exploit.sh

#!/bin/bash

# Function to convert word to its hex representation
to_hex() {
    local input="$1"
    local hex=$(echo -n "$input" | xxd -p)
    echo "$hex"
}

# Function to convert hex string to little-endian format
to_little_endian() {
    echo "$1" | awk '{ for(i=length; i>0; i-=2) printf "%s", substr($0, i-1, 2); printf "\n"; }'
}

# Function to convert hex string to big-endian format
to_big_endian() {
    local little_endian="$1"
    local big_endian=""

    # Length of the little-endian string
    local len=${#little_endian}

    # Iterate over the little-endian hex string in pairs of two characters
    for (( i=0; i<len; i+=2 )); do
        big_endian="${little_endian:i:2}$big_endian"
    done

    echo "$big_endian"
}

# Check if a valid port number is provided as an argument
if ! [[ "$1" =~ ^([a-zA-Z0-9-]+\.)*picoctf\.net$ && "$2" =~ ^([0-9]+$) ]]; then
    echo "Error: Please provide a valid destination as an argument."
    echo "Usage: $0 <destination> <port>"
    exit 1
fi

destination="$1"
port="$2"

# Connect to the server and process the input
echo "Connecting to the server..."
(
    # Connect to the server
    exec 3<>/dev/tcp/$destination/$port

    # Read and discard the first three lines
    for (( i=1; i<=3; i++ )); do
        read -r discard <&3
        echo "$discard"
    done

    # Read Word prompt
    read -r word <&3

    # Extract the word from the prompt
    real_word=$(echo "$word" | cut -d ':' -f 2 | tr -d ' ')
    echo "Word: $real_word"

    # Convert word to its hex representation
    hex_word=$(to_hex "$real_word")
    echo "Hex Representation: $hex_word"

    # Convert to little-endian and big-endian representations
    little_endian=$(to_little_endian "$hex_word")
    big_endian=$(to_big_endian "$little_endian")

    # Send little-endian representation
    echo "Sending Little Endian: $little_endian"
    echo "$little_endian" >&3
    sleep 1

    # Read response for little-endian
    read -r response1 <&3
    echo "$response1"
    echo ""

    # Send big-endian representation
    echo "Sending Big Endian: $big_endian"
    echo "$big_endian" >&3
    sleep 1

    # Read final response (should contain the flag)
    while IFS= read -r line; do
        echo "$line"
    done <&3

    # Close the connection
    exec 3<&-
    exec 3>&-
)