pwnable.kr —— coin1

question#

Mommy, I wanna play a game!
(if your network response time is too slow, try nc 0 9007 inside pwnable.kr server)

Running at : nc pwnable.kr 9007

game#

	-              Shall we play a game?              -
	---------------------------------------------------
	
	You have given some gold coins in your hand
	however, there is one counterfeit coin among them
	counterfeit coin looks exactly same as real coin
	however, its weight is different from real one
	real coin weighs 10, counterfeit coin weighes 9
	help me to find the counterfeit coin with a scale
	if you find 100 counterfeit coins, you will get reward :)
	FYI, you have 60 seconds.
	
	- How to play - 
	1. you get a number of coins (N) and number of chances (C)
	2. then you specify a set of index numbers of coins to be weighed
	3. you get the weight information
	4. 2~3 repeats C time, then you give the answer
	
	- Example -
	[Server] N=4 C=2 	# find counterfeit among 4 coins with 2 trial
	[Client] 0 1 		# weigh first and second coin
	[Server] 20			# scale result : 20
	[Client] 3			# weigh fourth coin
	[Server] 10			# scale result : 10
	[Client] 2 			# counterfeit coin is third!
	[Server] Correct!

	- Ready? starting in 3 sec... -
	
N=441 C=9

analyse#

就是写脚本交互计算一下

get flag#

脚本如下：

from pwn import *

def get_weight(begin,end):
        message = ""
        if(begin == end):
                ssh.sendline(str(begin))
        else:
                for i in range(begin,end + 1):
                        message = message + str(i)+" "
                ssh.sendline(message)
        weight = ssh.recvline()
        return int(weight)


def get_result(N,C):
        begin = 0
        end = N-1
        for i in range(0,C):
                weight = get_weight(begin,int(begin+(end-begin)/2))
                if(weight%10!=0):
                        end = int(begin+(end-begin)/2)
                else:
                        begin = int(begin+(end-begin)/2)+1
        ssh.sendline(str(end))
        result = ssh.recvline()
        print(result)


ssh = remote('0',9007)
print(ssh.recv())
for i in range(0,100):
        print("begin to process the %d th"%i)
        question = ssh.recvline()
        N = int(question.split(" ")[0].split("=")[1])
        C = int(question.split(" ")[1].split("=")[1])
        print N,C
        get_result(N,C)
print ssh.recvline()
print ssh.recvline()

连上去速度略慢，所以可以scp到pwnable.kr服务器再运行脚本scp -P 2222 coin.py fd@pwnable.kr:/tmp

flag：b1NaRy_S34rch1nG_1s_3asy_p3asy