[Windows7]

brute.py

#!/usr/bin/env python3

import pwn
import string
from hashlib import sha256


def xor(a, b):
    return bytes([i ^ j for i, j in zip(a, b)])


def H(m):
    return sha256(m).digest()


def send_payload(conn, payload):
    # receive until '> '
    conn.recvuntil(b'> ')

    # send '1'
    conn.sendline(b'1')

    # receive until 'Enter your message: '
    conn.recvuntil(b'Enter your message: ')

    # send payload
    conn.sendline(payload)

    # get hash receiving the next line
    h = conn.recvline().decode().split(":")[1].strip()

    return h


host = '94.237.59.63'  #change accordingly
port = 35688   #change accordingly

# establish connection
conn = pwn.remote(host, port)


flag = ""
l = 1
while not flag.endswith("}"):
    sentinel = H(b'\0'*l).hex()
    with pwn.log.progress('Finding next character {} + _...'.format(flag)):
        for c in string.printable:
            guess = flag + c

            # send guess
            h_guess = send_payload(conn, guess.encode('utf-8'))

            if h_guess == sentinel:
                print(f"Found next character of flag: {c}")
                flag += c
                break
        else:
            # next character not found
            print("Couldn't found next character. Cracking failed.")
            exit(1)

    l += 1

print("Cracked flag! {}".format(flag))

# close connection
conn.close()