from pwn import context, args, process, remote, success, xor context.update(arch='amd64', os='linux', log_level='info') URL = 'iaet6burymdllg3rflxg4ym7vk-1024-intro-crypto-1.challenge.cscg.live' PORT = 443 def start(): if args.REMOTE: return remote(URL, PORT, ssl=True) else: return process(['python3', './main.py']) io = start() payload_len = 512 io.sendlineafter(b"Enter some plaintext (hex): ", (b"00" * payload_len)) keystreams = [] for i in range(256): line = io.recvline() ks = bytes.fromhex(line.strip().split(b" ")[-1].decode()) keystreams.append(ks) io.recvuntil(b"Flag: ") flag_enc = bytes.fromhex(io.recvline().strip().decode()) io.close() for ks in keystreams: candidate = xor(flag_enc, ks[:len(flag_enc)]) if b"CSCG{" in candidate or b"flag{" in candidate: success(f"Found Flag: {candidate.decode()}") break