#!/usr/bin/python

#
# scorebot script for ngm
#
#
# Syntax: scorebot_ngm.py ACTION HOST ID FLAG
#
# by Collin Mulliner <collin(AT)betaversion.net>
#

import os, random, time, sys, string, socket, re


tld_str = ".de .com .org .net .edu .gov .mil .xxx .info .eu .tv .pl .int .ws .tr .iq .jp .cn .cc .ru .it .ca .au"
tld = string.split(tld_str)
dom_str = "uni money auto food sex drugs host rock music beer world fast top gas water cd movie tea coffee hard unix"
dom = string.split(dom_str)
user_str = "fred horst mike joe jmi pete james abe dieter jack alice bob carol cindy heidi lisa bart kelly al tim"
user = string.split(user_str)
last_str = "maier mueller smith jones schmidt schulze borland picard dohan simpson bundy manson"
last = string.split(last_str)

def makeUser():
	n = random.randint(0, len(user)-1)
	u = user[n]
	n = random.randint(0, 1)
	if n == 0:
		u = u + "."
	else:
		u = u + "_"
	n = random.randint(0, len(last)-1)
	u = u + last[n] + "@"
	nd = random.randint(1, 4)
	while nd > 0:
		n = random.randint(0, len(dom)-1)
		u = u + dom[n]
		nd = nd - 1
	n = random.randint(0, len(tld)-1)
	u = u + tld[n]
	return(u)


def findPrompt( s, prompt, maxLen ):
  buf = ""
  promptFound = -1
  while promptFound == -1 and len( buf ) < maxLen:
    buf = buf + s.recv(maxLen)
    promptFound = buf.find( prompt )
    
  if promptFound == -1:
    return -1
    
  return 0

def getLine( s ):
	buf = ""
	rd = 0
	while rd == 0:
		bufin = s.recv(1)
		if bufin[0] == '\n':
				rd = 1
		if bufin[0] == '\r':
				rd = 0 
		else:
			buf = buf + bufin
	#print ">"+buf
	return buf 

if len(sys.argv) < 4:
	print "\nusage: scorebot_ngm.py store|recevie IP ID FLAG\n"
	#dbg = open("/tmp/ngm.log"
	#dbg.write(sys.argv)
	#dbg.close()
	sys.exit(3)

action = sys.argv[1]
target  = sys.argv[2]
cookie = sys.argv[3]
newflag = sys.argv[4]

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM, 0)

if s.connect_ex((target, 25143)) == 0:

  # read the welcome banner
	banner = getLine(s)  
	#print banner

  # get FLAG 
	if action == "receive" or action == "retrieve" :
	
		if os.access("/tmp/ngm_TMP_" + target + "_" + cookie, os.F_OK):
			cf = open("/tmp/ngm_TMP_" + target + "_" + cookie)
			if cf == -1:
				sys.exit(0)
			line = cf.readline()
			cf.close()
			to = string.split(line)
			os.unlink("/tmp/ngm_TMP_" + target + "_" + cookie)
		else:
			sys.exit(0)
		
		buf = ""
		s.send("send\n")
		line = getLine(s)
		if line.find("200") != -1:
			s.send("to: " + to[0] + "\n")
			line = getLine(s)
			if line.find("700") != -1:
				line = getLine(s)
				if line.find("data:") != -1:
					np = re.compile(r'data: ')
					num_str = string.split(line)
					num = int(num_str[1])
					#print str(num) + "\n"
					while num > 0:
						b = s.recv(1)
						if b != '\n' and num > 1:
							buf = buf + b
						num = num - 1
					#print buf
				else:
					#print "never got data cmd"
					s.close()
					sys.exit(0)
			else:
				#print "to cmd faild"
				s.close()
				sys.exit(0)
		else:
			#print "send cmd faild"
			s.close()
			sys.exit(0)
			
		if buf == newflag:
			# FLAG is good
			#print "flag is good"
			s.send("quit\n")
			s.close()
			sys.exit(2)
		else:
			# FLAG is bad
			#print "flag is bad"
			s.send("quit\n")
			s.close()
			sys.exit(1)

	# set	 FLAG	
	elif action == "store":

		to = makeUser()
		fm = makeUser()

		cf = open("/tmp/ngm_TMP_" + target + "_" + cookie, "w")
		if cf == -1:
			exit(0)
		cf.write(to + "\n")
		cf.close()
	
		s.send("recv\n")
		line = getLine(s)
		if line.find("200") == -1:
			#print "recv cmd faild"
			sys.exit(0)
		
		s.send("to: " + to + "\n")
		line = getLine(s)
		if line.find("300") == -1:
			#print "to cmd faild"
			sys.exit(0)

		s.send("from: " + fm + "\n")
		line = getLine(s)
		if line.find("300") == -1:
			#print "from cmd faild"
			sys.exit(0)
	
		s.send("data: " + str(len(newflag)) + "\n")
		s.send(newflag + "\n")
		line = getLine(s)
		if line.find("200") == -1:
			#print "data cmd faild"
			sys.exit(0)
		
		#print "flag set"
		s.send("quit\n")
		s.close()
		sys.exit(2)
 	else:
		print "wrong command"
		sys.exit(3)

else:
	# can't connect to target
	sys.exit(0)
