# Aul
There was no binary given with this challenge.I tried to connect to the service and after playing for some seconds I foundout that with the `help` command a lot of "garbage" was sent out by the server.I used a simple python script to extract the binary data and put it in a file.
Looking quickly at it, it looks like the code of the server itself, but `file`is not able to say anything, although `hexdump` was more helpful.```00000000  4c 75 61 53 00 19 93 0d  0d 0a 1a 0d 0a 04 08 04  |LuaS............|00000010  08 08 78 56 00 00 00 00  00 00 00 00 00 00 00 28  |..xV...........(|00000020  77 40 01 00 00 00 00 00  00 00 00 00 00 02 02 1f  |w@..............|00000030  00 00 00 2c 00 00 00 08  00 00 80 2c 40 00 00 08  |...,.......,@...|00000040  00 80 80 2c 80 00 00 08  00 00 81 2c c0 00 00 08  |...,.......,....|00000050  00 80 81 2c 00 01 00 08  00 00 82 2c 40 01 00 08  |...,.......,@...|00000060  00 80 82 2c 80 01 00 08  00 00 83 2c c0 01 00 08  |...,.......,....|00000070  00 80 83 2c 00 02 00 08  00 00 84 08 80 c2 84 2c  |...,...........,|00000080  40 02 00 08 00 80 85 2c  80 02 00 08 00 00 86 2c  |@......,.......,|00000090  c0 02 00 08 00 80 86 06  80 43 00 41 c0 03 00 24  |.........C.A...$|000000a0  40 00 01 06 40 43 00 24  40 80 00 26 00 80 00 10  |@...@C.$@..&....|000000b0  00 00 00 04 0b 6d 61 6b  65 5f 62 6f 61 72 64 04  |.....make_board.|000000c0  0f 70 6f 70 75 6c 61 74  65 5f 62 6f 61 72 64 04  |.populate_board.|000000d0  0f 62 6f 61 72 64 5f 74  6f 73 74 72 69 6e 67 04  |.board_tostring.|```
I tried to compile a lua program myself to check if the first bytes weresimilar and they were, except for an initial byte `\x1b` and a different letterafter the `Lua` signature (that changes with every version of Lua).
I added the first byte and looked on the Internet for a Lua decompiler, finding`unluac` (https://sourceforge.net/projects/unluac/). It didn't work out of thebox though, complaining that the signature wasn't a valid Lua one.
Indeed, after carefully comparing the dump of a program I compiled myself andthe one downloaded from the server, I found out that each `\x0a` was prefixedby a `\x0d`. Done also this step, I was able to decompile Lua with `unluac` andget the source code.
In particular, this is the output of the `run_step` function:```luafunction run_step(A0_41)  local L1_42, L2_43  L1_42 = readline  L1_42 = L1_42()  L2_43 = string  L2_43 = L2_43.len  L2_43 = L2_43(L1_42)  if L2_43 == 0 then    L2_43 = exit    L2_43()    L2_43 = nil    return L2_43  end  L2_43 = string  L2_43 = L2_43.find  L2_43 = L2_43(L1_42, "function")  if L2_43 then    L2_43 = nil    return L2_43  end  L2_43 = string  L2_43 = L2_43.find  L2_43 = L2_43(L1_42, "print")  if L2_43 then    L2_43 = nil    return L2_43  end  L2_43 = load  L2_43 = L2_43("return " .. L1_42)  L2_43 = L2_43()  if L2_43 == nil then    return nil  end  return L2_43(A0_41)end```
The input command is used to find a function with that name, with `returnfunction_name`, that is immediately called. I thought that I could use it toexecute a "system" function and get a shell and it worked :) (except thefunction is called `os.execute` and not `system`).