Skip to content

Instantly share code, notes, and snippets.

@goelp14
Created January 7, 2021 05:58
Show Gist options
  • Save goelp14/1fe50273b86ca305c7b4a51f0b39beba to your computer and use it in GitHub Desktop.
Save goelp14/1fe50273b86ca305c7b4a51f0b39beba to your computer and use it in GitHub Desktop.
from pwn import *
saveNotebook = []
r = remote('<TCP-URL-HERE-NO-TCP://-INCLUDED>', <PORT>)
r.recvuntil('rounds?\n\n')
f = open("output.txt", "w+")
output = r.recvuntil('..> ')
f.write(output.decode('utf-8'))
items = {'racecar': 0, 'mouse': 0, 'book': 0, 'kitten': 0, 'binoculars': 0, 'crayons': 0, 'console': 0, 'doll': 0, 'guitar': 0, 'puzzle': 0}
# count number of times each item is wished for
s = output.split(b'\nSend')
s = s[0].decode("utf-8")
s = s.strip('\n')
for item in items.keys():
if item in s:
items[item] += 1
print(items) # for reference
for i in range(999):
r.send(b'n\n')
output = r.recvuntil('..> ')
f.write(output.decode('utf-8'))
s = output.split(b'\nSend')
s = s[0].decode("utf-8")
s = s.strip('\n')
for item in items.keys():
if item in s:
items[item] += 1
print(i) # check how many wishes iterated through
f.close() # stop saving to txt file
# transition to next part
r.send(b'n\n')
print(r.recvuntil(b'\n\n'))
# Answer questions
for x in range(10):
q = r.recvuntil(b' > ')
print(q)
keyword = q.split(b' ')[2].decode("utf-8")
print("Keyword is %s\n" % keyword)
print('Number of times Asked: %s' % items[keyword])
print(str(items[keyword]).encode('ascii'))
r.send(str(items[keyword]).encode('ascii'))
r.send(b'\n')
# get flag
print(r.recvuntil(b'}'))
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment