Newer
Older
DrawOnHisBadge / index.php
root on 30 Jul 2019 6 KB more images
#!/usr/bin/php
<?php

$host = '52.43.252.153';  // websocket server
$port = 9001;
$local = "http://localhost";  // origin header
$data = '{"CMD":"CLEAR"}';  // not actaully sent

echo ".-,--.                ,---.     ,-_/,.       ,-,---.       .       
' |   \ ,-. ,-. . , , |   | ,-. ' |_|/ . ,-.  '|___/ ,-. ,-| ,-. ,-.
, |   / |   ,-| |/|/  |   | | |  /| |  | `-.  ,|   \ ,-| | | | | |-'
`-^--'  '   `-^ ' '   `---' ' '  `' `' ' `-' `-^---' `-^ `-' `-| `-'
                                                              ,|    
                                                              `'\n";
$head = "GET / HTTP/1.1"."\r\n".
        "Upgrade: WebSocket"."\r\n".
        "Connection: Upgrade"."\r\n".
        "Origin: $local"."\r\n".
        "Host: $host"."\r\n".
        "Sec-WebSocket-Version: 13"."\r\n".
        "Sec-WebSocket-Key: asdasdaas76da7sd6asd6as7d"."\r\n".
        "Content-Length: ".strlen($data)."\r\n"."\r\n";

if ($argc < 2 ){
    exit("Usage: php index.php <image>\n");
}else{
    $filename = $argv[1];
    echo "[+] img: $filename\n";
    if ($filename == null || !isset($filename)) {
        echo "[!] Please choose an image\n";
        exit(0);
    }else{
        $imgStats = list($width, $height, $type, $attr) = getimagesize($filename);
        echo "[?] checking dimensions\n";
        if($imgStats[0] <> 64 || $imgStats[1] <> 32)
            die("[-] image must be 64px Wide and 32px high");

        $im = imagecreatefrompng($filename);
        //connect 
        $sock = fsockopen($host, $port, $errno, $errstr, 2);
        fwrite($sock, $head ) or die('error:'.$errno.':'.$errstr);
        $headers = fread($sock, 2000);

        echo "[!] sending...\n";
        $count = 0; // 2048 pixels total
        //time to get the colors
        for($x = 0; $x <= $imgStats[0]-1; $x++){
            $arrX = array();
            $arrY = array();
            $arrC = array();
            //calculate percentage
            $count++;
            $percent = round(($count / 64) * 100, 2);
            echo "[+] complete: $percent%         \r"; // extra spaces are important sytalisticly

            for($y = 0; $y <= $imgStats[1]-1; $y++){
                $rgb = imagecolorat($im, $x, $y);
                $newcol = color565($im, $rgb);
                array_push($arrX, $x);
                array_push($arrY, $y);
                array_push($arrC, $newcol);
            }

            //create data then send
            $data = '{"CMD":"DRAW","DATA":[';
            for($i = 0; $i <= 32-1; $i++){
                $data .= '['.$arrX[$i].','.$arrY[$i].',"'.$arrC[$i].'"],';  // data to be sent
            }
            $data = rtrim($data,',');
            $data .= ']}';
            //echo $data."\n"; // DEBUG
            fwrite($sock, hybi10Encode($data)) or die('error:'.$errno.':'.$errstr);
            $wsdata = fread($sock, 2000);
        }

        //close connection
        fclose($sock);
        echo "\n[+] done\n";
    }
}

function color565($im, $color){
    $color_tran = imagecolorsforindex($im, $color);
      $red = $color_tran['red'];
      $green = $color_tran['green'];
      $blue = $color_tran['blue'];
      /*bit Shifting*/
      $b = ($blue >> 3) & 0x1f;
      $g = (($green >> 2) & 0x3f) << 5;
      $r = (($red >> 3) & 0x1f) << 11;
      return "0x". strtoupper(dechex($r | $g | $b));
}

/***
 * functions below are for websocket interaction
 */

// hibi10 decoding of data
function hybi10Decode($data)
{
    $bytes = $data;
    $dataLength = '';
    $mask = '';
    $coded_data = '';
    $decodedData = '';
    $secondByte = sprintf('%08b', ord($bytes[1]));
    $masked = ($secondByte[0] == '1') ? true : false;
    $dataLength = ($masked === true) ? ord($bytes[1]) & 127 : ord($bytes[1]);
    if($masked === true)
    {
        if ($dataLength === 126) {
           $mask = substr($bytes, 4, 4);
           $coded_data = substr($bytes, 8);
        }
        elseif ($dataLength === 127) {
            $mask = substr($bytes, 10, 4);
            $coded_data = substr($bytes, 14);
        }
        else {
            $mask = substr($bytes, 2, 4);       
            $coded_data = substr($bytes, 6);        
        }   
        for ($i = 0; $i < strlen($coded_data); $i++) {       
            $decodedData .= $coded_data[$i] ^ $mask[$i % 4];
        }
    }
    else {
        if ($dataLength === 126) {          
           $decodedData = substr($bytes, 4);
        }
        elseif ($dataLength === 127) {           
            $decodedData = substr($bytes, 10);
        } 
        else {               
            $decodedData = substr($bytes, 2);       
        }       
    }   

    return $decodedData;
}
// hibi10 encoding of data
function hybi10Encode($payload, $type = 'text', $masked = true) {
    $frameHead = array();
    $frame = '';
    $payloadLength = strlen($payload);

    switch ($type) {
        case 'text':
            // first byte indicates FIN, Text-Frame (10000001):
            $frameHead[0] = 129;
            break;
        case 'close':
            // first byte indicates FIN, Close Frame(10001000):
            $frameHead[0] = 136;
            break;
        case 'ping':
            // first byte indicates FIN, Ping frame (10001001):
            $frameHead[0] = 137;
            break;
        case 'pong':
            // first byte indicates FIN, Pong frame (10001010):
            $frameHead[0] = 138;
            break;
     }

    // set mask and payload length (using 1, 3 or 9 bytes)
    if ($payloadLength > 65535) {
        $payloadLengthBin = str_split(sprintf('%064b', $payloadLength), 8);
        $frameHead[1] = ($masked === true) ? 255 : 127;
        for ($i = 0; $i < 8; $i++) {
            $frameHead[$i + 2] = bindec($payloadLengthBin[$i]);
        }

        // most significant bit MUST be 0 (close connection if frame too big)
        if ($frameHead[2] > 127) {
            $this->close(1004);
            return false;
        }
    } elseif ($payloadLength > 125) {
        $payloadLengthBin = str_split(sprintf('%016b', $payloadLength), 8);
        $frameHead[1] = ($masked === true) ? 254 : 126;
        $frameHead[2] = bindec($payloadLengthBin[0]);
        $frameHead[3] = bindec($payloadLengthBin[1]);
    } else {
        $frameHead[1] = ($masked === true) ? $payloadLength + 128 : $payloadLength;
    }

    // convert frame-head to string:
    foreach (array_keys($frameHead) as $i) {
        $frameHead[$i] = chr($frameHead[$i]);
    }
    if ($masked === true) {
        // generate a random mask:
        $mask = array();
        for ($i = 0; $i < 4; $i++) {
            $mask[$i] = chr(rand(0, 255));
        }
        $frameHead = array_merge($frameHead, $mask);
    }
    $frame = implode('', $frameHead);
    // append payload to frame:
    for ($i = 0; $i < $payloadLength; $i++) {
        $frame .= ($masked === true) ? $payload[$i] ^ $mask[$i % 4] : $payload[$i];
    }

    return $frame;
}
?>