while True:
    try:
        print("Input your cookie:")
        data_hex = sys.stdin.readline().strip()
        data = binascii.unhexlify(data_hex)
        assert(len(data) > iv_len + hash_len)
        iv, cookie_padded_encrypted, hv = data[:iv_len], data[iv_len: -hash_len], data[-hash_len:]
        cipher = Cipher(algorithms.AES(key), modes.CBC(iv), backend=backend)
        decryptor = cipher.decryptor()
        cookie_padded = decryptor.update(cookie_padded_encrypted) + decryptor.finalize()
        try:
            cookie = unpad(cookie_padded)
        except Exception as e:
            print("Invalid padding")
            continue
        if not is_valid_hash(cookie, hv):
            print("Invalid hash")
            continue
        info = {}
        for _ in cookie.split(b";"):
            k, v = _.split(b":")
            info[k] = v
        if info[b"admin"] == b"1":
            with open("flag") as f:
                flag = f.read()
                print("Your flag: %s" %flag)

import remotecli # https://github.com/rmb122/remoteCLI
import hashpumpy
from binascii import hexlify, unhexlify
import copy
from tqdm import tqdm


def padding(byte):
    padlen = 16 - len(byte) % 16
    byte += bytearray([padlen] * padlen)
    return byte


def addIvLastByte(iv, currIndex, midval):
    target = 16 + 1 - currIndex
    for i in range(currIndex, 16):
        iv[i] = midval[i] ^ target
    return iv


def xor(a, b):
    result = []
    for i in range(len(a)):
        result.append(a[i] ^ b[i])
    result = bytearray(result)
    return result

cli = remotecli.CLI()
cli.connect('207.148.68.109', 20000)
cli.sendLine('abcde')
cli.sendLine('abcde')

hv_hex_len = 40
iv_len = 16
orgCookie = 'admin:0;username:abcde;password:abcde'

cookie = cli.recvLinesUntilHave('Input your cookie:')[-2]
print(cookie)
hv_hex = cookie[-hv_hex_len:]
iv = cookie[:iv_len]
cookieEnc = cookie[iv_len: - hv_hex_len]

fakeHash, fakeCookie = hashpumpy.hashpump(hv_hex, orgCookie, ';admin:1', iv_len)
print(fakeCookie)
print(fakeHash)

fakeHash = bytearray(unhexlify(fakeHash))
fakeCookie = padding(fakeCookie)

assert len(fakeCookie) == 64
dummy = bytearray([0 for i in range(len(fakeCookie) + 16)]) # iv + cookie

for pos in range(64 + 16, 16, -iv_len):
    curr = dummy[pos - iv_len:pos]
    iv = bytearray([0 for i in range(iv_len)])
    midval = bytearray([0 for i in range(iv_len)])
    for currIndex in range(0, iv_len)[::-1]:
        for i in tqdm(range(0, 256)):
            iv[currIndex] = i
            cli.sendLine(hexlify(iv + curr + fakeHash))
            res = cli.recvline()
            #print(res)
            cli.recvline()
            if "Invalid padding" not in res:
                midval[currIndex] = (16 - currIndex) ^ iv[currIndex]
                if currIndex == 0:
                    tmp = xor(midval, fakeCookie[pos-iv_len*2:pos-iv_len])
                    for tmpPos in range(0, 16):
                        dummy[pos-iv_len*2 + tmpPos] = tmp[tmpPos]
                iv = addIvLastByte(iv, currIndex, midval)
                break

cli.sendLine(hexlify(dummy + fakeHash))
cli.console()

K = b"\x01\x23\x45\x67\x89\xab\xcd\xef\xfe\xdc\xba\x98\x76\x54\x32\x10"
    Ke = init(K)

    backend = default_backend()
    key = os.urandom(16)
    iv = encrypt(key, Ke)
    cipher = Cipher(algorithms.AES(key), modes.CBC(iv), backend=backend)
    decryptor = cipher.decryptor()
    try:
        print("Input a hexstr to decrypt:")
        data = sys.stdin.readline().strip()
        ciphertext = binascii.unhexlify(data)
        plaintext = decryptor.update(ciphertext) + decryptor.finalize()
        print("Decrypted result:")
        print(binascii.hexlify(plaintext).decode())
    except Exception as e:
        pass

    with open("flag", 'rb') as f:
        flag = f.read()
        padder = padding.PKCS7(128).padder()
        flag_padded = padder.update(flag) + padder.finalize()
        encryptor = cipher.encryptor()
        flag_encrypted = encryptor.update(flag_padded) + encryptor.finalize()
        print("Your encrypted flag is:")
        print(binascii.hexlify(flag_encrypted).decode())

from Crypto.Cipher import AES as stdAES
from Crypto.Util.strxor import strxor

K = b"\x01\x23\x45\x67\x89\xab\xcd\xef\xfe\xdc\xba\x98\x76\x54\x32\x10"
hexstr = '11111111111111111111111111111111'.encode()
dec = unhexlify('3205fe135b595e72c90d2613ada3087812f10dee01e66c4d1e47089a0ff0f18c')
midVal = strxor(dec[16:32], hexstr[0:16])
iv = strxor(dec[0:16], midVal)
aes = AES()
key = aes.decryptBlock(iv, K)
print(key)
print(iv)
flag = unhexlify('c2c06ee0e21dae7e5b64fcb84397b4ed920c28bb81a676d817a4b920564bd04dd2a570900ff2e9d5fee9cb74c37c4812')
stdaes = stdAES.new(key, stdAES.MODE_CBC, iv)
print(stdaes.decrypt(flag))

'''
b'N\t\x9c\xce*\xfa\xc1\x02\x94\xd1\x02\xf2\xb8d*E'
b'\x11\xc5\xc2\xcck\x8e\x03\x0e\xe6{\x1f\xb8\x93b\xc8\xc5'
b'RCTF{88358abe-e571-4bdf-95a3-93e9d8ddf558}\x06\x06\x06\x06\x06\x06'
'''