35 lines
890 B
Python
35 lines
890 B
Python
from pwn import context, args, process, remote, success, xor
|
|
|
|
context.update(arch='amd64', os='linux', log_level='info')
|
|
|
|
URL = 'iaet6burymdllg3rflxg4ym7vk-1024-intro-crypto-1.challenge.cscg.live'
|
|
PORT = 443
|
|
|
|
def start():
|
|
if args.REMOTE:
|
|
return remote(URL, PORT, ssl=True)
|
|
else:
|
|
return process(['python3', './main.py'])
|
|
|
|
io = start()
|
|
|
|
payload_len = 512
|
|
io.sendlineafter(b"Enter some plaintext (hex): ", (b"00" * payload_len))
|
|
|
|
keystreams = []
|
|
for i in range(256):
|
|
line = io.recvline()
|
|
ks = bytes.fromhex(line.strip().split(b" ")[-1].decode())
|
|
keystreams.append(ks)
|
|
|
|
io.recvuntil(b"Flag: ")
|
|
flag_enc = bytes.fromhex(io.recvline().strip().decode())
|
|
|
|
io.close()
|
|
|
|
for ks in keystreams:
|
|
candidate = xor(flag_enc, ks[:len(flag_enc)])
|
|
if b"CSCG{" in candidate or b"flag{" in candidate:
|
|
success(f"Found Flag: {candidate.decode()}")
|
|
break
|