Ywc

RCTF-2018 cpushop

Word count: 128 / Reading time: 1 min
2018/08/05 Share

题目

nc连接后,可以看到商品列表,里面有一件商品是flag,需要足够的价格以及相关的sign、timestamp才能购买成功。

RCTF-2018

EXP

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
from pwn import *
from urlparse import parse_qsl
from hashpumpy import hashpump

p = remote('10.10.55.153', 30197)

p.sendline('2')
p.sendline('8')
p.recvuntil('Your order:\n')
order = p.recvline().strip()

print order
o = parse_qsl(order)
for k, v in o:
if (k == 'sign'):
sign = v

print sign
data = order[:-70]
print data

for i in range(8, 32):
payload = hashpump(sign, data, '&product=Flag', i)
# print payload
new_sign = payload[0]
new_data = payload[1]
payload = new_data + '&sign=' + new_sign
p.sendline('3')
p.sendline(payload)
print p.recv()

原文作者: Ywc

原文链接: https://yinwc.github.io/2018/08/05/RCTF-2018/

发表日期: August 5th 2018, 4:53:25 pm

版权声明:

CATALOG
  1. 1. 题目
  2. 2. EXP