2017 Flare-On Challenge 12 missing (APT Attack Analysis)

import socket
import sys
import struct
import json
from pprint import pprint

def read_packet():
    with open ('packet.json') as f:
        packet = json.load(f)
        print len(packet)
    return packet

def packet(conn):
    packet = read_packet()

    for i,j in enumerate(packet):
        ip_src = j['_source']['layers']['ip']['ip.src']            # dict
        if ip_src == '52.0.104.200':                               # only server data
            try:
                data = j['_source']['layers']['data']['data.data'] # get data
                data = data.replace(":","")
                # pprint(data)
                conn.send(data.decode('hex'))
 
                else:
                 print "----- next packet -----"
                if packet[i+1]['_source']['layers']['ip']['ip.src'] == '192.168.221.91':        #check next packet for client
                    recv_data = conn.recv(1024)
                    print 'got data from client'
            except KeyError:                                       # key = 'data'
                pass
    return 0

#Socket
HOST = '0.0.0.0'                       # bind
PORT = 9443
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
print 'Socket created'

#Bind socket to local host and port
try:
    s.bind((HOST, PORT))
except socket.error as msg:
    print 'Bind failed. Error Code : ' + str(msg[0]) + ' Message ' + msg[1]
    sys.exit()
print 'Socket bind complete'

#Start listening on socket
s.listen(10)
print 'Server start at: %s:%s' %(HOST, PORT)
print 'Wait for connection...'

# connect and send data
while True:
    conn, addr = s.accept()
    print 'Connected by ', addr
    while 1:
        #send
        g_data = packet(conn)
#        conn.send("32303137aff18141240000005e0000005e00000051298f741667d7ed2941950106f505451c0000004200000042000000f37126ad88a5617eaf06000d424c5a21170417200e000000000000000000000000000000155bbf4a1efe1517734604b9d42b80e8770065006c0063006f006d00650070006100730073003100210031000000".decode("hex"))

#===========================================
# Usage: python pe.py [InputPE] [OutputPE]
#===========================================

import sys
import struct
import binascii
from pwn import *

# python pe.py pe pedump

def ReadFile():
    file = open(sys.argv[1], 'rb').read().replace("\n","").decode('hex')
    return ''.join(file)

ifile = open(sys.argv[1], 'rb')
ofile = open(sys.argv[2], 'wb')

# MZ header
assert ifile.read(2) == 'LM'
ofile.write('MZ')
print 'MZ header done'

# Write up to e_lfanew
ofile.write(ifile.read(0x3c-2))
e_lfanew = u32(ifile.read(4))
ofile.write(p32(e_lfanew))
ofile.write(ifile.read(e_lfanew - (0x3c + 4)))

# PE header
assert ifile.read(4) == 'NOP\0'
ofile.write('PE\0\0')
print 'PE header done'

# Machine
assert ifile.read(2) == '32'    #FileHeader.Machine
ofile.write('\x4c\x01')         ##IMAGE_FILE_MACHINE_I386
print 'PE.Machine done'

ofile.write(ifile.read(0x22))

# Make Entrypoint
entrypoint = u32(ifile.read(4)) ^ 0xabcdabcd
ofile.write(p32(entrypoint))

print 'Entrypoint done'
ofile.write(ifile.read())

ifile.close()
ofile.close()

print 'DLL Done'

Python>file = GetManyBytes(0x5ac488, 0x34d954)
Python>open("plugin0.dll", "wb").write(file)
Python>file = GetManyBytes(0x5ac488, 0x34d954)
Python>open("plugin1.dll", "wb").write(file)
Python>file = GetManyBytes(0x5c2238, 0x34d954)
Python>open("plugin2.dll", "wb").write(file)
Python>file = GetManyBytes(0x5c2238, 0x34d954)
Python>open("plugin3.dll", "wb").write(file)
Python>file = GetManyBytes(0x5d9d90, 0x34d954)
Python>open("plugin4.dll", "wb").write(file)
Python>file = GetManyBytes(0x5d9d90, 0x34d954)
Python>open("plugin5.dll", "wb").write(file)
Python>file = GetManyBytes(0x5d9d90, 0x34d954)
Python>open("plugin6.dll", "wb").write(file)
Python>file = GetManyBytes(0x5d9d90, 0x34d954)
Python>open("plugin7.dll", "wb").write(file)

