# Bring weakness (crypto300) - ALEX CTF
That was a funny challenge. We have to connect to a server and guess 10 numbers randomly generated consecutively in order to get the flag. The usage is very simple
```bash$ nc 195.154.53.62 7412Guessed 0/101: Guess the next number2: Give me the next number22882282195Guessed 0/101: Guess the next number2: Give me the next number23616041256Guessed 0/101: Guess the next number2: Give me the next number......```
A (very) little theory.. A good random number generator should have high entropy. Infact if the random generator returns a number that i saw few time ago, i can guess the next generated number easily (it generates the next number depending from the previous one!). My first idea was to always ask the next random numer, save it and see if I've encountered it in the past. It always happens sooner (if the generator is weak) or later (if the generator is well made). So even if the genator is well made it happens, but we should wait so long that we would all be dead :D
So that's my very simple POC exploit.. but hey.. we know that it is weak :D  Let's see!
```python#!/usr/bin/env python2
import sys, socket, telnetlibfrom struct import *import randomimport timeimport binasciiimport timedef recvuntil(t):    data = ''    while not data.endswith(t):        tmp = s.recv(1)        if not tmp: break        data += tmp
    return data
def interactive():    t = telnetlib.Telnet()    t.sock = s    t.interact()
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)s.connect((sys.argv[1], int(sys.argv[2])))f = open("file1.txt","wb")s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)s.connect((sys.argv[1], int(sys.argv[2])))i = 0mySet = set()while 1:	print "i : " + str(i)	i += 1	recvuntil("2: Give me the next number\n")	s.send("2\n")	number = recvuntil("\n")	mySet.add(int(number[:-1],10))	f.write(str(i) + " " + number[:-1] + "\n")	if(i != len(mySet)):		f.close()		print "GOT IT!!!"		print i		interactive()```
i know that it looks like shit, but it works! After 32768 iterations i got a repeated number: i looked at the file saved and interactively send the correct numbers and i got the flag 
```bash......i : 32761i : 32762i : 32763i : 32764i : 32765i : 32766i : 32767i : 32768GOT IT!!!32769Guessed 0/101: Guess the next number2: Give me the next number1Next number (in decimal) is1198007487Guessed 1/101: Guess the next number2: Give me the next number1Next number (in decimal) is1196723700Guessed 2/101: Guess the next number2: Give me the next number1Next number (in decimal) is3223035981Guessed 3/101: Guess the next number2: Give me the next number1Next number (in decimal) is3629331723Guessed 4/101: Guess the next number2: Give me the next number1Next number (in decimal) is216206427Guessed 5/101: Guess the next number2: Give me the next number1Next number (in decimal) is1252512825Guessed 6/101: Guess the next number2: Give me the next number1Next number (in decimal) is3100277946Guessed 7/101: Guess the next number2: Give me the next number1Next number (in decimal) is3166866393Guessed 8/101: Guess the next number2: Give me the next number1Next number (in decimal) is3024820857Guessed 9/101: Guess the next number2: Give me the next number1Next number (in decimal) is645079395flag is ALEXCTF{f0cfad89693ec6787a75fa4e53d8bdb5}```
The script is [here](exploit.py), and the file saved [here](file.txt). I know that saving all the numbers was unnecessary, but i wrote this very quickly and i didn't have time to reorganize the script: i apologize for that :D