111 lines
2.7 KiB
Python
111 lines
2.7 KiB
Python
#!/usr/bin/env python
|
|
|
|
import re
|
|
import time
|
|
import socket
|
|
import hashlib
|
|
import requests
|
|
import sympy
|
|
import hashcash
|
|
"""
|
|
requirements:
|
|
sympy
|
|
requests
|
|
"""
|
|
|
|
|
|
def knock():
|
|
for port in [1337, 2674, 4011]:
|
|
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
|
s.setblocking(False)
|
|
|
|
print("Knocking {}".format(port))
|
|
s.connect_ex(("152.66.249.144", port))
|
|
|
|
s.close()
|
|
|
|
time.sleep(0.1)
|
|
|
|
|
|
def server_communicate():
|
|
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
|
s.setblocking(True)
|
|
|
|
s.connect_ex(("152.66.249.144", 8888))
|
|
|
|
print(s.recv(1024).decode())
|
|
s.send("Y8O353".encode())
|
|
print(s.recv(1024).decode())
|
|
|
|
last_solution = numbre_crunch(s)
|
|
|
|
print(s.recv(1024).decode())
|
|
print(s.recv(1024).decode())
|
|
|
|
sha1_magic(s, last_solution)
|
|
|
|
s.close()
|
|
|
|
|
|
def sha1_magic(s, last_solution):
|
|
hash_sha1 = hashlib.sha1()
|
|
print('Y8O353{}'.format(last_solution))
|
|
hash_sha1.update('Y8O353{}'.format(last_solution).encode())
|
|
digest = str(hash_sha1.hexdigest())
|
|
print(digest)
|
|
s.send(digest.encode())
|
|
print(s.recv(1024).decode())
|
|
newstring = hashcash.generate(16, 'Y8O353{}'.format(last_solution))
|
|
print(s.recv(1024).decode())
|
|
print(newstring)
|
|
s.send(newstring.encode())
|
|
print(s.recv(1024).decode())
|
|
|
|
|
|
def http_comm():
|
|
sess = requests.Session()
|
|
url = "http://152.66.249.144/"
|
|
sess.post(url, data={"neptun": "Y8O353", "password": "crysys"})
|
|
cert = sess.get("{}getcert.php".format(url), allow_redirects=True)
|
|
open("/tmp/clientcert.pem", "wb").write(cert.content)
|
|
key = sess.get("{}getkey.php".format(url), allow_redirects=True)
|
|
open("/tmp/clientkey.pem", "wb").write(key.content)
|
|
|
|
|
|
def https_comm():
|
|
sess = requests.Session()
|
|
url = "https://152.66.249.144/"
|
|
flag = sess.get(url, cert=("/tmp/clientcert.pem", "/tmp/clientkey.pem"), verify=False, headers={'User-Agent': 'CrySyS'})
|
|
print(flag.content)
|
|
|
|
|
|
def numbre_crunch(s):
|
|
problem_statement = s.recv(1024).decode().split('\n')
|
|
numofcycles = re.findall(r'[0-9]+', problem_statement[0])
|
|
|
|
print(problem_statement)
|
|
solution1 = sympy.sympify(problem_statement[2].split('.')[1].split('=')[0])
|
|
print(solution1)
|
|
s.send(str(solution1).encode())
|
|
|
|
last_solution = None
|
|
|
|
for i in range(int(numofcycles[0]) - 1):
|
|
problem_statement_for = s.recv(1024).decode()
|
|
print(problem_statement_for)
|
|
solution = sympy.sympify(problem_statement_for.split('.')[1].split('=')[0])
|
|
print(solution)
|
|
s.send(str(solution).encode())
|
|
last_solution = solution
|
|
|
|
return last_solution
|
|
|
|
|
|
if __name__ == '__main__':
|
|
knock()
|
|
server_communicate()
|
|
http_comm()
|
|
https_comm()
|
|
|
|
# FLAG: YouCanHandleNetworking-Y8O353-1d66de
|