netsec-webhomework/netsec.py

#!/usr/bin/env python

import re
import time
import socket
import hashlib
import requests
import sympy
import hashcash
"""
requirements:
    sympy
    requests
"""


def knock():
    for port in [1337, 2674, 4011]:
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.setblocking(False)

        print("Knocking {}".format(port))
        s.connect_ex(("152.66.249.144", port))

        s.close()

        time.sleep(0.1)


def server_communicate():
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.setblocking(True)

    s.connect_ex(("152.66.249.144", 8888))

    print(s.recv(1024).decode())
    s.send("Y8O353".encode())
    print(s.recv(1024).decode())

    last_solution = numbre_crunch(s)

    print(s.recv(1024).decode())
    print(s.recv(1024).decode())

    sha1_magic(s, last_solution)

    s.close()


def sha1_magic(s, last_solution):
    hash_sha1 = hashlib.sha1()
    print('Y8O353{}'.format(last_solution))
    hash_sha1.update('Y8O353{}'.format(last_solution).encode())
    digest = str(hash_sha1.hexdigest())
    print(digest)
    s.send(digest.encode())
    print(s.recv(1024).decode())
    newstring = hashcash.generate(16, 'Y8O353{}'.format(last_solution))
    print(s.recv(1024).decode())
    print(newstring)
    s.send(newstring.encode())
    print(s.recv(1024).decode())


def http_comm():
    sess = requests.Session()
    url = "http://152.66.249.144/"
    sess.post(url, data={"neptun": "Y8O353", "password": "crysys"})
    cert = sess.get("{}getcert.php".format(url), allow_redirects=True)
    open("/tmp/clientcert.pem", "wb").write(cert.content)
    key = sess.get("{}getkey.php".format(url), allow_redirects=True)
    open("/tmp/clientkey.pem", "wb").write(key.content)


def https_comm():
    sess = requests.Session()
    url = "https://152.66.249.144/"
    flag = sess.get(url, cert=("/tmp/clientcert.pem", "/tmp/clientkey.pem"), verify=False, headers={'User-Agent': 'CrySyS'})
    print(flag.content)


def numbre_crunch(s):
    problem_statement = s.recv(1024).decode().split('\n')
    numofcycles = re.findall(r'[0-9]+', problem_statement[0])

    print(problem_statement)
    solution1 = sympy.sympify(problem_statement[2].split('.')[1].split('=')[0])
    print(solution1)
    s.send(str(solution1).encode())

    last_solution = None

    for i in range(int(numofcycles[0]) - 1):
        problem_statement_for = s.recv(1024).decode()
        print(problem_statement_for)
        solution = sympy.sympify(problem_statement_for.split('.')[1].split('=')[0])
        print(solution)
        s.send(str(solution).encode())
        last_solution = solution

    return last_solution


if __name__ == '__main__':
    knock()
    server_communicate()
    http_comm()
    https_comm()

# FLAG: YouCanHandleNetworking-Y8O353-1d66de