Advertisement
Guest User

Untitled

a guest
Jul 16th, 2018
89
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Python 6.90 KB | None | 0 0
  1. #!/usr/bin/env python
  2.  
  3. import string
  4. import urllib
  5. import urllib2
  6. import time
  7. import re
  8. import base64
  9. import sys
  10. from PIL import Image
  11. import pytesseract
  12. import hashlib
  13.  
  14. ## Settings
  15. URL_BASE = "http://51.15.73.163/BOT-WORLD/"
  16. URL_INDEX = URL_BASE + "index.php"
  17. URL_GENERATE = URL_BASE + "generate_captcha.php"
  18.  
  19. def sha256(text):
  20.     h = hashlib.new('sha256')
  21.    
  22.     h.update(text.encode("utf-8"))
  23.    
  24.     return h.hexdigest()
  25.  
  26. def is_ascii(s):
  27.     return all(ord(c) < 128 for c in s)
  28.  
  29. def getTitle(data):
  30.     result = re.search(r"<h4>(.+)</h4>", data, re.M|re.I)
  31.     title = result.group(1) if result else ""
  32.    
  33.     return title
  34.    
  35. def getWebsiteCode(data):
  36.     data = urllib.unquote(data).decode('utf8')
  37.    
  38.     result = re.search(r"data=(.+)\'", data, re.M|re.I)
  39.     website_code = result.group(1) if result else ""
  40.    
  41.     return website_code
  42.  
  43. def getFlag(data):
  44.     result = re.search(r"(CTF{.+})", data, re.M|re.I)
  45.    
  46.     flag = result.group(1) if result else ""
  47.    
  48.     return flag
  49.  
  50. """
  51.     Results get/save
  52. """
  53. def getResults():
  54.     list = {}
  55.    
  56.     with open('results.txt') as fp:
  57.         for line in fp:
  58.             result = re.search(r"(.+)   (.+)", line, re.M|re.I)
  59.            
  60.             ## Get website code
  61.             website_code = result.group(1)
  62.            
  63.             ## Get captcha code
  64.             captcha_code = result.group(2)
  65.            
  66.             list[website_code] = captcha_code
  67.    
  68.     return list
  69.    
  70. def saveResults(website_code, captcha_code):
  71.     f = open("results.txt","a+")
  72.    
  73.     if f:
  74.         f.write("{} {}\n".format(website_code, captcha_code))
  75.    
  76.         f.close()
  77.  
  78. """
  79.  
  80. """
  81. def createSession():
  82.     session = urllib2.build_opener()
  83.    
  84.     ## Go to index page
  85.     response = session.open(URL_INDEX)
  86.     data = response.read()
  87.    
  88.     ## Get Cookie
  89.     cookie = response.info().getheader('Set-cookie')
  90.     cookie = cookie[cookie.find("=")+1:cookie.find(";")]
  91.    
  92.     ## Set Cookie
  93.     session.addheaders.append(("Cookie", "PHPSESSID={}".format(cookie)))
  94.    
  95.     return session, getWebsiteCode(data)
  96.  
  97. def downloadImage(session, website_code):
  98.     website_code = urllib.quote(website_code, safe='')
  99.  
  100.     file_name = "download/{}.png".format(website_code)
  101.    
  102.     ## Download Picture
  103.     response = session.open(URL_GENERATE + "?data=" + website_code)
  104.     data = response.read()
  105.    
  106.     ## Save picture
  107.     f = open(file_name, "wb")
  108.     f.write(data)
  109.     f.close()
  110.  
  111. def removeNoice(website_code):
  112.     website_code = urllib.quote(website_code, safe='')
  113.    
  114.     infile_path = "download/{}.png".format(website_code)
  115.     outfile_path = "unfilter/{}.png".format(website_code)
  116.    
  117.     im = Image.open(infile_path)
  118.     im = im.convert('RGB')
  119.     pix = im.load()
  120.    
  121.     w = im.size[0]
  122.     h = im.size[1]
  123.    
  124.     gen_im = Image.new("RGB", (w, h), "white")
  125.     gen_pix = gen_im.load()
  126.    
  127.     # Patch pixels
  128.     for y in range(h):
  129.         for x in range(w):
  130.             if pix[x, y][0] != 15 and pix[x, y][1] != 15 and pix[x, y][2] != 15:
  131.                 gen_pix[x, y] = pix[x, y]
  132.    
  133.     gen_im.save(outfile_path, "PNG")
  134.    
  135.     return gen_im
  136.  
  137. """
  138.    
  139. """
  140. def genReverse(results):
  141.     reverse = [{} for x in range(10)]
  142.    
  143.     for website_code in results:
  144.         decode_web = base64.b64decode(website_code)
  145.         captcha_code = results[website_code]
  146.        
