/ ctf

# Pwnable.kr - coin1

Writeup for coin1 of pwnable.kr

## 0x00 Puzzle

``````Mommy, I wanna play a game!
(if your network response time is too slow, try nc 0 9007 inside pwnable.kr server)

Running at : nc pwnable.kr 9007
``````

## 0x01 Explore

nc

``````shellshock@ubuntu:~\$ nc 0 9007

---------------------------------------------------
-              Shall we play a game?              -
---------------------------------------------------

You have given some gold coins in your hand
however, there is one counterfeit coin among them
counterfeit coin looks exactly same as real coin
however, its weight is different from real one
real coin weighs 10, counterfeit coin weighes 9
help me to find the counterfeit coin with a scale
if you find 100 counterfeit coins, you will get reward :)
FYI, you have 30 seconds.

- How to play -
1. you get a number of coins (N) and number of chances (C)
2. then you specify a set of index numbers of coins to be weighed
3. you get the weight information
4. 2~3 repeats C time, then you give the answer

- Example -
[Server] N=4 C=2 	# find counterfeit among 4 coins with 2 trial
[Client] 0 1 		# weigh first and second coin
[Server] 20			# scale result : 20
[Client] 3			# weigh fourth coin
[Server] 10			# scale result : 10
[Client] 2 			# counterfeit coin is third!
[Server] Correct!

- Ready? starting in 3 sec... -

N=148 C=8

``````

## 0x02 Solution

N < 2 ^ C, so bi-search would work:

``````import subprocess

a = ''
while len(a)==0 or a != 'N':
print "server said:"+a+'end'
print 'len->'+str(len(a))+'<-'
print 'hex->'+(hex(ord(a)))+'<-'
return a

def parseNC(string):
string = string.split(' ')
n = int(string.split('='))
c = int(string.split('='))
return n,c

def put(st):
s = ''
for i in st:
s += str(i)
s += ' '
s += '\n'
coin.stdin.write(s)
print 'put: '+s

def get(noreturn=False):
a=''
while a == '':
print 'get: '+a
if not noreturn:
return int(a)

def getstr():
a=''
while a == '':
print 'get: '+a

def q(st):
put(st)
return get()

def game(l,r,c):
if r==l+1:
return l,c;
if q(range(l,l+(r-l)/2))<((r-l)/2*10):
return game(l,l+(r-l)/2,c+1)
else:
return game(l+(r-l)/2,r,c+1)
coin = subprocess.Popen("nc 0 9007".split(' '), stdin=subprocess.PIPE, stdout=subprocess.PIPE)

for rd in range(100):
n,c = parseNC(a)
print 'coin said:' +a+'end'
print 'n = '+str(n)+' c = '+str(c)

res,tc=game(0,n,0)
for i in range(c-tc+1):
put([res])
get(True)
get(True)
get(True)
get(True)
get(True)
get(True)
``````
``````...
get: Correct! (99)

get: b1NaRy_S34rch1nG_1s_3asy_p3asy

``````

Done! 