SwampCTF 2018 - Locked Dungeon Writeup

ecb_padding_exploit.py

from pwn import *
import string

s = remote('chal1.swampctf.com', 1450)

flag=''

for j in xrange(1,60):
	s.send('a'*(47-len(flag))+'\n')
	checker = s.recvline().strip()
	for i in string.printable:
		payload=flag+i+('a'*(47-len(flag)))+'\n'
		s.send(payload)
		res = s.recvline().strip()
		# print payload
		# print res
		if res == checker:
			print "Cracked: "+i
			flag+=i
			print "Flag == "+flag
			break

# $ python exploit_ecb_padding.py
# [+] Opening connection to chal1.swampctf.com on port 1450: Done
# Cracked: f
# Flag == f
# Cracked: l
# Flag == fl
# Cracked: a
# Flag == fla
# Cracked: g
# Flag == flag
# Cracked: {
# Flag == flag{
# Cracked: r
# Flag == flag{r
# Cracked: e
# Flag == flag{re
# Cracked: m
# Flag == flag{rem
# Cracked: 3
# Flag == flag{rem3
# Cracked: m
# Flag == flag{rem3m
# Cracked: b
# Flag == flag{rem3mb
# Cracked: e
# Flag == flag{rem3mbe
# Cracked: r
# Flag == flag{rem3mber
# Cracked: _
# Flag == flag{rem3mber_
# ...
# Flag == flag{rem3mber_the_pic_of_tux_aes_3ncrypted}