vortex10 -> vortex11

워게임/vortex 2014.05.22 16:33
크리에이티브 커먼즈 라이선스
Creative Commons License

http://overthewire.org/wargames/vortex/vortex10.html

숫자를 리스트형태로 주길래 파이썬으로 받아서 C로 넘겨서 시드를 구한 후 파이썬에서 시드를 입력했습니다

solver.c 

#include <stdio.h>
main(){
 int i;
 unsigned long currenttime;
 unsigned long seed = 0;
 unsigned long numbers[20] = {0,};
 currenttime = time(0);
 for(i=0; i<20; i++){
  fflush(0);
  scanf("%d", &numbers[i]);
 }
 
 while(1){
  srand(currenttime+seed);
  for(i=0; i<seed; i++){
   rand();
  }
  for(i=0; i<20; i++){
   if(rand() != numbers[i]){
    break;
   }
   if(i==19){
    printf("%d\n", currenttime+seed);
    exit(0);
   }
  }
  seed++;
 }
}

 

solver.py

#!/usr/bin/env python
import os
from subprocess import Popen, PIPE
from time import sleep
target = Popen("/vortex/vortex10", stdin=PIPE, stdout=PIPE, stderr=PIPE, shell=True)
arrstring = target.stdout.readline()
print "==========================="
print arrstring
print "==========================="
arrstring = arrstring.split("[")[1]
arrstring = arrstring.split("]")[0]
arrstring = arrstring.split(",")
numbers = []
for num in arrstring[:-1]:
 numbers.append(int(num, 16))
solver = Popen("/tmp/cd80_vortex10/solver", stdin=PIPE, stdout=PIPE, stderr=PIPE, shell=True)
print "Sleep"
sleep(3)
print "Go"
for i in range(0, 20):
 solver.stdin.write(str(numbers[i])+"\n")
 sleep(0.5)
while 1:
 answer = solver.stdout.readline()
 if len(answer) > 0:
  break
answer = eval(answer)
print "Answer: %x" % answer
from struct import pack
target.stdin.write(pack("<L",answer)+"\n")
target.stdin.write("cat /etc/vortex_pass/vortex11\n")
print "vortex11 pass : " + target.stdout.readline()

 

vortex10@melinda:/tmp/cd80_vortex10$ ./solver.py
===========================
[ 1800a8a3, 6cbe3892, 19e9ffb8, 152d6f5f, 068dc8e7, 2e0e621b, 136c5cd0, 27405a33, 288b2529, 04d5e971, 2f882704, 3b6ecfa6, 27669c6b, 624831c1, 43e4020a, 65aa718d, 268ba818, 2fc72ed5, 299bdde3, 128aba01,]
===========================
Sleep
Go
Answer: 537da917
vortex11 pass : %8sLEszy9
vortex10@melinda:/tmp/cd80_vortex10$ 

 

신고

'워게임 > vortex' 카테고리의 다른 글

vortex10 -> vortex11  (3) 2014.05.22
level0 -> level1  (0) 2013.09.29

설정

트랙백

댓글

level0 -> level1

워게임/vortex 2013.09.29 23:36
크리에이티브 커먼즈 라이선스
Creative Commons License

 

import struct
from socket import *
p = lambda x : struct.pack("<Q", x)
up = lambda x : struct.unpack("<L", x)
host = "vortex.labs.overthewire.org"
port = 5842
s = socket(AF_INET, SOCK_STREAM)
s.connect((host, port))
a,b,c,d = up(s.recv(4))+up(s.recv(4))+up(s.recv(4))+up(s.recv(4))
s.send(p(a+b+c+d))
print s.recv(512)
 

 

Username: vortex1 Password: Gq#qu3bF3 

 

신고

'워게임 > vortex' 카테고리의 다른 글

vortex10 -> vortex11  (3) 2014.05.22
level0 -> level1  (0) 2013.09.29

설정

트랙백

댓글


티스토리 툴바