diff --git a/bank/checkers/support.py b/bank/checkers/support.py deleted file mode 100755 index a5de99f4e8b9013dd07c7ac19e8b83193728d0d6..0000000000000000000000000000000000000000 --- a/bank/checkers/support.py +++ /dev/null @@ -1,74 +0,0 @@ -#!/usr/bin/env python -import logging -import requests -from OpenSSL.crypto import load_privatekey, load_publickey, FILETYPE_PEM, sign, verify, X509 -import base64 -import re -from const import * - -logging.basicConfig() -log = logging.getLogger(__file__) -log.setLevel(logging.DEBUG) - -# you're supposed to generate these yourself ;) -PRIV_KEY_FILENAME="priv.pem" -PUB_KEY_FILENAME="pub.pem" -BASE_URL = "http://10.10.20.21:7777" - -def signmsg(msg): - """return b64encoded signature of msg""" - priv_key = load_privatekey(FILETYPE_PEM, open(PRIV_KEY_FILENAME).read()) - return base64.b64encode(sign(priv_key, msg, 'sha256')) - -def verifysig(msg, sig): - """verify signature sig of message msg - - note: crypto.verify() returns None on success - """ - pub_key = load_publickey(FILETYPE_PEM, open(PUB_KEY_FILENAME).read()) - x509 = X509() - x509.set_pubkey(pub_key) - log.info(verify(x509, base64.b64decode(sig), msg, 'sha256')) - - -def main(): - # get string to be verified by support's priv key - r = s.get(BASE_URL + "/login/support") - if r.status_code != 200: - log.error("GET {} failed".format(BASE_URL + "/login/support")) - - string = r.json()['string'] - sig = signmsg(string) - #verifysig(string, sig) - - # send string and signature to auth as support - data = { 'str' : string, 'signature' : sig} - r = s.post(BASE_URL + "/login/support", data=data) - - # we're support now - log.info(r.status_code) - #log.info(r.content) - - r = s.get(BASE_URL + "/card2card") - m = re.findall("%s{.*?}" % FLAG_PREFIX, r.content) - - retrieved_flags = [] - for f in m: - retrieved_flags.append(f) - print "FLAG:%s" % f - - with open(FLAG_LOG) as f: - sent_flags = filter(None, f.read().split('\n')) - retrieved_flags.sort() - sent_flags.sort() - - log.info("#flags_retrieved: {}".format(len(retrieved_flags))) - log.info("#flags_sent: {}".format(len(sent_flags))) - if retrieved_flags != sent_flags: - missing_flags = set(sent_flags) - set(retrieved_flags) - log.info("missing flags: {}".format(missing_flags)) - - -if __name__ == "__main__": - s = requests.session() - main() diff --git a/bank/checkers/user.py b/bank/checkers/user.py deleted file mode 100755 index c650cdf1f8831c91abe3415515ebeac7f98a8979..0000000000000000000000000000000000000000 --- a/bank/checkers/user.py +++ /dev/null @@ -1,80 +0,0 @@ -#!/usr/bin/env python -import sys -import os -import requests -import re -import string -import random -import hashlib -import json -import logging -import base64 -from const import * -logging.basicConfig() -log = logging.getLogger(__file__) -log.setLevel(logging.DEBUG) -BASE_URL = "http://10.10.20.21:7777" - -def submit_transaction(amount, from_card, to_card, message): - data = { - 'amount' : amount, - 'from_card' : from_card, - 'to_card' : to_card, - 'message' : message - } - r = s.post(BASE_URL + "/card2card/submit", data=data) - if r.status_code != 200: - log.error("error submitting transaction") - -def reg_card(): - r = s.post(BASE_URL + "/index/cardRegister", data={ 'register' : 'true' }) - - if r.status_code != 200: - log.error("error registering card") - return None - - return r.json()['card_number'] - -def rand_word(min_chars=8, max_chars=16): - letters = string.ascii_lowercase - return ''.join(random.choice(letters) for i in range(random.randint(min_chars, max_chars))) - -def reg_user(uname, pw): - r = s.post(BASE_URL + "/register", data={ 'username' : uname, 'password' : pw }) - - if r.status_code != 200: - log.error("error registering user") - return None - -def login_user(uname, pw): - r = s.post(BASE_URL + "/login", data={ 'username' : uname, 'password' : pw }) - if r.status_code != 200: - log.error("error logging in user") - return None - -def main(): - - uname = rand_word() - pw = rand_word() - reg_user(uname, pw) - - login_user(uname, pw) - - myid = reg_card() - if not myid: - return - - log.info("myid: {}".format(myid)) - - flag = FLAG_PREFIX + "{" + base64.b64encode(rand_word(32,32)) + "}" - log.info("flag: {}".format(flag)) - - submit_transaction(random.randrange(50,300), myid, SUPPORT_CARD_ID, flag) - - with open(FLAG_LOG, "a") as f: - f.write(flag+"\n") - - -if __name__=="__main__": - s = requests.session() - main()