ecb-solve.py

#!/usr/bin/env nix-shell
#! nix-shell --pure -I nixpkgs=https://github.com/NixOS/nixpkgs/archive/c23193b943c6c689d70ee98ce3128239ed9e32d1.tar.gz -i python3 -p python3 -p python3Packages.requests -p php
import requests
import subprocess
import random
import sys

want = subprocess.check_output(["php", "-r", "echo gzdeflate(serialize(['user'=>'admin']));"])

for i in range(32000, 33000):
    username=random.randbytes(i) + want
    trial = subprocess.check_output(["php", "-r", "echo gzdeflate(serialize(['user'=>hex2bin('"+username.hex()+"')]));"])

    if want in trial:
        idx = trial.index(want)
        if idx % 16 == 0:
            bs = bytes.fromhex(requests.post(f"{sys.argv[1]}/register.php", data={"user": username}).cookies["session"])
            forged_session = bs[idx:].hex()

            print(requests.post(f"{sys.argv[1]}/flag.php", cookies={"session": forged_session}).text)
            break