solve (744B)
1#!/usr/bin/env python3 2 3from pwn import * 4from sys import argv 5import base64 6import hlextend 7 8args = argv[1:] 9if args == []: 10 args = ["python3", "main.py"] 11io = process(args) 12 13io.readuntil(b"choice: ") 14io.sendline(b"1") 15 16io.sendline(b"") 17io.sendline(b"") 18 19io.readuntil(b"token: ") 20token = base64.b64decode(io.readline().strip().decode()) 21 22sha = hlextend.new("sha1") 23data, mac = token.decode().split("|mac=") 24token = sha.extend("|admin=true", data, 32, mac, raw=True) 25token += "|mac=" + sha.hexdigest() 26token = token.encode("latin1") 27 28print(token) 29 30io.readuntil(b"choice: ") 31io.sendline(b"3") 32 33io.readuntil(b"token: ") 34io.sendline(base64.b64encode(token)) 35 36print(io.readline().decode().strip()) 37 38io.readuntil(b"choice: ") 39io.sendline(b"4"); 40