import sys
import os
import struct
import json
import string
import base64
import xtea     #pip install xtea
import camellia #pip install python-camellia

from termcolor import colored
from pwn import *
from Crypto.Cipher import Blowfish
from Crypto.Cipher import DES3

plugin_data = ""
plugin_size = ""
bmp_header = ""
bmp_body = ""
file_name = ""
file_data = ""
recv_data = ""
send_data = ""
DUMP_FILE = True


######################################## read packet functions ######################################## 

def read_stage2_packet():
    with open ('packet.json') as f:
        packet = json.load(f)
    return packet

def read_stage3_packet(binary):
    file = open(binary).read()
    return ''.join(file)

############################################ dump functions ########################################### 

def hexdump(src, length=16):
    FILTER = ''.join([(len(repr(chr(x))) == 3) and chr(x) or '.' for x in range(256)])
    lines = []
    for c in xrange(0, len(src), length):
        chars = src[c:c+length]
        hex = ' '.join(["%02x" % ord(x) for x in chars])
        printable = ''.join(["%s" % ((ord(x) <= 127 and FILTER[ord(x)]) or '.') for x in chars])
        lines.append("%04x  %-*s  %s\n" % (c, length*3, hex, printable))
    return ''.join(lines)

def dump(name, data):
    if DUMP_FILE:
        if not os.path.exists("dump"):
            os.makedirs("dump")
        open("./dump/" + name, "wb").write(data)

def save_bmp(bmp_header, bmp_body):
    bmp = "BM"
    bmp += p32(len(bmp_header)+len(bmp_body)+14)
    bmp += p32(0)
#    bmp += p32(1078)
    bmp += p32(54)
    bmp += bmp_header
    bmp += bmp_body
    print colored("Save BMP", 'magenta')
    dump("screen_%d.bmp" % len(bmp), bmp)

########################################## decrypt functions ########################################## 

def RC4(data, key):
    S = range(256);j = 0
    for i in range(256):
        j = (j + S[i] + ord(key[i%len(key)])) % 256
        S[i], S[j] = S[j], S[i]
    j = 0
    i = 0
    res = ""
    for d in data:
        i = (i + 1) % 256
        j = (j + S[i]) % 256
        S[i], S[j] = S[j], S[i]
        res += chr(ord(d) ^ S[(S[i] + S[j]) % 256])
    return res

def simple_substitution_cipher(body):
    m = [0xC7,0x19,0x30,0x0C,0xA8,0x10,0xAD,0xD5,0xD4,0x16,0x52,0xFC,0x1B,0x82,0x7D,0x32,0x34,0x01,0xE6,0x4C,0x12,0x08,0x2B,0xF7,0xAC,0x8B,0x3F,0x67,0x48,0x72,0x21,0xDC,0xED,0xF6,0x85,0xB8,0x4F,0x5F,0x53,0x0A,0x04,0x28,0xDF,0xD8,0x7E,0x06,0x3D,0x03,0x40,0x36,0x68,0x73,0x25,0xB7,0x5D,0x1E,0xD2,0x0D,0xC6,0xC3,0x22,0xF2,0x20,0x0E,0x17,0xCC,0x60,0x5C,0x51,0xC2,0x1D,0x4A,0xCB,0x33,0x1C,0xF8,0x66,0x83,0x6B,0x3E,0x27,0xE3,0x9F,0xF5,0x3A,0xAA,0x8A,0x26,0x7F,0x5A,0x42,0xCF,0x7C,0x07,0x58,0x71,0xEB,0x05,0xBA,0x29,0x4B,0x7A,0xE0,0xEC,0x9A,0x7B,0x2E,0x37,0xFE,0xA4,0xBE,0x49,0xDE,0x00,0xC5,0xBB,0x96,0xE9,0xC4,0x79,0x99,0x87,0xF4,0x13,0x1A,0x15,0x63,0xF9,0xA0,0xD1,0x02,0xD6,0x09,0x1F,0xE5,0x92,0x6A,0xE7,0x18,0x43,0x91,0x6E,0x41,0xC8,0xA3,0xB2,0x2C,0xEE,0x8D,0xA6,0x5B,0xEF,0x24,0xB9,0x75,0x57,0x0F,0x6F,0x11,0x47,0x9B,0x3B,0x76,0xE1,0x9D,0x64,0x54,0xA7,0xC1,0x55,0xB3,0x89,0x31,0xFD,0xAB,0xB1,0x94,0xB6,0x14,0x2F,0xF3,0xBC,0x69,0xBF,0xA1,0x80,0x59,0x0B,0xBD,0xC9,0x2A,0xD7,0x81,0x3C,0x23,0xD3,0xF1,0xFA,0xEA,0x39,0x38,0x9E,0x5E,0xB5,0x45,0x61,0xFF,0x4E,0x77,0x4D,0x65,0x9C,0xE8,0xD9,0x93,0xAF,0x50,0xA2,0x84,0x88,0x78,0x98,0xE2,0x86,0xCE,0xDD,0x8C,0x8E,0xA9,0x95,0x70,0xAE,0xE4,0xCA,0x62,0xCD,0x90,0xC0,0xFB,0xB0,0xDB,0xB4,0xD0,0x97,0xF0,0x2D,0x46,0xDA,0x6C,0x6D,0x44,0x74,0xA5,0x8F,0x56,0x35]
    return "".join(chr(m[ord(i)]) for i in body)

