('Invalid verification code: codes should be 6 digits.')

		data = json.dumps({'code': code, 'service': 'a4907de5fa9d78fc', 'scopes': ['profile','openid'], 'newsletters': []})

		auth_header = hawk_header(data, 'POST', '/v1/session/verify_code', 'api.accounts.firefox.com', '443')

		print('[Seeking verification]')

		req('post', 'https://api.accounts.firefox.com/v1/session/verify_code',

			headers={'authorization': auth_header, 'content-type': 'application/json'}, data=data)

	# Get OAuth

	print('[Obtaining OAuth permissions- 3 requests to be made]')

	r = req('get', 'https://addons.mozilla.org/api/v4/accounts/login/start/?config=amo&to=%2Fen-US%2Ffirefox%2F')

	state = r.url.split('&state=', maxsplit=1)[1].split('&', maxsplit=1)[0].replace('%3A', ':')

	data = json.dumps({'client_id': 'a4907de5fa9d78fc', 'scope': 'profile openid', 'state': state})

	auth_header = hawk_header(data, 'POST', '/v1/oauth/authorization', 'api.accounts.firefox.com', '443')

	r = req('post', 'https://api.accounts.firefox.com/v1/oauth/authorization',

		headers={'authorization': auth_header, 'content-type': 'application/json'}, data=data)

	req('get', r.json()['redirect'])

if 'create' in options:

	dbase = {'action': 'generate'}

	r = req('get', 'https://addons.mozilla.org/en-US/developers/addon/api/key/')

	csrf = r.text.replace("'", '"').split('<meta name="csrf" content="', maxsplit=1)[1].split('"', maxsplit=1)[0]

	if r.url == 'https://addons.mozilla.org/en-US/developers/addon/agreement/':

		# Part of the initial sign-up process

		print("LEGAL NOTICE:\nBy continuing, you accept Mozilla's:\n")

		print("-\tdistribution agreement <https://extensionworkshop.com/documentation/publish/firefox-add-on-distribution-agreement/>")

		print("-\treview policy <https://extensionworkshop.com/documentation/publish/add-on-policies/>")

		display_name = get('display_name')

		token = librecaptcha.get_token('6LcsBhYTAAAAAKpVTZ16Lh7nmTxVRKoKSr8e3vsV', 'https://addons.mozilla.org/',

						'Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0')

		data = {'distribution_agreement': 'on', 'review_policy': 'on', 'display_name': display_name, \

			'g-recaptcha-response': token, 'csrfmiddlewaretoken': csrf}

		r = req('post', 'https://addons.mozilla.org/en-US/developers/addon/agreement/', data=data,

			headers={'referer': 'https://addons.mozilla.org/en-US/developers/addon/agreement/'})

		csrf = r.text.split('<meta name="csrf" content="', maxsplit=1)[1].split('"', maxsplit=1)[0]

	dbase['csrfmiddlewaretoken'] = csrf

	req('post', 'https://addons.mozilla.org/en-US/developers/addon/api/key/',

		headers={'referer': 'https://addons.mozilla.org/en-US/developers/addon/api/key/'}, data=dbase)

	print('If you have not created a keypair before, a link should have been sent to your e-mail address.')

	token = input('Please enter link if applicable, nothing otherwise: ')

	if token:

		if '://' not in token:

			raise Exception('Invalid link.')

		token = token.split('?token=', maxsplit=1)[1].split('&', maxsplit=1)[0]

		dbase = {'confirmation_token': token, 'action': 'generate'}

		r = req('get', 'https://addons.mozilla.org/en-US/developers/addon/api/key/?token=' + token)

		dbase['csrfmiddlewaretoken'] = r.text.replace("'", '"').split('<meta name="csrf" content="', maxsplit=1)[1].split('"', maxsplit=1)[0]

		r = req('post', 'https://addons.mozilla.org/en-US/developers/addon/api/key/?token=' + token,

		headers={'referer': 'https://addons.mozilla.org/en-US/developers/addon/api/key/?token=' + token}, data=dbase)

	json_key, text = r.text.split('name="jwtkey" value="', maxsplit=1)[1].split('"', maxsplit=1)

	print('Key:', json_key)

	secret = text.split('name="jwtsecret" value="', maxsplit=1)[1].split('"', maxsplit=1)[0]

	print('Secret:', secret)

elif 'keys' in options:

	if 'delete' in options:

		print('KEY DELETION IS CURRENTLY UNSUPPORTED.')

	else:

		r = req('get', 'https://addons.mozilla.org/en-US/developers/addon/api/key/')

		json_key, text = r.text.split('name="jwtkey" value="', maxsplit=1)[1].split('"', maxsplit=1)

		print('Key:', json_key)

		secret = text.split('name="jwtsecret" value="', maxsplit=1)[1].split('"', maxsplit=1)[0]

		print('Secret:', secret)

elif 'delete' in options:

	if input('Please type "y" and press return to delete your account') == 'y':

		email, pwd = get('e-mail'), get('stretched_password')

		data = json.dumps({'email': email, 'authPW': pwd})

		auth_header = hawk_header(data, 'POST', '/v1/account/destroy', 'api.accounts.firefox.com', '443')

		req('post', 'https://api.accounts.firefox.com/v1/account/destroy',

			headers={'authorization': auth_header, 'content-type': 'application/json'}, data=data)

		sys.exit(0)

if 'e-mail' in options and 'stretched_password' in options:

	auth_header = hawk_header('{}', 'POST', '/v1/session/destroy', 'api.accounts.firefox.com', '443')

	r = req('post', 'https://api.accounts.firefox.com/v1/session/destroy',

		headers={'authorization': auth_header, 'content-type': 'application/json'}, data='{}')