-
Notifications
You must be signed in to change notification settings - Fork 26
/
solve.py
58 lines (49 loc) · 1.72 KB
/
solve.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
#!/usr/bin/env python2
from pwn import *
context.log_level = "DEBUG"
key_default = "0daaba74f35afe20988172f4680e68b8"
def authorize(key):
p = remote("ctf.pragyan.org", 13500)
p.recvuntil("To view the Flag u should be root user userid:350 groupid:123\n")
p.recvuntil("Enter the secret key : ")
p.sendline(key)
p.recvline()
try:
userid = p.recvline().strip().lstrip("userid:")
groupid = p.recvline().strip().lstrip("groupid:")
return userid, groupid
except:
return None
def leak(additional):
usermap = {}
groupmap = {}
for i in range(256):
log.info(i)
key = key_default[:-(len(additional) + 1) * 2] + chr(i).encode("hex")
key += "".join([chr(c).encode("hex") for c in additional])
output = authorize(key)
if output != None:
log.success(output)
userid, groupid = output
usermap[i] = userid
groupmap[i] = groupid
return usermap, groupmap
def main():
# Use leak function to get mapping of (ct, pt) pair
# Start leaking at the end of ciphertext, complete guessing
# Find mapping and generate desired plaintext
additional = [131, 113, 128, 104, 11, 104, 128]
key = key_default[:-len(additional) * 2]
key += "".join([chr(c).encode("hex") for c in additional])
p = remote("ctf.pragyan.org", 13500)
p.recvuntil("To view the Flag u should be root user userid:350 groupid:123\n")
p.recvuntil("Enter the secret key : ")
p.sendline(key)
p.recvline()
p.recvline()
p.recvline()
flag = p.recvline().strip()
assert flag == "p_ctf{th3_c@ne_$f_Ic3Cre@m_is_m3lted}"
log.success("flag = {:s}".format(flag))
if __name__ == "__main__":
main()