def do_base64(body):
    standard_base64 = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'
    custom_base64 = 'B7wAOjbXLsD+S24/tcgHYqFRdVKTp0ixlGIMCf8zvE5eoN1uyU93Wm6rZPQaJhkn'
    table = string.maketrans(custom_base64, standard_base64)
    return base64.b64decode(body.translate(table))

def xtea_decrypt(key, iv, buf):
    x = xtea.new(key, mode = xtea.MODE_CBC, IV = iv)
    return x.decrypt(buf)

def blowfish_decrypt(key, ciphertext, iv):
    bs = Blowfish.block_size
    if len(ciphertext) % 8 != 0:
        ciphertext += '\x00' * (8- (len(ciphertext) % 8))

    cipher = Blowfish.new(key, Blowfish.MODE_CBC, iv)
    plaintext = cipher.decrypt(ciphertext)
    return plaintext

def des_decrypt(key, ciphertext, iv):
    bs = 8
    if len(ciphertext) % bs != 0:
        ciphertext += '\x00' * (bs - (len(ciphertext) % bs))
    cipher = DES3.new(key, DES3.MODE_CBC, iv)
    plaintext = cipher.decrypt(ciphertext)
    return plaintext

def camellia_decrypt(key, ciphertext):
    bs = 16
    plaintext = ""
 #   print("c_dll -> key=%s , len(enc)=%d" % (key.encode('hex'), len(ciphertext)))
    cipher = camellia.CamelliaCipher(key=key, mode=camellia.MODE_ECB)
    for i in range(0, len(ciphertext), bs):
        block = ciphertext[i:i+bs]
        plaintext+= cipher.decrypt(block)
 #   print("c_dll -> len(dec)=%d" % (len(plaintext)))
    return plaintext

########################################### decode functions ########################################## 

def decrypt(data):

    header = data[:36]
    year = header[:4]                                  
    #print "year = " + year.encode('hex')
    checksum = u32(header[4:8])
    #print "checksum = " + hex(checksum)
    header_size = u32(header[8:12])                    
    #print "header size = " + hex(header_size)
    body_size = u32(header[12:16])                     
    #print "body size = " + hex(body_size)
    plain_size = u32(header[16:20])                    
    #print "plain size = " + hex(plain_size)
    cryptor_id = header[20:].encode('hex')             

    body = data[header_size:header_size+body_size]

    if cryptor_id == "51298f741667d7ed2941950106f50545":   # default
        print "crypto -> default"
        return body

    elif cryptor_id == "c30b1a2dcb489ca8a724376469cf6782": # rc4
        print "crypto -> rc4"
        key = data[36:52]
        return RC4(body, key)