  147.         ## Create results
  148.         reverse[0][ord(decode_web[0])] = captcha_code[0]
  149.         reverse[1][ord(decode_web[1])] = captcha_code[1]
  150.         reverse[2][ord(decode_web[2])] = captcha_code[2]
  151.         reverse[3][ord(decode_web[3])] = captcha_code[3]
  152.         reverse[4][ord(decode_web[4])] = captcha_code[4]
  153.         reverse[5][ord(decode_web[5])] = captcha_code[5]
  154.         reverse[6][ord(decode_web[6])] = captcha_code[6]
  155.         reverse[7][ord(decode_web[7])] = captcha_code[7]
  156.         reverse[8][ord(decode_web[8])] = captcha_code[8]
  157.         reverse[9][ord(decode_web[9])] = captcha_code[9]
  158.        
  159.     return reverse
  160.  
  161. def decode(reverse, website_code):
  162.     decode_web = base64.b64decode(website_code)
  163.    
  164.     ## Debug
  165.     ##print(decode_web)
  166.    
  167.     captcha_code = reverse[0][ord(decode_web[0])]
  168.     captcha_code += reverse[1][ord(decode_web[1])]
  169.     captcha_code += reverse[2][ord(decode_web[2])]
  170.     captcha_code += reverse[3][ord(decode_web[3])]
  171.     captcha_code += reverse[4][ord(decode_web[4])]
  172.     captcha_code += reverse[5][ord(decode_web[5])]
  173.     captcha_code += reverse[6][ord(decode_web[6])]
  174.     captcha_code += reverse[7][ord(decode_web[7])]
  175.     captcha_code += reverse[8][ord(decode_web[8])]
  176.     captcha_code += reverse[9][ord(decode_web[9])]
  177.    
  178.     return captcha_code
  179.    
  180. def test(results, reverse):
  181.     for website_code in results:
  182.         captcha_code = decode(reverse, website_code)
  183.        
  184.         if captcha_code != results[website_code]:
  185.             print(website_code)
  186.             print(captcha_code)
  187.             print(results[website_code])
  188.             print("-------------")
  189.            
  190.             print("Oeps something went wrong! :O YOU FAILL!!!!")
  191.            
  192.             return False
  193.    
  194.     print("Passed all tests! Good Job! :D")
  195.    
  196.     return True
  197.  
  198. def total(reverse):
  199.     c = 0
  200.    
  201.     for l in reverse:
  202.         c += len(l)
  203.    
  204.     return c
  205.  
  206. def analiseResults():
  207.     results = getResults()
  208.     reverse = genReverse(results)
  209.    
  210.     print("total found = {}".format(total(reverse)))
  211.    
  212.     test(results, reverse)
  213.  
  214. def runChallange():
  215.     save = False
  216.    
  217.     results = getResults()
  218.     reverse = genReverse(results)
  219.    
  220.     session, website_code = createSession()
  221.    
  222.     for i in range(100000):
  223.         ## Try to decode with know results
  224.         try:
  225.             ## Generate captcha code
  226.             captcha_code = decode(reverse, website_code)
  227.            
  228.             save = False
  229.         except:
  230.             ## Not enough results, try to decode the captcha picture
  231.            
  232.             ## Download image
  233.             downloadImage(session, website_code)
  234.            
  235.             ## Remove noice out of picture
  236.             im = removeNoice(website_code)
  237.            
  238.             ## Generate captcha
  239.             captcha_code = pytesseract.image_to_string(im)
  240.             captcha_code = captcha_code if is_ascii(captcha_code) else ""
  241.            
  242.             save = True
  243.        
  244.         ## Go to index page
  245.         post = urllib.urlencode({"captcha" : captcha_code, "Submit" : "Submit"})
  246.         response = session.open(URL_INDEX, post)
  247.        
  248.         data = response.read()
  249.         title = getTitle(data)
  250.        
  251.         if not "Incorrect solution" in title:
  252.             if not "Solve captchas to get invitation" in title:
  253.                 ## New valid captcha found
  254.                 if title != "" and save:
  255.                     ## Save result
  256.                     saveResults(website_code, captcha_code)
  257.                    
  258.                     ## Refresh
  259.                     results = getResults()
  260.                     reverse = genReverse(results)
  261.                
  262.                 print("---------------------------------------")
  263.                 print("title = {}".format(title))
  264.                 print("website_code = {}".format(website_code))
  265.                 print("captcha_code = {}".format(captcha_code))
  266.                 print("Found reversed = {}/620".format(total(reverse)))
  267.                 print("---------------------------------------")
  268.        
  269.         ## Solved challange! :D
  270.         if "You have proved yourself bot" in title:
  271.             flag = getFlag(title)
  272.            
  273.             print("Flag = {}".format(flag))
  274.             print("Sha256 = {}".format(sha256(flag)))
  275.             return
  276.        
  277.         ## Get next website code
  278.         website_code = getWebsiteCode(data)
  279.        
  280.         ## Debug
  281.         ##print("website_code = {}".format(website_code))
  282.        
  283.         if website_code == "":
  284.             ## Create new session
  285.             session, website_code = createSession()
  286.    
  287. def main(argv):
  288.     if "-a" in argv:
  289.         analiseResults()
  290.     else:
  291.         runChallange()
  292.        
  293. if __name__ == "__main__":
  294.    main(sys.argv[1:])
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement