Newer
Older
DrawOnHisBadge / index.php
root on 29 Jul 2019 6 KB initial commit
  1. #!/usr/bin/php
  2. <?php
  3. //error_reporting(0);
  4.  
  5. $host = '52.43.252.153'; // websocket server
  6. $port = 9001;
  7. $local = "http://localhost"; // origin header
  8. $data = '{"CMD":"CLEAR"}'; // not actaully sent
  9.  
  10. echo ".-,--. ,---. ,-_/,. ,-,---. .
  11. ' | \ ,-. ,-. . , , | | ,-. ' |_|/ . ,-. '|___/ ,-. ,-| ,-. ,-.
  12. , | / | ,-| |/|/ | | | | /| | | `-. ,| \ ,-| | | | | |-'
  13. `-^--' ' `-^ ' ' `---' ' ' `' `' ' `-' `-^---' `-^ `-' `-| `-'
  14. ,|
  15. `'\n";
  16. $head = "GET / HTTP/1.1"."\r\n".
  17. "Upgrade: WebSocket"."\r\n".
  18. "Connection: Upgrade"."\r\n".
  19. "Origin: $local"."\r\n".
  20. "Host: $host"."\r\n".
  21. "Sec-WebSocket-Version: 13"."\r\n".
  22. "Sec-WebSocket-Key: asdasdaas76da7sd6asd6as7d"."\r\n".
  23. "Content-Length: ".strlen($data)."\r\n"."\r\n";
  24.  
  25. if ($argc < 2 ){
  26. exit("Usage: php index.php <image>\n");
  27. }else{
  28. $filename = $argv[1];
  29. echo "[+] Img: $filename\n";
  30. if ($filename == null || !isset($filename)) {
  31. echo "[!] Please choose an image\n";
  32. exit(0);
  33. }else{
  34. $imgStats = list($width, $height, $type, $attr) = getimagesize($filename);
  35. echo "[i] Height: $imgStats[1]\n";
  36. echo "[i] Width: $imgStats[0]\n";
  37. if($imgStats[0] <> 64 || $imgStats[1] <> 32)
  38. die("[-] Image must be 64px Wide and 32px high");
  39.  
  40. $im = imagecreatefrompng($filename);
  41. //connect
  42. $sock = fsockopen($host, $port, $errno, $errstr, 2);
  43. fwrite($sock, $head ) or die('error:'.$errno.':'.$errstr);
  44. $headers = fread($sock, 2000);
  45.  
  46. echo "[!] sending...\n";
  47. $count = 0; // 2048 pixels total
  48. //time to get the colors
  49. for($x = 0; $x <= $imgStats[0]-1; $x++){
  50. $arrX = array();
  51. $arrY = array();
  52. $arrC = array();
  53. //calculate percentage
  54. $count++;
  55. $percent = round(($count / 64) * 100, 2);
  56. echo "[+] complete: $percent% \r";
  57.  
  58. for($y = 0; $y <= $imgStats[1]-1; $y++){
  59. $rgb = imagecolorat($im, $x, $y);
  60. $newcol = color565($im, $rgb);
  61. array_push($arrX, $x);
  62. array_push($arrY, $y);
  63. array_push($arrC, $newcol);
  64. }
  65.  
  66. //create data then send
  67. $data = '{"CMD":"DRAW","DATA":[';
  68. for($i = 0; $i <= 32-1; $i++){
  69. $data .= '['.$arrX[$i].','.$arrY[$i].',"'.$arrC[$i].'"],'; // data to be sent
  70. }
  71. $data = rtrim($data,',');
  72. $data .= ']}';
  73. //echo $data."\n"; // DEBUG
  74. fwrite($sock, hybi10Encode($data)) or die('error:'.$errno.':'.$errstr);
  75. $wsdata = fread($sock, 2000);
  76. }
  77.  
  78. //close connection
  79. fclose($sock);
  80. echo "\n[+] done\n";
  81. }
  82. }
  83.  
  84. function color565($im, $color){
  85. $color_tran = imagecolorsforindex($im, $color);
  86. $red = $color_tran['red'];
  87. $green = $color_tran['green'];
  88. $blue = $color_tran['blue'];
  89. /*bit Shifting*/
  90. $b = ($blue >> 3) & 0x1f;
  91. $g = (($green >> 2) & 0x3f) << 5;
  92. $r = (($red >> 3) & 0x1f) << 11;
  93. return "0x". strtoupper(dechex($r | $g | $b));
  94. }
  95.  
  96. // hibi10 decoding of data
  97. function hybi10Decode($data)
  98. {
  99. $bytes = $data;
  100. $dataLength = '';
  101. $mask = '';
  102. $coded_data = '';
  103. $decodedData = '';
  104. $secondByte = sprintf('%08b', ord($bytes[1]));
  105. $masked = ($secondByte[0] == '1') ? true : false;
  106. $dataLength = ($masked === true) ? ord($bytes[1]) & 127 : ord($bytes[1]);
  107. if($masked === true)
  108. {
  109. if ($dataLength === 126) {
  110. $mask = substr($bytes, 4, 4);
  111. $coded_data = substr($bytes, 8);
  112. }
  113. elseif ($dataLength === 127) {
  114. $mask = substr($bytes, 10, 4);
  115. $coded_data = substr($bytes, 14);
  116. }
  117. else {
  118. $mask = substr($bytes, 2, 4);
  119. $coded_data = substr($bytes, 6);
  120. }
  121. for ($i = 0; $i < strlen($coded_data); $i++) {
  122. $decodedData .= $coded_data[$i] ^ $mask[$i % 4];
  123. }
  124. }
  125. else {
  126. if ($dataLength === 126) {
  127. $decodedData = substr($bytes, 4);
  128. }
  129. elseif ($dataLength === 127) {
  130. $decodedData = substr($bytes, 10);
  131. }
  132. else {
  133. $decodedData = substr($bytes, 2);
  134. }
  135. }
  136.  
  137. return $decodedData;
  138. }
  139.  
  140. // hibi10 encoding of data
  141. function hybi10Encode($payload, $type = 'text', $masked = true) {
  142. $frameHead = array();
  143. $frame = '';
  144. $payloadLength = strlen($payload);
  145.  
  146. switch ($type) {
  147. case 'text':
  148. // first byte indicates FIN, Text-Frame (10000001):
  149. $frameHead[0] = 129;
  150. break;
  151. case 'close':
  152. // first byte indicates FIN, Close Frame(10001000):
  153. $frameHead[0] = 136;
  154. break;
  155. case 'ping':
  156. // first byte indicates FIN, Ping frame (10001001):
  157. $frameHead[0] = 137;
  158. break;
  159. case 'pong':
  160. // first byte indicates FIN, Pong frame (10001010):
  161. $frameHead[0] = 138;
  162. break;
  163. }
  164.  
  165. // set mask and payload length (using 1, 3 or 9 bytes)
  166. if ($payloadLength > 65535) {
  167. $payloadLengthBin = str_split(sprintf('%064b', $payloadLength), 8);
  168. $frameHead[1] = ($masked === true) ? 255 : 127;
  169. for ($i = 0; $i < 8; $i++) {
  170. $frameHead[$i + 2] = bindec($payloadLengthBin[$i]);
  171. }
  172.  
  173. // most significant bit MUST be 0 (close connection if frame too big)
  174. if ($frameHead[2] > 127) {
  175. $this->close(1004);
  176. return false;
  177. }
  178. } elseif ($payloadLength > 125) {
  179. $payloadLengthBin = str_split(sprintf('%016b', $payloadLength), 8);
  180. $frameHead[1] = ($masked === true) ? 254 : 126;
  181. $frameHead[2] = bindec($payloadLengthBin[0]);
  182. $frameHead[3] = bindec($payloadLengthBin[1]);
  183. } else {
  184. $frameHead[1] = ($masked === true) ? $payloadLength + 128 : $payloadLength;
  185. }
  186.  
  187. // convert frame-head to string:
  188. foreach (array_keys($frameHead) as $i) {
  189. $frameHead[$i] = chr($frameHead[$i]);
  190. }
  191. if ($masked === true) {
  192. // generate a random mask:
  193. $mask = array();
  194. for ($i = 0; $i < 4; $i++) {
  195. $mask[$i] = chr(rand(0, 255));
  196. }
  197. $frameHead = array_merge($frameHead, $mask);
  198. }
  199. $frame = implode('', $frameHead);
  200. // append payload to frame:
  201. for ($i = 0; $i < $payloadLength; $i++) {
  202. $frame .= ($masked === true) ? $payload[$i] ^ $mask[$i % 4] : $payload[$i];
  203. }
  204.  
  205. return $frame;
  206. }
  207. ?>
Buy Me A Coffee