    elif cryptor_id == "38be0f624ce274fc61f75c90cb3f5915": # Substitution
        print "crypto -> Substitution"
        return simple_substitution_cipher(body)

    elif cryptor_id == "ba0504fcc08f9121d16fd3fed1710e60": # base64
        print "crypto -> base64"
        return do_base64(body)

    elif cryptor_id == "b2e5490d2654059bbbab7f2a67fe5ff4": # XTEA in CBC mode
        print "crypto -> XTEA"
        key = data[36:52]
        iv = data[52:60]
        return xtea_decrypt(key, iv, body)

    elif cryptor_id == "2965e4a19b6e9d9473f5f54dfef93533": # Blowfish
        print "decrypt -> Blowfish"
        key = data[36:52]
        iv = data[52:60]
        return blowfish_decrypt(key, body, iv)

    elif cryptor_id == "8746e7b7b0c1b9cf3f11ecae78a3a4bc": # XOR
        print "decrypt -> xor"
        key = data[36:40]
        return xor(body, key)

    elif cryptor_id == "46c5525904f473ace7bb8cb58b29968a": # 3DES
        print "decrypt -> 3des"
        key = data[36:60]
        iv = data[60:68]
        return des_decrypt(key, body, iv)

    elif cryptor_id == "9b1f6ec7d9b42bf7758a094a2186986b": # Camellia
        print "decrypt -> camellia"
        key = data[36:52]
        return camellia_decrypt(key, body)

    else: 
        print colored("crypto -> unknow :" + cryptor_id , "red")

def decompress(data, mode): 
    header = data[:28]

    header_size = u32(header[0:4])
    body_size   = u32(header[4:8])
    plain_size  = u32(header[8:12])
    compressor_id = header[12:28].encode('hex')

    body = data[header_size:header_size+body_size]

    if compressor_id == "f37126ad88a5617eaf06000d424c5a21": #default
        print "compressor -> default"
        return body
    elif compressor_id == "5fd8ea0e9d0a92cbe425109690ce7da2": #zlib
        print "compressor -> zlib"
        import zlib
        return zlib.decompress(body)
    elif compressor_id == "503b6412c75a7c7558d1c92683225449": # aplib
        import aplib
        return aplib.depack_safe(body)
    elif compressor_id == "0a7874d2478a7713705e13dd9b31a6b1": # lzo
        plain_size = u32(header[8:12])
        import lzo
        return lzo.decompress(body, False, plain_size) 
    else: 
        print colored("compressor -> unknow : " + compressor_id, "red")

def plugin_cmd(data, mode):
    header = data[:36]
  
    version = header[:4].encode('hex') 
    cmd = u32(header[4:8])
    seq = u32(header[8:12])
    status1 = u32(header[12:16])
    status2 = u32(header[16:20])
    processor_id = header[20:36].encode('hex')

    download_data = data[36:]

    if processor_id == "155bbf4a1efe1517734604b9d42b80e8": # default
        print "processor -> default"
        download_plugin_header = download_data[:32]
        download_plugin = download_data[32:]
        processor_default(cmd, download_plugin_header, download_plugin, mode)
    elif processor_id == "f47c51070fa8698064b65b3b6e7d30c6":  #CMD file
        print "processor -> file"
        processor_file(cmd, download_data, mode) 
    elif processor_id == "f46d09704b40275fb33790a362762e56":  #CMD shell
        print "processor -> shell"
        processor_shell(cmd, download_data, mode)
    elif processor_id == "a3aecca1cb4faa7a9a594d138a1bfbd5":   #CMD screen
        print "processor -> screen"
        processor_screen(cmd, download_data, mode)
    elif processor_id == "77d6ce92347337aeb14510807ee9d7be":   #CMD socket 
        print "processor -> socket"
        processor_socket(cmd, download_data, mode)
    else: 
        print colored("processor -> unknow: " + processor_id, "red") 

