from pwn import * def run(): #r = process(["python", "./server.py"]) r = remote("babypad.be.ax", 1337) enc = bytes.fromhex(r.readline().decode().strip()) print(enc.hex()) def trial(s): if isinstance(s, str): s = s.encode() r.readuntil("> ") r.sendline(s.hex()) result = r.readline().decode().strip() return int(result) == 1 known_content = bytearray([0] * len(enc)) def run_test(position): npads = 16 - (position % 16) for x in range(256): if x == npads: continue test = bytearray(xor(enc, known_content)) test[position] ^= x ^ npads for z in range(position + 1, position + npads): test[z] ^= npads if trial(test[:position + npads]): return x raise Exception("none found for", position) # actual_pad = run_test(len(enc) - 1) # print("found pad", actual_pad) actual_pad = 4 known_content[-4:] = b"\x04\x04\x04\x04" i = len(enc) - 5 while i >= 0: result = run_test(i) print(known_content) known_content[i] = result i -= 1 return known_content if __name__ == "__main__": run()