HITB-XCTF GSEC 2018 base

solve.py

from pwn import *
r = remote('47.91.210.116', 9999)
enc = '2SiG5c9KCepoPA3iCyLHPRJ25uuo4AvD2/7yPHj2ReCofS9s47LU39JDRSU='.decode('base64')

def encode(s):
  r.sendline(s)
  r.recvuntil('=> "')
  ret = r.recvuntil('"', drop=True)
  return ret.decode('base64')

def lcp(a, b):
  #a = bin(int(a.encode('hex'), 16))
  #b = bin(int(b.encode('hex'), 16))
  for i in xrange(min(len(a), len(b))):
    if a[i] != b[i]:
      return i
  return min(len(a), len(b))

charset='0123456789abcdef'

buf = ''
while len(buf) != 32:
  ok = False
  mc = 0
  cand = []
  for c1 in charset:
    for c2 in charset:
      s = buf + c1 + c2 + 'a'*(30-len(buf))
      assert len(s) == 32
      score = lcp(enc, encode(s))
      if score > mc:
        cand = []
        mc = score

      if score == mc:
        cand.append((c1, c2))

  print cand
  #buf += cand[0][0]+cand[0][1]
  buf += cand[0][0]
  print buf