duplicati-login.py

import base64
import hashlib
import json
import requests
import sys

def get_hash(pwhash,nonce):
  # var noncedpwd = CryptoJS.SHA256(CryptoJS.enc.Hex.parse(CryptoJS.enc.Base64.parse(data.Nonce) + saltedpwd)).toString(CryptoJS.enc.Base64);
  m = hashlib.sha256()
  payload =  base64.b64decode(nonce) + base64.b64decode(pwhash)
  m.update(payload)
  return base64.b64encode(m.digest())

def main():
  if len(sys.argv) < 3:
    print(f"{sys.argv[0]} <server-passphrase> <login URL>")
    return

  pwhash = sys.argv[1]
  login_url = sys.argv[2]
  
  s = requests.Session()
  res = s.post(login_url, data={'get-nonce':'1'})
  if res.status_code != 200:
    print(f"Something went wrong: {res}")
    return

  content = json.loads(res.text.encode().decode('utf-8-sig'))

  nonce = content["Nonce"]
  salt = content["Salt"]

  print(f"nonce: {nonce}")
  print(f"salt: {salt}")
  print(f"hash: {pwhash}")

  res = s.post(login_url, data={'password':get_hash(pwhash,nonce).decode()})

  if res.status_code != 200:
    print(f"Something went wrong: {res}")
    return
  
  for c in s.cookies:
    print(c)

if __name__ == "__main__":
  main()