We're given a prompt, which turns out to be some variant of a python repl:
```$ nc 178.128.12.234 10002This is function x()>>>dir<built-in function dir>```
There's a limit on our input though, at 19 chars + newline, so what can we do in 19 or less?
Let's see what we've got:```This is function x()>>>globals(){'server_thread': <Thread(Thread-1, started daemon 140225032603392)>, 'ThreadedTCPRequestHandler': <class __main__.ThreadedTCPRequestHandler at 0x7f88b0d32530>, 'ThreadedTCPServer': <class __main__.ThreadedTCPServer at 0x7f88b0d324c8>, 'socket': <module 'socket' from '/usr/lib/python2.7/socket.pyc'>, 'SocketServer': <module 'SocketServer' from '/usr/lib/python2.7/SocketServer.pyc'>, '__builtins__': <module '__builtin__' (built-in)>, '__file__': '/home/xoxopwn/xoxopwn.py', 'o': <function o at 0x7f88b0d21c80>, '__package__': None, 'port': 9999, 'threading': <module 'threading' from '/usr/lib/python2.7/threading.pyc'>, 'host': '0.0.0.0', 'x': <function x at 0x7f88b0d2e050>, '__name__': '__main__', '__doc__': None, 'serverthuong123': <__main__.ThreadedTCPServer instance at 0x7f88b0d19e18>}```
`o` and `x` stand out. Let's dump code and globals for `o`:
```This is function x()>>> o.__code__.co_consts(None, '392a3d3c2b3a22125d58595733031c0c070a043a071a37081d300b1d1f0b09', 'hex', 'pythonwillhelpyouopenthedoor', '', 'Open the door', 'Close the door')
This is function x()>>> o.__code__.co_code00000000: 6401 007d 0100 7c01 006a 0000 6402 0083  d..}..|..j..d...00000010: 0100 7d01 0064 0300 7d02 0064 0400 7d03  ..}..d..}..d..}.00000020: 0078 4c00 7401 0074 0200 7c00 0083 0100  .xL.t..t..|.....00000030: 8301 0044 5d38 007d 0400 7c03 0074 0300  ...D]8.}..|..t..00000040: 7404 007c 0000 7c04 0019 8301 0074 0400  t..|..|......t..00000050: 7c02 007c 0400 7402 007c 0000 8301 0016  |..|..t..|......00000060: 1983 0100 4183 0100 377d 0300 7134 0057  ....A...7}..q4.W00000070: 7c03 007c 0100 6b02 0072 8400 6405 0047  |..|..k..r..d..G00000080: 486e 0500 6406 0047 4864 0000 53         Hn..d..GHd..S```
Dump it into python and disassemble:
```import disdis.dis(open("raw", "rb").read())          0 LOAD_CONST               1 (1) '392a3d3c2b3a22125d58595733031c0c070a043a071a37081d300b1d1f0b09'          2 <0>          4 POP_TOP          6 LOAD_FAST                1 (1)          8 <0>         10 <0>         12 LOAD_CONST               2 (2) 'hex'         14 <0>         16 POP_TOP         18 STORE_FAST               1 (1)         20 <0>         22 ROT_THREE         24 STORE_FAST               2 (2)         26 <0>         28 DUP_TOP         30 STORE_FAST               3 (3)         32 <0>         34 INPLACE_RSHIFT         36 LOAD_GLOBAL              1 (1)         38 <0>         40 ROT_TWO         42 LOAD_FAST                0 (0)         44 <0>         46 POP_TOP         48 CALL_FUNCTION            1         50 <0>    >>   52 FOR_ITER                56 (to 110)         54 <0>         56 DUP_TOP         58 LOAD_FAST                3 (3) 'pythonwillhelpyouopenthedoor'         60 <0>         62 ROT_THREE         64 LOAD_GLOBAL              4 (4)         66 <0>         68 <0>         70 LOAD_FAST                4 (4)         72 <0>         74 CALL_FUNCTION            1         76 <0>         78 DUP_TOP         80 LOAD_FAST                2 (2)         82 <0>         84 DUP_TOP         86 LOAD_GLOBAL              2 (2)         88 <0>         90 <0>         92 CALL_FUNCTION            1         94 <0>         96 BINARY_SUBSCR         98 POP_TOP        100 BINARY_XOR        102 POP_TOP        104 INPLACE_ADD        106 ROT_THREE        108 JUMP_ABSOLUTE           52    >>  110 <0>        112 LOAD_FAST                3 (3) 'pythonwillhelpyouopenthedoor'        114 <0>        116 POP_TOP        118 COMPARE_OP               2 (==)        120 <0>        122 MAKE_FUNCTION            0        124 LOAD_CONST               5 (5)        126 <0>        128 YIELD_FROM        130 DUP_TOP_TWO        132 LOAD_CONST               6 (6)        134 <0>        136 YIELD_FROM        138 <0>        140 RETURN_VALUE```
We could continue to dump `x` (just tells us to look in `o`), and `globals()`, but a quick glance and educated guess yielded a quicker solutions (as opposed to earnestly going through the disassembly):
```python3from binascii import unhexlify
msg = unhexlify("392a3d3c2b3a22125d58595733031c0c070a043a071a37081d300b1d1f0b09")key = list(map(ord, "pythonwillhelpyouopenthedoor"))
print("".join([chr(msg[i]^key[i%len(key)]) for i in range(len(msg))]))```
Also known as: `ISITDTU{1412_secret_in_my_door}`