########################################## processor functions ######################################## 

def processor_default(cmd, download_plugin_header, download_plugin, mode):
    global plugin_data
    global plugin_size 

    if cmd == 2:
        print "cmd = 2 -> Processor::IsAuthed"

    elif cmd == 3:
        if mode == "CLIENT":
            computer_info = download_plugin_header+download_plugin
            version = computer_info[16:80].rstrip("\x00")
            computer_name = computer_info[80:208].decode('utf16').rstrip("\x00")
            user = computer_info[208:336].decode('utf16').rstrip("\x00")
            group = computer_info[336:848].decode('utf16').rstrip("\x00")
            others = computer_info[848:876]

            print "===================== ComputerInfo ===================="
            print colored("version =  " + version, 'magenta')
            print colored("computer name = " + computer_name, 'magenta')
            print colored("user name = " + user, 'magenta')
            print colored("group name = " + group, 'magenta')
            print hexdump(others)                                       #todo

        elif mode == "SERVER":
            "cmd = 3 -> Processor::GetComputerInfo"        

    elif cmd == 4:
        print "cmd = 4 -> Processor::ListPlugins"

    elif cmd == 5:
        print "cmd = 5 -> Processor::StartDownloadPlugin"
        if mode == "SERVER":
            plugin_data = ""

    elif cmd == 6:
        print "cmd = 6 -> Processor::DowloadPlugin" 
        if mode == "CLIENT":
            print "Downloading"
        if mode == "SERVER":
            plugin_id = download_plugin_header[:16].encode('hex')
            plugin_type = download_plugin_header[16:20]
            written = u32(download_plugin_header[20:24])
            plugin_size = u32(download_plugin_header[24:28])
            block = u32(download_plugin_header[28:32])    
            print "ID: %s | Type: %s | %d bytes (%d/%d)" % (plugin_id, plugin_type, block, written, plugin_size)
            
            plugin_data += download_plugin

    elif cmd == 7:
        print "cmd = 7 -> Processor::InstallPlugin"
        if mode == "SERVER":
            download_plugin_id = download_plugin_header[:16].encode('hex')  
            download_plugin_type = download_plugin_header[16:20]
            print colored("download plugin id = " + download_plugin_id, 'magenta')
            dump("./plugin_%s_%s.dll" % (download_plugin_id, download_plugin_type), plugin_data)

    elif cmd == 8:
        print "cmd = 8 -> Processor::Exit"

    elif (cmd == 9 or cmd == 10):
        return "cmd = 9 or a -> Processor::Unused"

    elif cmd == 11:
        print "cmd = b -> Processor::MessageBox"
        message = download_plugin_header + download_plugin

        print "====================== MassageBox ====================="
        print colored("MessageBox Title: %s " % massage[:512].decode('utf16'), 'magenta')
        print colored("MassageBox Content: %s" % message[512:].decode('utf16'), 'magenta')       

    elif cmd == 13:
        print "cmd = d -> Processor::ClearDownloadTask"

    elif cmd == 14:
        print "cmd = e -> Processor::Online"
        if mode == "SERVER":
            print "password = " + download_plugin_header.decode('utf16').rstrip("\x00")

    else:
        print colored("error cmd id: " + cmd, "red")


def processor_file(cmd, download_data, mode):
    global file_data
    global file_name

    if cmd == 1:
        print "file -> get drive info"
        if mode == "CLIENT":
            print "==============================================="
            drive_size = 552                      #0x228
            num = len(download_data) / drive_size
            for i in range(num):
                print "drive " + str(i)
                drive = download_data[0x228*i:0x228*(i+1)]
                drive_name = drive[:4].decode('utf16').rstrip("\x00")
                drive_type = drive[0x128:].decode('utf16').rstrip("\x00") 
                print colored("drive name = " + drive_name, "green") 
                print colored(drive_type, "green")
                drive = ""
            
    elif cmd == 2: 
        print "cmd = 2"
        print colored("file -> List Directory %s" % download_data[:260].decode('utf16').rstrip("\x00"), 'green')

    elif cmd == 3: 
        print "cmd = 3"
        if mode == "CLIENT":
            print "file -> Download"
        elif mode == "SERVER":
            file_name = download_data[16:].decode('utf16').rstrip("\x00") 
            print "file -> Download | %s" % file_name
            file_data = ""

