Advertisement
Guest User

Untitled

a guest
Jul 16th, 2018
76
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Python 7.25 KB | None | 0 0
  1. #!/usr/bin/env python
  2.  
  3. import string
  4. import urllib
  5. import urllib2
  6. import time
  7. import re
  8. import base64
  9. import sys
  10. from PIL import Image
  11. import pytesseract
  12. import hashlib
  13.  
  14. ## Settings
  15. URL_BASE = "http://51.15.73.163/BOT-WORLD/"
  16. URL_INDEX = URL_BASE + "index.php"
  17. URL_GENERATE = URL_BASE + "generate_captcha.php"
  18.  
  19. def sha256(text):
  20.     h = hashlib.new('sha256')
  21.    
  22.     h.update(text.encode("utf-8"))
  23.    
  24.     return h.hexdigest()
  25.  
  26. def is_ascii(s):
  27.     return all(ord(c) < 128 for c in s)
  28.  
  29. def isSolved(title):
  30.     if title == "":
  31.         return False
  32.    
  33.     if "Incorrect solution" in title:
  34.         return False
  35.        
  36.     if "Solve captchas to get invitation" in title:
  37.         return False
  38.    
  39.     return True
  40.    
  41. def getTitle(data):
  42.     result = re.search(r"<h4>(.+)</h4>", data, re.M|re.I)
  43.     title = result.group(1) if result else ""
  44.    
  45.     return title
  46.    
  47. def getWebsiteCode(data):
  48.     data = urllib.unquote(data).decode('utf8')
  49.    
  50.     result = re.search(r"data=(.+)\'", data, re.M|re.I)
  51.     website_code = result.group(1) if result else ""
  52.    
  53.     return website_code
  54.  
  55. def getFlag(data):
  56.     result = re.search(r"(CTF{.+})", data, re.M|re.I)
  57.    
  58.     flag = result.group(1) if result else ""
  59.    
  60.     return flag
  61.  
  62. """
  63.     Results get/save
  64. """
  65. def getResults():
  66.     list = {}
  67.    
  68.     with open('results.txt') as fp:
  69.         for line in fp:
  70.             result = re.search(r"(.+)   (.+)", line, re.M|re.I)
  71.            
  72.             ## Get website code
  73.             website_code = result.group(1)
  74.            
  75.             ## Get captcha code
  76.             captcha_code = result.group(2)
  77.            
  78.             list[website_code] = captcha_code
  79.    
  80.     return list
  81.    
  82. def saveResults(website_code, captcha_code):
  83.     f = open("results.txt","a+")
  84.    
  85.     if f:
  86.         f.write("{} {}\n".format(website_code, captcha_code))
  87.    
  88.         f.close()
  89.  
  90. """
  91.  
  92. """
  93. def createSession():
  94.     session = urllib2.build_opener()
  95.    
  96.     ## Go to index page
  97.     response = session.open(URL_INDEX)
  98.     data = response.read()
  99.    
  100.     ## Get Cookie
  101.     cookie = response.info().getheader('Set-cookie')
  102.     cookie = cookie[cookie.find("=")+1:cookie.find(";")]
  103.    
  104.     ## Set Cookie
  105.     session.addheaders.append(("Cookie", "PHPSESSID={}".format(cookie)))
  106.    
  107.     return session, getWebsiteCode(data)
  108.  
  109. def downloadImage(session, website_code):
  110.     website_code = urllib.quote(website_code, safe='')
  111.  
  112.     file_name = "download/{}.png".format(website_code)
  113.    
  114.     ## Download Picture
  115.     response = session.open(URL_GENERATE + "?data=" + website_code)
  116.     data = response.read()
  117.    
  118.     ## Save picture
  119.     f = open(file_name, "wb")
  120.     f.write(data)
  121.     f.close()
  122.  
  123. def removeNoice(website_code):
  124.     website_code = urllib.quote(website_code, safe='')
  125.    
  126.     infile_path = "download/{}.png".format(website_code)
  127.     outfile_path = "unfilter/{}.png".format(website_code)
  128.    
  129.     im = Image.open(infile_path)
  130.     im = im.convert('RGB')
  131.     pix = im.load()
  132.    
  133.     w = im.size[0]
  134.     h = im.size[1]
  135.    
  136.     gen_im = Image.new("RGB", (w, h), "white")
  137.     gen_pix = gen_im.load()
  138.    
  139.     # Patch pixels
  140.     for y in range(h):
  141.         for x in range(w):
  142.             if pix[x, y][0] != 15 and pix[x, y][1] != 15 and pix[x, y][2] != 15:
  143.                 gen_pix[x, y] = pix[x, y]
  144.    
  145.     gen_im.save(outfile_path, "PNG")
  146.    
  147.     return gen_im
  148.  
  149. """
  150.    
  151. """
  152. def genReverse(results):
  153.     reverse = [{} for x in range(10)]
  154.    
  155.     ## These cases pytesseract had a hard time to solve, I added this by hand
  156.     reverse[2][43] = "J"
  157.     reverse[3][10] = "l"
  158.     reverse[3][43] = "M"
  159.     reverse[5][43] = "M"
  160.    
  161.     for website_code in results:
  162.         decode_web = base64.b64decode(website_code)
  163.         captcha_code = results[website_code]
  164.        
