35 lines
987 B
Python
35 lines
987 B
Python
#!/usr/bin/env python3
|
|
import os
|
|
import random
|
|
from time import time
|
|
from pwn import *
|
|
|
|
HOST = "130.192.5.212"
|
|
PORT = "6562"
|
|
server = remote(HOST, PORT)
|
|
example_flag = "5377d37d23d8b447c3ad04300eaf24d033fceb109ebf764876103b150ff7693f16d220d1a56b2043f503c2fd5ebd"
|
|
lenFlag = len(bytes.fromhex(example_flag))
|
|
sleepT = 0.1
|
|
print(server.recv(1024))
|
|
sleep(sleepT)
|
|
server.send(b'y\n')
|
|
sleep(sleepT)
|
|
print(server.recv(1024))
|
|
sleep(sleepT)
|
|
payload = b'A'*lenFlag
|
|
server.send(payload)
|
|
server.send(b'\n')
|
|
|
|
seed = int(time.time())
|
|
payload_enc = server.recv(1024)
|
|
server.send(b'f\n')
|
|
flag_enc = server.recv(1024)
|
|
print(f"Payload:{payload_enc.split(b'\n')[0]} flagEnc:{flag_enc.split(b'\n')[0]}")
|
|
payload_enc = bytes.fromhex(payload_enc.split(b'\n')[0].decode())
|
|
flag_enc = bytes.fromhex(flag_enc.split(b'\n')[0].decode())
|
|
|
|
ks = [ p ^ pe for p,pe in zip(payload,payload_enc)]
|
|
flag = [ f ^ k for f,k in zip(flag_enc,ks)]
|
|
print(bytes(flag))
|
|
# The script sometimes fail if it goes to fast, just rerun it
|