    elif cmd == 4 :
        if mode == "CLIENT":
            file_id = download_data[:16].encode('hex')
            sent = u64(download_data[16:24])
            size = u64(download_data[24:32])
            block = u64(download_data[32:40])
            if sent == size:
                sha1 = download_data[:20].encode('hex')
                print ("file -> Download | ID: %s | Finished | SHA1: %s" % (file_id, sha1))
                print colored("dump lab10.zip.cry", 'red')
                dump("%s" % sha1, file_data)
            else:
                print ("file -> Download | ID: %s | File Response %d bytes (%d/%d) " % (file_id, block, sent, size))
                file_data += download_data[40:40+block]

    elif cmd == 5: 
        print "file -> Close file"

    elif cmd == 6: 
        print "cmd = 6"
        if mode == "CLIENT":
            print "file -> Upload" 
        elif mode == "SERVER":
            filename = download_data[52:].decode('utf16').rstrip("\x00")
            fid = download_data[:16].encode('hex')
            print "upload " + filename     
            size = u32(download_data[24:28])
            sha1 = download_data[32:52].encode('hex')
            print ("file -> Upload: %s | %s | Size: %d | SHA1: %s" % (filename, fid, size, sha1) )

#            file_data = ""
            file_name = filename.split("\\")[-1]

    elif cmd == 7: 
        print "cmd = 7"
        if mode == "SERVER":
            sha1 = download_data[:16].encode('hex')
            written = u32(download_data[16:20])
            size = u32(download_data[24:28])
            block = u32(download_data[32:36])

            if block == 0:
                print "file -> Upload: %s | Finished (%d/%d)" % (sha1, written, size)
                print colored(("Dump file %s..." % file_name), 'green')
                dump(file_name, file_data)
            else:
                print ("print -> Upload: %s | %d bytes (%d/%d)" % (sha1, block, written, size))
                file_data += download_data[40:40+block]

    elif (cmd == 8 or cmd == 9 or cmd == 10): 
        print "cmd = 8, 9, a file-> ping"
        
    else:
        print colored("file cmd error, cmd = %s" % cmd, 'red')
 
def processor_shell(cmd, download_data, mode):
    if cmd == 1:
        print "shell cmd -> Start"

    elif cmd == 2:
        print "shell cmd -> Close"

    elif cmd == 3:
        shell_cmd = download_data
        print "shell cmd" 
        print colored(shell_cmd.replace("\r\n", "\\r\\n").split("\x00")[0], 'green') 

    elif cmd == 4:
        shell_data = download_data
        print "==================== shell response ===================="
        print colored(shell_data.split('\x00')[0], "green")  

    else:
        print colored("shell cmd error", "red")

def processor_screen(cmd, download_data, mode):
    global bmp_header
    global bmp_body
    screen_data = download_data        

    if cmd == 1:
        print "screen -> take Screenshot"
        color_depths = u32(screen_data[:4])    #color depths (1, 4, 8, 16, 24, 32, or 64 bits per pixel)
        print "screen -> color depths: %d bits per pixel" % (color_depths)

    elif (cmd == 2 and mode == "CLIENT"):
        print "screen cmd = 2"
        size = u32(screen_data[:4])
        bmp_header = screen_data[4:]
        width = u32(bmp_header[4:8])
        height = u32(bmp_header[8:12])
        color_depths = u16(bmp_header[14:16])
        print "screen -> Response Header | size: %d | (%d x %d) %d bit" % (size, width, height, color_depths)
    
    elif cmd == 3:
        
        print "screen -> collect bitmap data"
        sent = u32(screen_data[0:4])
        size = u32(screen_data[4:8])
        block = u32(screen_data[8:12])
        print "screen -> Response | %d (%d/%d)" % (block, sent, size)
        bmp_body = bmp_body.ljust(sent, "\0")
        bmp_body += screen_data[12:block+12]

        if sent + block == size:
            save_bmp(bmp_header, bmp_body)

    else:
        print colored("screen cmd error", "red")


def processor_socket(cmd, download_data, mode):
    global send_data
    global recv_data

