[](ctf=hack.lu-2015)[](type=coding)[](tags=random)
# GuessTheNumber (coding-150)
```The teacher of your programming class gave you a tiny little task: just write a guess-my-number script that beats his script. He also gave you some hard facts:he uses some LCG with standard glibc LCG parametersthe LCG is seeded with server time using number format YmdHMS (python strftime syntax)numbers are from 0 up to (including) 99numbers should be sent as ascii stringYou can find the service on school.fluxfingers.net:1523```
```bash$ nc school.fluxfingers.net 1523Welcome to the awesome guess-my-number game!It's 22.10.2015 today and we have 13:01:49 on the server right now. Today's goal is easy: just guess my 100 numbers on the first try within at least 30 seconds from now on.Ain't difficult, right?Now, try the first one:99Wrong! You lost the game. The right answer would have been '61'. Quitting.```So here we have a random number generator and we have to guess 100 numbers on the server.Searching about LCG we land on [this](http://rosettacode.org/wiki/Linear_congruential_generator#C) page.The seed is given by the server in the message.It is the standard rand_r function in glibc with same parameters. Also all numbers are less than 100 so we need a mod 100 for each number.
```cint main(int argc, char **argv){	rseed = atoi(argv[1]);	int i;	for (i = 0; i <100; i++)		printf("%d ", rand()%100); 	return 0;}```By a little hit and trial we find that the server generates 100 numbers using the above algorithm and checks in reverse order.So [here](guess.py) is a quick dirty client to handle the same.
```pythonfrom pwn import *import subprocesss=remote('school.fluxfingers.net',1523)a=s.recv(1000,timeout=1)print aall=re.search('have .* on',a).group()[5:13].split(':')seed=20151021000000seed+=int(all[0])*10000seed+=int(all[1])*100seed+=int(all[2])res=subprocess.check_output(["./lol", str(seed)]).split()[::-1]print res,"len",len(res)for i in res:	print i,	s.send(str(i))	a=s.recv(100)		print a```
Flag
>flag{don't_use_LCGs_for_any_guessing_competition}