57 lines
1.4 KiB
Python
57 lines
1.4 KiB
Python
#!/usr/bin/env python3
|
|
|
|
from Cryptodome.Cipher import AES
|
|
from Cryptodome.Util.Padding import pad, unpad
|
|
import json
|
|
import base64
|
|
from pwn import *
|
|
HOST = "130.192.5.212"
|
|
PORT = 6551
|
|
|
|
server = remote(HOST,PORT)
|
|
|
|
# 1 | 2 Block | 3 Block | 4 Block |
|
|
#RICORDA ALLA FINE C'e' SEMPRE " in PIU'
|
|
#name = 'aa true "a " '
|
|
# AGGIUNGI anche 'aa'
|
|
name = 'aa'+' '*(16-len('true')-1)+':true'+' '*(15)+'"'+'a'+' '*14+","+" "*15+' '*15+'"'+' '*15+' '*5+'a'
|
|
print(len(name))
|
|
#print(name)
|
|
|
|
print(server.recvline())
|
|
#print(server.recvline())
|
|
server.send(name)
|
|
server.send(b'\n')
|
|
tok = server.recvline()
|
|
tok = tok.split(b":")[1].strip()
|
|
print(tok)
|
|
server.recvline()
|
|
server.recvline()
|
|
server.recvline()
|
|
server.recvline()
|
|
server.send(b'flag\n')
|
|
print(server.recvline())
|
|
enc = base64.b64decode(tok)
|
|
tok = enc[0:16]+enc[112:128]+enc[16:32]+enc[64:80]+enc[48:64]+enc[96:112]+enc[128:144]
|
|
tok = base64.b64encode(tok).decode()
|
|
server.send(tok)
|
|
server.send(b'\n')
|
|
print(server.recvline())
|
|
print(server.recvline())
|
|
print(server.recvline())
|
|
print(server.recvline())
|
|
print(server.recvline())
|
|
print(server.recvline())
|
|
print(server.recvline())
|
|
print(server.recvline())
|
|
print(server.recvline())
|
|
#print(f"{payload} | len:{len(payload)}")
|
|
#token = json.dumps({
|
|
# "username": name,
|
|
|
|
#})
|
|
#enc = token.encode()
|
|
#for i in range(0,len(enc),16):
|
|
# print(enc[i:i+16])
|
|
#print(enc[0:16]+enc[112:128]+enc[16:32]+enc[64:80]+enc[48:64]+enc[96:112]+enc[128:144])
|