sploit for arena-battle

challenges/pwn/arena-battle/work/checker_sim.py

@@ -0,0 +1,48 @@
+#!/usr/bin/env python3
+"""Simulates the game checker: registers 'CheckerX' and stores fake flags
+in a NOTE_CREATE title/content, like the real scoring bot would."""
+
+import re
+import socket
+import sys
+import time
+
+HOST = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
+PORT = int(sys.argv[2]) if len(sys.argv) > 2 else 31337
+
+FLAG_RE = re.compile(rb"[A-Z0-9]{31}=")
+
+
+def make_flag(seedtext):
+    alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
+    h = 0
+    for ch in seedtext:
+        h = (h * 131 + ord(ch)) & 0xFFFFFFFF
+    s = ""
+    for i in range(31):
+        h = (h * 1103515245 + 12345) & 0x7FFFFFFF
+        s += alphabet[h % len(alphabet)]
+    return s + "="
+
+
+def main():
+    flag = make_flag("arena-%d" % time.time())
+    s = socket.create_connection((HOST, PORT), timeout=5)
+
+    def cmd(line):
+        s.sendall(line.encode() + b"\n")
+        buf = b""
+        while b"\n" not in buf:
+            buf += s.recv(4096)
+        return buf.strip()
+
+    r = cmd("REGISTER CheckerX warrior")
+    print("REGISTER ->", r.decode(), flush=True)
+    r = cmd("NOTE_CREATE %s %s" % (flag, flag))
+    print("NOTE_CREATE ->", r.decode(), flush=True)
+    print("PLANTED_FAKE_FLAG " + flag, flush=True)
+    s.close()
+
+
+if __name__ == "__main__":
+    main()