the-st0rm

#!/usr/bin/python

# Quick and dirty demonstration of CVE-2014-0160 by Jared Stafford (jspenguin@jspenguin.org)
# The author disclaims copyright to this source code.
#
# Modified slightly by Andreas Thienemann <athienemann@schubergphilis.com> for clearer exploit code
# and 64k reads
#
# This version of the exploit does write received data to a file called "dump" in the local directory
# for analysis.

the-st0rm

#!/usr/bin/python
# -*- coding: utf-8 -*-

import socket
import sys
import string
import time

def recv_until(s, data):
	res = ""

the-st0rm

import requests
import random


def send_combination(combination):
	URL = "http://slumdogmillionaire.quals.nuitduhack.com/"
	data = {"numbers": "%s" %(combination)}
	r = requests.post(URL, data=data)
	winning_combination =  r.content[r.content.find("Winning combination was: ")+25:r.content.find("Winning combination was: ")+54]
	return winning_combination