from pwn import *

io = remote('cpushop.2018.teamrois.cn', 43000)

io.recvuntil('Command:')
io.sendline('2')
io.recvuntil('Product ID:')
io.sendline('9')
io.recvline()
payment = io.recvline().strip()

def r16x(data):
    for i in range(256):
        data = data.replace('\\x%02x' % i, ('%02x' % i).decode('hex'))
    return data

for i in range(8, 33):
    print 'Working on %d' % i
    sign = payment.split('&sign=')[1]
    data = payment.split('&sign=')[0]
    add = '&product=Flag&price=1&timestamp=1'
    keylen = str(i)
    lo = process(['hashpump', '-s', sign, '-d', data, '-a', add, '-k', keylen])
    new_sign = lo.recvline().strip()
    new_pm = lo.recvline().strip()
    new_pm = r16x(new_pm)
    new_pm += '&sign=%s' % new_sign
    print new_pm
    lo.close()
    io.recvuntil('Command:')
    io.sendline('3')
    io.recvuntil('Your order:')
    io.sendline(new_pm)
    if 'Invalid Order' in io.recvline(): continue
    io.recvline()
    print io.recvline()
    break