[pwnable.kr]coin1

        ---------------------------------------------------
        -              Shall we play a game?              -
        ---------------------------------------------------

        You have given some gold coins in your hand
        however, there is one counterfeit coin among them
        counterfeit coin looks exactly same as real coin
        however, its weight is different from real one
        real coin weighs 10, counterfeit coin weighes 9
        help me to find the counterfeit coin with a scale
        if you find 100 counterfeit coins, you will get reward :)
        FYI, you have 60 seconds.

        - How to play - 
        1. you get a number of coins (N) and number of chances (C)
        2. then you specify a set of index numbers of coins to be weighed
        3. you get the weight information
        4. 2~3 repeats C time, then you give the answer

        - Example -
        [Server] N=4 C=2        # find counterfeit among 4 coins with 2 trial
        [Client] 0 1            # weigh first and second coin
        [Server] 20                     # scale result : 20
        [Client] 3                      # weigh fourth coin
        [Server] 10                     # scale result : 10
        [Client] 2                      # counterfeit coin is third!
        [Server] Correct!

        - Ready? starting in 3 sec... -

用二分法写个脚本

from pwn import *


r = remote('pwnable.kr',9007)

rec=r.recvuntil('- Ready? starting in 3 sec... -\n',drop=False)


r.recvline()

for i in range(100):

    t=r.recvline().decode('utf-8').split(' ')
    n=int(t[0].split('=')[1])
    c=int(t[1].split('=')[1])
    print('N=',n,'C=',c)

    start = 0
    end = n - 1
    print('start=',start,'end=',end)

    for j in range(c):

        mid = ( start + end )// 2
        print('mid=',mid)

        s=' '.join(str(k) for k in range(start,mid + 1))
        r.sendline(s)
        #print('send the index:',s)

        tmp_res=r.recvline()
        #print(tmp_res)

        if (int(tmp_res) % 10 == 0):
            start = mid + 1
        else:
            end = mid
    r.sendline(str(start))
    print(r.recvline())

print(r.recvline())
print(r.recvline())

如果远程连接的话因为网络延迟的问题会超时

需要连接到之前的其他题目给的ssh
然后mkdir /tmp/叫什么都行
在新建的文件夹里面写脚本
回过头来发现每次连接的时候的提示里面就有说到写权限目录的问题，

有个没太搞懂的点，在于pwntools和python版本的关系，
在我自己的虚拟机上面pwntools需要python3才能跑，
在靶机上面反而是python2才行

from pwn import *


r = remote('localhost',9007)

rec=r.recvuntil('- Ready? starting in 3 sec... -\n',drop=False)


r.recvline()

for i in range(100):

    t=r.recvline().decode('utf-8').split(' ')
    n=int(t[0].split('=')[1])
    c=int(t[1].split('=')[1])
    #print('N=',n,'C=',c)

    start = 0
    end = n - 1
    #print('start=',start,'end=',end)

    for j in range(c):
		#把这一层循环里的print全部注释掉似乎会快一点
		#虽然本来也不需要print
		
        mid = ( start + end )// 2
        #print('mid=',mid)

        s=' '.join(str(k) for k in range(start,mid + 1))
        r.sendline(s)
        #print('send the index:',s)

        tmp_res=r.recvline()
        #print(tmp_res)

        if (int(tmp_res) % 10 == 0):
            start = mid + 1
        else:
            end = mid
    r.sendline(str(start))
    print(r.recvline())

print(r.recvline())
print(r.recvline())