ucdavis-ecs189m

[RADIOACTIVE] python exploits for uc davis class ecs189m
git clone git://git.figbert.com/ucdavis-ecs189m.git
Log | Files | Refs

commit 1bd115875eb23aebe53bc85fcef12d5a35b46fcf
parent c7e4aa6fd45805915349168ddeddc87970f4190f
Author: therealFIGBERT <figbertwelner@gmail.com>
Date:   Sat, 21 Dec 2019 22:07:53 -0800

Change variable names to be more clear

Diffstat:
Mfirst_flag.py | 21++++++++++-----------
Msecond_flag.py | 19+++++++++----------
Mthird_flag.py | 45++++++++++++++++++++++-----------------------
3 files changed, 41 insertions(+), 44 deletions(-)

diff --git a/first_flag.py b/first_flag.py @@ -5,19 +5,19 @@ from pwn import * #Connecting to the server -conn = remote("daviscybersec.ddns.net", 1337) +connection = remote("daviscybersec.ddns.net", 1337) for i in range(0,50): #Recieving the equation - eq = conn.recvline_contains("Question") + equation = connection.recvline_contains("Question") #Splitting the equation into the two numbers to add - nums = [int(item.strip()) for item in ((eq.split(b":")[1]).strip()).split(b"+")] - num_one = nums[0] - num_two = nums[1] + numbers = [int(item.strip()) for item in ((equation.split(b":")[1]).strip()).split(b"+")] + num_one = numbers[0] + num_two = numbers[1] #Adding the two numbers - num_sum = sum(nums) + num_sum = sum(numbers) print("Equation %d: %d + %d = %d"%(i+1, num_one, num_two, num_sum)) - conn.recv() + connection.recv() #Sending the password - conn.sendline(bytes("%d"%num_sum, "utf-8")) -conn.recv() -conn.interactive() -\ No newline at end of file + connection.sendline(bytes("%d"%num_sum, "utf-8")) +connection.recv() +connection.interactive() diff --git a/second_flag.py b/second_flag.py @@ -6,19 +6,19 @@ from pwn import * import struct #Connecting to the server -conn = remote("daviscybersec.ddns.net", 1338) -conn.recvuntil("Ready") +connection = remote("daviscybersec.ddns.net", 1338) +connection.recvuntil("Ready") for i in range(0,50): - conn.recvuntil("Question") - conn.recvuntil(" : ") + connection.recvuntil("Question") + connection.recvuntil(" : ") #Arrive at the first number and unpack it - num_one = struct.unpack("I", conn.recv(4))[0] - conn.recvuntil(" + ") + num_one = struct.unpack("I", connection.recv(4))[0] + connection.recvuntil(" + ") #Arrive at the second number and unpack it - num_two = struct.unpack("I", conn.recv(4))[0] + num_two = struct.unpack("I", connection.recv(4))[0] num_sum = num_one + num_two print("Equation %d: %d + %d = %d"%(i+1, num_one, num_two, num_sum)) #Convert the added numbers and send them back num_sum = struct.pack("I", num_sum) - conn.send(num_sum) -conn.interactive() -\ No newline at end of file + connection.send(num_sum) +connection.interactive() diff --git a/third_flag.py b/third_flag.py @@ -1,39 +1,39 @@ from pwn import * -def str_to_dec(s: str) -> int: +def string_to_integer(s: str) -> int: """Returns the passed string's (b26, a-z) base10 value Keyword arguments: s -- the string to convert to an int """ #Converts the characters to ascii representations (a=0, z=25) - num_vals = [(ord(char)-97) for char in s][::-1] + num_values = [(ord(char)-97) for char in s][::-1] lst = [] #Converts the number representation in the list to its base10 value - for pos, val in enumerate(num_vals): + for pos, val in enumerate(num_values): lst.append(val*(26**pos)) #Return the sum of the character values in base10 return sum(lst) -def dec_to_str(num: int, max: int = 19) -> str: +def integer_to_string(num: int, max: int = 19) -> str: """Returns the passed base10 int's string representation Keyword arguments: num -- the int to convert to a string max -- the length of the string minus one """ - st = "" + alphabetized_input = "" for a in range(max,0,-1): #Divides the number to get an int (0-25/a-z) digit = int(num/(26**a)) if int(num/(26**a)) <= 25 else 25 #Converts the number to the corresponding letter - char = chr(digit+97) + corresponding_character = chr(digit+97) #Adds the new character to the total string - st += char + alphabetized_input += corresponding_character num -= digit*(26**a) - char = chr(int(num)+97) - st += char - return st + corresponding_character = chr(int(num)+97) + alphabetized_input += corresponding_character + return alphabetized_input def passgen(low: str, high: str, size: int = 19) -> str: """ @@ -44,26 +44,26 @@ def passgen(low: str, high: str, size: int = 19) -> str: high -- the highest string size -- the length of the strings """ - return dec_to_str((str_to_dec(low)+str_to_dec(high))//2, size) + return integer_to_string((string_to_integer(low)+string_to_integer(high))//2, size) cracked = False -first = True +first_attempt = True LO = "aaaaaaaaaaaaaaaaaaaa" HI = "zzzzzzzzzzzzzzzzzzzz" -conn = remote("twinpeaks.cs.ucdavis.edu", 30004) +connection = remote("twinpeaks.cs.ucdavis.edu", 30004) while not cracked: #First run case - if first: + if first_attempt: #Generates a password password = passgen(LO, HI) #Prints challenge - print(str(conn.recv(), "utf-8")) + print(str(connection.recv(), "utf-8")) #Sends and prints the password - conn.sendline(password) + connection.sendline(password) print("Password: %s"%password) - first = False + first_attempt = False else: - response = conn.recvline() + response = connection.recvline() previous_pass = password #Checks the response to perform binary search if b" -1 " in response: #Password too small @@ -75,9 +75,9 @@ while not cracked: else: #Password cracked cracked = True break - conn.sendline(password) + connection.sendline(password) print("Password: %s"%password) - conn.recvline() -print("Flag: %s\n"%str(conn.recvline(), "utf-8").strip()) + connection.recvline() +print("Flag: %s\n"%str(connection.recvline(), "utf-8").strip()) -conn.close() -\ No newline at end of file +connection.close()