diff --git a/README.md b/README.md index 4c629d9..d630831 100644 --- a/README.md +++ b/README.md @@ -1,8 +1,8 @@ ## Duo One Time Password Generator -This is a little script I put together after I reverse engineered the Duo 2FA -Mobile App and figured out how their auth flow works. This can be ported into -probably a useful desktop app or chrome extention and can probably be used to +This is a little script I put together after I reverse engineered the Duo 2FA +Mobile App and figured out how their auth flow works. This can be ported into +probably a useful desktop app or chrome extention and can probably be used to write bots for MIT Services that require auth. ### Usage @@ -27,6 +27,12 @@ If everything worked you can then generate a code by running: ./duo_gen.py ``` -Warning: These are HOTP tokens and generate codes increments a counter. If you +Warning: These are HOTP tokens and generate codes increments a counter. If you get too far out of sync with the server it will stop accepting your codes. +``` +./duo_export.py +``` + +Export the duo hotp secret as a QR code for inclusion in third-party hotp apps +like freeotp. diff --git a/duo_export.py b/duo_export.py new file mode 100755 index 0000000..d69683d --- /dev/null +++ b/duo_export.py @@ -0,0 +1,24 @@ +#!/usr/bin/env python3 + +import pyotp +import pyqrcode +import json +import base64 +import sys + +file_json = "response.json" + +with open('response.json', "r") as f: + response = json.loads(f.read())['response'] + +with open('duotoken.hotp', "r") as f: + counter = int(f.readlines()[1]) + +label = response['customer_name'] +issuer = 'Duo' +# base32 encoded hotp secret, with the padding ("=") stripped. +secret = base64.b32encode(bytes(response['hotp_secret'], 'utf-8')).decode('utf-8').replace('=', '') +qrdata = 'otpauth://hotp/{label}?secret={secret}&issuer={issuer}&counter={counter}'.format(label=label, secret=secret, issuer=issuer, counter=counter) +qrcode = pyqrcode.create(qrdata) +print(qrcode.terminal(quiet_zone=1)) +print(qrdata) diff --git a/duo_gen.py b/duo_gen.py index d4da768..da92bc2 100755 --- a/duo_gen.py +++ b/duo_gen.py @@ -22,4 +22,3 @@ print("Code:", hotp.at(count)) f.seek(offset) f.write(str(count + 1)) f.close() -