exploit.py

import pexpect
import argparse


def handle_user_input():
    parser = argparse.ArgumentParser()
    parser.add_argument(
        "-d", help="the target's destination (eg: ctf-player@atlas.picoctf.net)", metavar='destination', required=True)
    parser.add_argument("-p", help="the target's port",
                        metavar='port', required=True)
    parser.add_argument(
        "-pwd", help="the target's password", metavar='password', required=True)
    args = parser.parse_args()
    return [args.d, args.p, args.pwd]


def handle_guess(lower_bound, upper_bound, last_guess, hint):
    if hint == "Lower":
        upper_bound = last_guess - 1
    elif hint == "Higher":
        lower_bound = last_guess + 1
    return (lower_bound + upper_bound) // 2, lower_bound, upper_bound


def ssh_interaction(username, hostname, port, password):
    # Construct the SSH command
    ssh_cmd = f"ssh -o StrictHostKeyChecking=no -p {
        port} {username}@{hostname}"

    try:
        # Spawn a new SSH process
        ssh_session = pexpect.spawn(ssh_cmd)

        # Expect password prompt and send password
        ssh_session.expect("password:")
        ssh_session.sendline(password)

        # Start interaction after successful login
        ssh_session.expect("Enter your guess:")

        # Initialize bounds and first guess
        lower_bound = 1
        upper_bound = 1000
        guess = (lower_bound + upper_bound) // 2

        while True:
            # Send the guess
            ssh_session.sendline(str(guess))

            index = ssh_session.expect(
                ["Lower! Try again.", "Higher! Try again.", pexpect.EOF, pexpect.TIMEOUT])

            if index == 0:  # Lower
                guess, lower_bound, upper_bound = handle_guess(
                    lower_bound, upper_bound, guess, "Lower")
                ssh_session.expect("Enter your guess:")
            elif index == 1:  # Higher
                guess, lower_bound, upper_bound = handle_guess(
                    lower_bound, upper_bound, guess, "Higher")
                ssh_session.expect("Enter your guess:")
            else:  # EOF or TIMEOUT
                break

        # Print output for demonstration
        print(ssh_session.before.decode('utf-8'))

        # Wait for the session to close
        ssh_session.expect(pexpect.EOF)

        # Close the SSH session
        ssh_session.close()

    except pexpect.exceptions.EOF:
        print("SSH session terminated unexpectedly.")
    except pexpect.exceptions.TIMEOUT:
        print("Timeout occurred during interaction.")
    except Exception as e:
        print(f"Exception occurred: {e}")


# Example usage:
if __name__ == "__main__":
    try:
        user_input = handle_user_input()
        destination = user_input[0]
        port = user_input[1]
        password = user_input[2]

        if destination is None or port is None or password is None:
            raise ValueError(
                "All arguments (destination, port, password) are required.")

        username, hostname = destination.split("@")
        ssh_interaction(username, hostname, port, password)

    except ValueError as ve:
        print(f"Input error: {ve}")
    except Exception as e:
        print(f"Unexpected error: {e}")