wp-pwncollege-data-dealings~nested-encoding

Posted on In Views: Disqus: Word count in article: 154 Reading time ≈ 1 mins.
用用pwntools

Dealing with Data

data-dealings~nested-encoding

have a look source code

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
hacker@data-dealings~nested-encoding:~$ cat /challenge/runme

#!/usr/bin/exec-suid -- /bin/python3 -I

import sys

try:
    entered_password = open(sys.argv[1], "rb").read()
except FileNotFoundError:
    print("Input file not found...")
    sys.exit(1)
correct_password = b"qbtsxoxg"

print(f"Read {len(entered_password)} bytes.")

# four times decode in latin-1
entered_password = bytes.fromhex(entered_password.decode("l1"))
entered_password = bytes.fromhex(entered_password.decode("l1"))
entered_password = bytes.fromhex(entered_password.decode("l1"))
entered_password = bytes.fromhex(entered_password.decode("l1"))

if entered_password == correct_password:
    print("Congrats! Here is your flag:")
    print(open("/flag").read().strip())
else:
    print("Incorrect!")
    sys.exit(1)

solution code 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
import pwn

# encode
correct_password =pwn.enhex(b'qbtsxoxg')
for i in range(3):
    correct_password =correct_password.encode("l1")
    correct_password =pwn.enhex(correct_password)

# write to file
with open('/home/hacker/pwn_script/sec', 'w') as f:
    f.write(correct_password)

# read from file, filename is the  --arg1
# p = process(['./target', '--arg1']
p = pwn.process(["/challenge/runme", '/home/hacker/pwn_script/sec'])

# get flag
print(p.readall().decode())