1. We started with netcat connecting to the host via WSL.2. Then we started to identify the code.3. We noticed that the message "Something has leaked" was popping up at generation request.
It turned out that before the request in the encryption script, there was a line of code that checked whether all characters of the encoded message differed from the key characters.
`if all(a != b for a, b in zip(cipher, key)):`
4. We analyzed the code and started writing an exploit.
If any character was the same at a particular position in both the key and the encoded message, we got the info "Something has leaked". In the opposite situation, we obtained hexadecimal notation of characters that certainly did not fit in the given key position. By repeating the operation in loop many times (10,000), we were able to exclude all characters at a specific position in the key. We tested everything locally, after analyzing how everything works, we wrote an exploit using Python and the `pwntools` library.
The entire exploit:
```pythonfrom pwn import *
connection = remote('52.149.135.130',4869)# request first headerheader = connection.recv(timeout=5).decode()hex_flag = header[57:]print("FLAG:",hex_flag)
# initialize index and sets for forbidden charsindex = 0delim = "\n"whole_set = set(list(range(0,255)))forbidden_characters = {}for i in range(32):    forbidden_characters[i] = set([])
while True:    # increase index    index += 1
    # request options    connection.recv()
    # sendline to encrypt    connection.sendline(b'1')    encrypted_message = connection.recvline().decode()    print(index)    encrypted_message = encrypted_message.replace('\n', '')    if "Something" in encrypted_message:        continue    for i in range(32):        forbidden_characters[i].add(bytes.fromhex(encrypted_message)[i])    if index > 10000:        print("Possible characters: ")        byte_list = [list(whole_set.difference(forbidden_characters[i]))[0] for i in range(32)]        print(byte_list)        raw_bytes = bytes([int(hex(x),0) for x in byte_list])        print(raw_bytes.hex())        print("DECRYPTING...")        connection.sendline(b'2')        connection.sendline(raw_bytes.hex().encode())        connection.sendline(hex_flag.encode())        connection.interactive()```
It's not the best solution, but it works.Next time, remember to analyze the XOR. pepesad
![flag](https://i.imgur.com/QWwr5jA.png)