#!/usr/bin/env python3
import hashlib
import hmac
import base64
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad
import struct
import os

# NOTE: PyCryptodome's AES only supports Rijndael-128 (128-bit block size)
# CI 2.x uses Rijndael-256 (256-bit block size) which is NOT the same!
# This script won't produce a valid session for CI's mcrypt encryption.

# The only way to generate a valid session is:
# 1. Find a PHP environment with mcrypt extension
# 2. Or find that the server falls back to XOR encoding

# Let's check if the server might be using XOR encoding as fallback
# because mcrypt is showing deprecation warnings

# Actually, looking at CI's Encrypt.php:
# if ($this->_mcrypt_exists === FALSE) => uses XOR
# The deprecation warnings mean mcrypt EXISTS but is deprecated
# So it still uses mcrypt

# Without Rijndael-256 support, we can't forge the session cryptographically

print("Rijndael-256 (256-bit block) is not available in PyCryptodome")
print("CI 2.x uses MCRYPT_RIJNDAEL_256 which requires mcrypt PHP extension")
print("Cannot forge session without proper Rijndael-256 implementation")

# Let's try a different approach - maybe we can find the actual admin credentials
# by exploiting the weak password storage or finding them in logs