  165.         ## Create results
  166.         reverse[0][ord(decode_web[0])] = captcha_code[0]
  167.         reverse[1][ord(decode_web[1])] = captcha_code[1]
  168.         reverse[2][ord(decode_web[2])] = captcha_code[2]
  169.         reverse[3][ord(decode_web[3])] = captcha_code[3]
  170.         reverse[4][ord(decode_web[4])] = captcha_code[4]
  171.         reverse[5][ord(decode_web[5])] = captcha_code[5]
  172.         reverse[6][ord(decode_web[6])] = captcha_code[6]
  173.         reverse[7][ord(decode_web[7])] = captcha_code[7]
  174.         reverse[8][ord(decode_web[8])] = captcha_code[8]
  175.         reverse[9][ord(decode_web[9])] = captcha_code[9]
  176.        
  177.     return reverse
  178.  
  179. def decode(reverse, website_code):
  180.     decode_web = base64.b64decode(website_code)
  181.    
  182.     ## Debug
  183.     ##print(decode_web)
  184.    
  185.     captcha_code = reverse[0][ord(decode_web[0])]
  186.     captcha_code += reverse[1][ord(decode_web[1])]
  187.     captcha_code += reverse[2][ord(decode_web[2])]
  188.     captcha_code += reverse[3][ord(decode_web[3])]
  189.     captcha_code += reverse[4][ord(decode_web[4])]
  190.     captcha_code += reverse[5][ord(decode_web[5])]
  191.     captcha_code += reverse[6][ord(decode_web[6])]
  192.     captcha_code += reverse[7][ord(decode_web[7])]
  193.     captcha_code += reverse[8][ord(decode_web[8])]
  194.     captcha_code += reverse[9][ord(decode_web[9])]
  195.    
  196.     return captcha_code
  197.    
  198. def test(results, reverse):
  199.     for website_code in results:
  200.         captcha_code = decode(reverse, website_code)
  201.        
  202.         if captcha_code != results[website_code]:
  203.             print(website_code)
  204.             print(captcha_code)
  205.             print(results[website_code])
  206.             print("-------------")
  207.            
  208.             print("Oeps something went wrong! :O YOU FAILL!!!!")
  209.            
  210.             return False
  211.    
  212.     print("Passed all tests! Good Job! :D")
  213.    
  214.     return True
  215.  
  216. def total(reverse):
  217.     c = 0
  218.    
  219.     for l in reverse:
  220.         c += len(l)
  221.    
  222.     return c
  223.  
  224. def analiseResults():
  225.     results = getResults()
  226.     reverse = genReverse(results)
  227.    
  228.     print(reverse)
  229.     print("total found = {}".format(total(reverse)))
  230.    
  231.     test(results, reverse)
  232.  
  233. def runChallange():
  234.     save = False
  235.     solved = 0
  236.    
  237.     results = getResults()
  238.     reverse = genReverse(results)
  239.    
  240.     session, website_code = createSession()
  241.    
  242.     for i in range(100000):
  243.         ## Try to decode with know results
  244.         try:
  245.             ## Generate captcha code
  246.             captcha_code = decode(reverse, website_code)
  247.            
  248.             save = False
  249.         except:
  250.             ## Not enough results, try to decode the captcha picture
  251.            
  252.             ## Download image
  253.             downloadImage(session, website_code)
  254.            
  255.             ## Remove noice out of picture
  256.             im = removeNoice(website_code)
  257.            
  258.             ## Generate captcha
  259.             captcha_code = pytesseract.image_to_string(im)
  260.             captcha_code = captcha_code if is_ascii(captcha_code) else ""
  261.            
  262.             save = True
  263.        
  264.         ## Go to index page
  265.         post = urllib.urlencode({"captcha" : captcha_code, "Submit" : "Submit"})
  266.         response = session.open(URL_INDEX, post)
  267.        
  268.         data = response.read()
  269.         title = getTitle(data)
  270.        
  271.         if isSolved(title) == True:
  272.             if save:
  273.                 ## Save result
  274.                 saveResults(website_code, captcha_code)
  275.  
  276.                 ## Refresh
  277.                 results = getResults()
  278.                 reverse = genReverse(results)
  279.            
  280.             solved += 1
  281.         else:
  282.             solved = 0
  283.        
  284.         print("---------------------------------------")
  285.         print("title = {}".format(title))
  286.         print("website_code = {}".format(website_code))
  287.         print("captcha_code = {}".format(captcha_code))
  288.         print("Learned = {}/620".format(total(reverse)))
  289.         print("Solved = {}".format(solved))
  290.         print("---------------------------------------")
  291.            
  292.         ## Solved challange! :D
  293.         if "You have proved yourself bot" in title:
  294.             flag = getFlag(title)
  295.            
  296.             print("Flag = {}".format(flag))
  297.             print("Sha256 = {}".format(sha256(flag)))
  298.             return
  299.        
  300.         ## Get next website code
  301.         website_code = getWebsiteCode(data)
  302.        
  303.         ## Debug
  304.         ##print("website_code = {}".format(website_code))
  305.        
  306.         if website_code == "":
  307.             solved = 0
  308.            
  309.             ## Create new session
  310.             session, website_code = createSession()
  311.    
  312. def main(argv):
  313.     if "-a" in argv:
  314.         analiseResults()
  315.     else:
  316.         runChallange()
  317.        
  318. if __name__ == "__main__":
  319.    main(sys.argv[1:])
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement