pwnable.kr 之 coin1

发表于 | 分类于

coin1

二分法，100次就行了，得在60秒内完成

题目也提示了，如果本地超时的话可以去服务器上跑。

ssh fd@pwnable.kr -p2222 (pw:guest)，到/tmp下，服务器上有pwntools，将下面脚本中的pwnable.kr改成127.0.0.1跑，飞快

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
from pwn import *
#context.log_level = 'debug'
p = remote("pwnable.kr","9007")

sd = lambda s    :p.send(s)
rc = lambda s    :p.recv(s)
sl = lambda s    :p.sendline(s)
ru = lambda s    :p.recvuntil(s)
sda = lambda a,s :p.sendafter(a,s)
sla = lambda a,s :p.sendlineafter(a,s)

def leak(name,addr):
    log.info(name + " --> %s",str(addr))

def get_weight(start,end,p):
    pay = ""
    if start == end:
        p.sendline(str(start))
    else:
        for i in range(start,end+1):
            pay += str(i) + " "
        p.sendline(pay)
    res = p.recvline()
    return int(res)

def choose_coin(n,c,p):
    start = 0
    end = n-1
    weight = 0
    for i in range(c):
        weight = get_weight(start,(start+end)/2,p)
        if weight % 10 != 0:
            end = (start+end)/2
        else:
            start = (start+end)/2
    p.sendline(str(end))
    leak("[+]server: ",p.recvline())

ru("- Ready? starting in 3 sec... -")
sleep(3)

for i in range(100):
    #log.info("times--> %s",str(i))
    ru("N=")
    n = int(ru(" ")[:-1],10)
    #leak("N=",n)
    ru("C=")
    c = int(ru("\n")[:-1],10)
    #leak("C=",c)
    choose_coin(n,c,p)


p.interactive()
0%