#!/usr/bin/env python3 import os import random from time import time from pwn import * HOST = "130.192.5.212" PORT = "6562" server = remote(HOST, PORT) example_flag = "5377d37d23d8b447c3ad04300eaf24d033fceb109ebf764876103b150ff7693f16d220d1a56b2043f503c2fd5ebd" lenFlag = len(bytes.fromhex(example_flag)) sleepT = 0.1 print(server.recv(1024)) sleep(sleepT) server.send(b'y\n') sleep(sleepT) print(server.recv(1024)) sleep(sleepT) payload = b'A'*lenFlag server.send(payload) server.send(b'\n') seed = int(time.time()) payload_enc = server.recv(1024) server.send(b'f\n') flag_enc = server.recv(1024) print(f"Payload:{payload_enc.split(b'\n')[0]} flagEnc:{flag_enc.split(b'\n')[0]}") payload_enc = bytes.fromhex(payload_enc.split(b'\n')[0].decode()) flag_enc = bytes.fromhex(flag_enc.split(b'\n')[0].decode()) ks = [ p ^ pe for p,pe in zip(payload,payload_enc)] flag = [ f ^ k for f,k in zip(flag_enc,ks)] print(bytes(flag)) # The script sometimes fail if it goes to fast, just rerun it