Solution for challenge simple, hitcon quals 2015

x_simple.py

import sys
import urllib
import requests


def xor(s1, s2):
    res = ''
    for x, y in zip(s1, s2):
        res += chr(ord(x) ^ ord(y))
    return res

username = "a"
password = ""
json = """{"username":"%s","password":"%s","db":"hitcon-ctf"}""" % (
    username, password)
cookie = '''c%5C%F8o%84%93G%0A%BEl%00%08%8Fk%9E%89*%F0%FF%F2%9BU%92i%29%18%12%7D%AEt%BF%E4%A1%CD%85%98%F3%A7%AAA%F7A%E6rWf%0B%EEWL%B0%B8%9C%25H_%A6%13%F5N%DA%0A%D2%80'''
print cookie
cookie = urllib.unquote(cookie)
# print cookie

last = """b":"hitcon-ctf"}"""
last_cookie = cookie[-16:]
new_last = '":0,"admin":true}'
new_end = xor(xor(last, last_cookie), new_last)
new_c = cookie[:-16] + new_end
print len(new_c), len(cookie)
new_curl = urllib.quote(new_c)
for x in range(0, 256):
    random = "%%%x" % x
    c = {"auth": (new_curl + random)}
    print c
    r = requests.get('http://52.69.244.164:51913/', cookies=c)

    z = r.text

    if "You're admin!" in z:
        print z
        raw_input(">")
#
#hitcon{WoW_CFB_m0dE_5o_eAsY}