forked from fail0verflow/letterbomb
-
Notifications
You must be signed in to change notification settings - Fork 2
/
app.py
183 lines (155 loc) · 5.09 KB
/
app.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
import os, zipfile, hashlib, hmac, struct, logging, random, json
import urllib
from io import BytesIO
from logging.handlers import SMTPHandler
from datetime import datetime, timedelta
from flask import Flask, request, g, render_template, make_response, redirect, url_for
from werkzeug.middleware.proxy_fix import ProxyFix
from flask_limiter import Limiter
from flask_limiter.util import get_remote_address
COUNT_CACHE_AGE = 60
counter_cache = (datetime(1999, 1, 1), -1)
app = Flask(__name__)
app.wsgi_app = ProxyFix(app.wsgi_app, x_proto=1)
app.config.from_object("config")
limiter = Limiter(
get_remote_address,
app=app,
default_limits=[],
storage_uri="memory://",
)
TEMPLATES = {
"U": "templateU.bin",
"E": "templateE.bin",
"J": "templateJ.bin",
"K": "templateK.bin",
}
BUNDLEBASE = os.path.join(app.root_path, "bundle")
class RequestFormatter(logging.Formatter):
def format(self, record):
s = logging.Formatter.format(self, record)
try:
return (
"[%s] [%s] [%s %s] "
% (
self.formatTime(record),
request.remote_addr,
request.method,
request.path,
)
+ s
)
except:
return "[%s] [SYS] " % self.formatTime(record) + s
if not app.debug:
handler = logging.FileHandler(os.path.join(app.root_path, "log", "info.log"))
handler.setLevel(logging.INFO)
handler.setFormatter(RequestFormatter())
app.logger.addHandler(handler)
app.logger.setLevel(logging.INFO)
app.logger.warning("Starting...")
def count_unique_letterbombs(path="./log/info.log"):
global counter_cache
if (datetime.now() - counter_cache[0]).total_seconds() < COUNT_CACHE_AGE:
return counter_cache[1]
res = []
with open(path) as logfile:
for line in logfile.readlines():
try:
loc = line.find("LetterBombed")
if loc == -1:
continue
mac = line[loc:].split(" ")[1]
res.append(mac)
except:
pass
res = len(set(res))
counter_cache = (datetime.now(), res)
return res
def _index(error=None):
rs = make_response(
render_template("index.html", region="U", error=error, num_lb=count_unique_letterbombs())
)
rs.headers["Expires"] = "Thu, 01 Dec 1983 20:00:00 GMT"
return rs
@app.route("/")
@limiter.limit("100/minute")
def index():
return _index()
@app.route("/haxx", methods=["POST"])
@limiter.limt("3/minute")
def haxx():
OUI_LIST = [
bytes.fromhex(i)
for i in open(os.path.join(app.root_path, "oui_list.txt")).read().split("\n")
if len(i) == 6
]
dt = datetime.utcnow() - timedelta(1)
delta = dt - datetime(2000, 1, 1)
timestamp = delta.days * 86400 + delta.seconds
try:
mac = bytes((int(request.form[i], 16)) for i in "abcdef")
template = TEMPLATES[request.form["region"]]
bundle = "bundle" in request.form
except:
return _index("Invalid input.")
if mac == b"\x00\x17\xab\x99\x99\x99":
app.logger.info(
"Derp MAC %s at %d ver %s bundle %r",
mac.hex(),
timestamp,
request.form["region"],
bundle,
)
return _index("If you're using Dolphin, try File->Open instead ;-).")
if not any([mac.startswith(i) for i in OUI_LIST]):
app.logger.info(
"Bad MAC %s at %d ver %s bundle %r",
mac.hex(),
timestamp,
request.form["region"],
bundle,
)
return _index("The exploit will only work if you enter your Wii's MAC address.")
key = hashlib.sha1(mac + b"\x75\x79\x79").digest()
blob = bytearray(open(os.path.join(app.root_path, template), "rb").read())
blob[0x08:0x10] = key[:8]
blob[0xB0:0xC4] = bytes(20)
blob[0x7C:0x80] = struct.pack(">I", timestamp)
blob[0x80:0x8A] = b"%010d" % timestamp
blob[0xB0:0xC4] = hmac.new(key[8:], bytes(blob), hashlib.sha1).digest()
path = "private/wii/title/HAEA/%s/%s/%04d/%02d/%02d/%02d/%02d/HABA_#1/txt/%08X.000" % (
key[:4].hex().upper(),
key[4:8].hex().upper(),
dt.year,
dt.month - 1,
dt.day,
dt.hour,
dt.minute,
timestamp,
)
zipdata = BytesIO()
zip = zipfile.ZipFile(zipdata, "w")
zip.writestr(path, blob)
BUNDLE = [
(name, os.path.join(BUNDLEBASE, name)) for name in os.listdir(BUNDLEBASE) if not name.startswith(".")
]
if bundle:
for name, path in BUNDLE:
zip.write(path, name)
zip.close()
app.logger.info(
"LetterBombed %s at %d ver %s bundle %r",
mac.hex(),
timestamp,
request.form["region"],
bundle,
)
rs = make_response(zipdata.getvalue())
zipdata.close()
rs.headers.add("Content-Disposition", "attachment", filename="LetterBomb.zip")
rs.headers["Content-Type"] = "application/zip"
return rs
application = app
if __name__ == "__main__":
app.run("0.0.0.0", 10142)