    if cmd == 1:
        print "socket -> start socket"
        if mode == "SERVER":
            port = u32(download_data[0:4])
            host = download_data[4:].rstrip("\x00")
            print colored("host: %s, port: %d" % (host, port), 'magenta')
            print send_data
            print 
    elif cmd == 2:
        print "socket -> colse socket"
        if send_data:
            print colored("dump send data to server.bin", 'magenta')
            dump("server2.bin", send_data)

    elif cmd == 3:
        if mode == "SERVER":
            print ("socket -> connect | Send: %d bytes" % len(download_data))
            send_data += download_data
        elif mode == "CLIENT":
            print ("socket -> connect | Recv: %d bytes" % len(download_data))
            recv_data += download_data
            if len(download_data) == 0 and recv_data:
                print colored("Dump recv data to client.bin...", 'magenta')
                dump("client2.bin", recv_data)
               
    elif cmd == 4:
        print "scoket -> recv"

    else: 
        print colored("cmd error", 'red')


########################################### packet functions ########################################## 


def get_mode_by_ip(ip):
    print "---------------------------------------------------------------------"
    if ip == "192.168.221.91":
        print colored("[Client] ", "yellow") + ip
        mode = "CLIENT"
        return mode
                                                      
    elif ip == '52.0.104.200':
        print colored("[Server] ", "cyan") + ip
        mode = "SERVER"
        return mode

    else:
        print colored("get ip error", "red")

def decode_stage2_packet():
    collect_data = ''
    compile_data = ''

    packet = read_stage2_packet()

    for i in packet:
        ip_src = i['_source']['layers']['ip']['ip.src']         #dict  
        try:
            data = i['_source']['layers']['data']['data.data'] 
            data = data.replace(":","").decode('hex')

            if data[:4] == '2017':
                mode = get_mode_by_ip(ip_src)
                collect = data
                header_len = u32(collect[8:0xc])
                body_len = u32(collect[0xc:0x10])

            else:
                if len(collect) != (header_len+body_len) and '2017' in data:
                    collect += data[:data.index('2017')]
                    data = data[data.index('2017'):]
                else:
                    collect += data

            compile_data = collect
            if len(compile_data) == (header_len+body_len):
                
                decrypt_data = decrypt(compile_data)
                compile_data = ''
                decompress_data = decompress(decrypt_data, mode)
                plugin_cmd(decompress_data, mode)      
        except KeyError:
            pass
    return 0

def decode_stage3_client():
     print "================================================================================"
     print "============================= decode stage3 client ============================="
     print "================================================================================"

     clientpacket = read_stage3_packet('client2.bin')
     mode = "CLIENT"
     while clientpacket != '':
        clientpacket = clientpacket[clientpacket.index('2017'):]
        if clientpacket[:4] == '2017':
            header_len = u32(clientpacket[8:0xc])
            body_len = u32(clientpacket[0xc:0x10])    
            
            print "---------------------------------------------------------------------" 
            print colored("[" + mode + "]", 'yellow')
            decrypt_data = decrypt(clientpacket)
            decompress_data = decompress(decrypt_data, mode)
            plugin_cmd(decompress_data, mode)

            clientpacket = clientpacket[header_len + body_len:]

def decode_stage3_server():
     print "================================================================================"
     print "============================= decode stage3 server ============================="
     print "================================================================================"

     serverpacket = read_stage3_packet('server2.bin')
     mode = "SERVER"
     while serverpacket != '':
        serverpacket = serverpacket[serverpacket.index('2017'):]
        if serverpacket[:4] == '2017':
            header_len = u32(serverpacket[8:0xc])
            body_len = u32(serverpacket[0xc:0x10])

            print "---------------------------------------------------------------------" 
            print colored("[" + mode + "]", 'cyan') 
            
            decrypt_data = decrypt(serverpacket)
            decompress_data = decompress(decrypt_data, mode)
            plugin_cmd(decompress_data, mode)

            serverpacket = serverpacket[header_len + body_len: ]

####################################################################################################### 

decode_stage2_packet()
decode_stage3_client()
decode_stage3_server()