#!/usr/bin/env python3
"""
Extract last byte from each packet, showing only printable ASCII
"""

import struct

def parse_pcap_with_data(filename):
    with open(filename, 'rb') as f:
        f.read(24)
        packets = []
        
        while True:
            packet_header = f.read(16)
            if len(packet_header) < 16:
                break
            
            ts_sec, ts_usec, incl_len, orig_len = struct.unpack('IIII', packet_header)
            packet_data = f.read(incl_len)
            if len(packet_data) < incl_len:
                break
            
            packets.append(packet_data)
        
        return packets

packets = parse_pcap_with_data('sniffed.pcap')

print("=" * 80)
print("PRINTABLE ASCII CHARACTERS FROM LAST BYTE OF EACH PACKET:")
print("=" * 80)

message_chars = []
for i, pkt in enumerate(packets):
    if len(pkt) > 0:
        last_byte = pkt[-1]
        if 32 <= last_byte <= 126:
            char = chr(last_byte)
            message_chars.append(char)
            print(f"Packet {i+1:3d}: '{char}' (0x{last_byte:02x})")

# Build complete message
message = ''.join(message_chars)
print(f"\n{'=' * 80}")
print("COMPLETE MESSAGE (printable chars only):")
print("=" * 80)
print(message)

# Try reversed
reversed_msg = message[::-1]
print(f"\nREVERSED:")
print(reversed_msg)

# Check for HTB flag
for msg_name, msg in [("Forward", message), ("Reversed", reversed_msg)]:
    if 'HTB{' in msg:
        start = msg.find('HTB{')
        end = msg.find('}', start) + 1
        flag = msg[start:end]
        print(f"\n🚩🚩🚩 FLAG FOUND ({msg_name}): {flag} 🚩🚩🚩")
        break
else:
    print("\nNo complete HTB flag found.")
    print(f"Looking for components...")
    if '{' in message:
        print(f"  Found '{{' at position {message.find('{')}")
    if '}' in message:
        print(f"  Found '}}' at position {message.find('}')}")
    if 'HTB' in message:
        print(f"  Found 'HTB' at position {message.find('HTB')}")