Visiting Vortex level 0 we immediately greeted with such text

Your goal is to connect to port 5842 on vortex.labs.overthewire.org and read in 4 unsigned integers in host byte order. Add these integers together and send back the results to get a username and password for vortex1. This information can be used to log in using SSH.

Let start with these code and connect to server

import socket, struct
import telnetlib 


s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("vortex.labs.overthewire.org", 5842))

According to Instruction, we would recieve 4 integer, but the website also gave us such hint

Note: vortex is on an 32bit x86 machine (meaning, a little endian architecture)

recieved = []
for i in range(4):
    recieved.append(s.recv(4))

Before summing it up, we have to consider network byte order (Big Endian) and host byte order (Little Endian)
Both endian difference in a sense where how the computer representing them in memory

consider a 4 byte 0A 0B 0C 0D

Addr 0x1 0x2 0x3 0x4
Little 0D 0C 0B 0A
Big 0A 0B 0C 0D

As you can see
Little Endian : Store Most Significant Bit (MSB) to Largest address
Big Endian : Store MSB to Smallest address

Now lets check your system byte order
in Python

>>> import sys 
>>> sys.byteorder
'little'

How number 1 are presented under different endianess

# < , litte-endian
# > , big-endian
# ! , network byte order (big-endian)
# I , Integer 
>>> from struct import *
>>> pack('<I', 1) # little
'\x01\x00\x00\x00'
>>> pack('>I', 1) # big
'\x00\x00\x00\x01'
>>> pack('!I', 1) # network 
'\x00\x00\x00\x01'

If you are careful, you would notice that big endian is how we would represent 1 in writting, 00 00 00 01 , remove the 0 <!-- talk about useless thing-->

Back to the puzzle, we should treat recieved packet as little endian

total = 0
for i in range(4):
    total += struct.unpack('<I', s.recv(4))[0]

next also send in little endian format

s.send(struct.pack('<I', total))

t = telnetlib.Telnet()
t.sock = s
t.interact()
#now only spew everything from wire (which should be password) 

[top]



comments powered byDisqus