Challenge Description#

Guess 30 secret numbers (range 1-1000) with only 10 attempts each.

Analysis#

With 10 attempts to find a number in range 1-1000, we need binary search. Since 2^10 = 1024 > 1000, binary search guarantees finding any number within 10 guesses.

$ nc 43.128.69.211 10002
Rockwell ada angka 1 - 1000, ayo tebak angka yang rockwell pikirkan ya!
Kamu punya 10 kali kesempatan untuk menebak angka rockwell
Tebakanmu: 500
tebakanmu kekecilan!
Sisa tebakan: 9
Tebakanmu:

Server responses (Indonesian):

• "tebakanmu kekecilan!" = your guess is too small
• "tebakanmu kegedean!" = your guess is too big
• "tebakanmu bener!" = your guess is correct

Solution#

#!/usr/bin/env python3
from pwn import *
import time

def main():
    p = remote('43.128.69.211', 10002)
    
    # Get banner
    time.sleep(0.5)
    p.recv(timeout=2)
    print("[+] Connected!")
    
    for round_num in range(30):
        low, high = 1, 1000
        
        for attempt in range(10):
            mid = (low + high) // 2
            p.sendline(str(mid).encode())
            time.sleep(0.05)
            
            response = p.recv(512, timeout=2).decode().lower()
            
            if 'kekecilan' in response:  # too small
                low = mid + 1
            elif 'kegedean' in response:  # too big
                high = mid - 1
            elif 'bener' in response:  # correct!
                print(f"[{round_num+1}/30] Found: {mid}")
                break
    
    # Get flag
    print(p.recvall(timeout=3).decode())

if __name__ == '__main__':
    main()

Algorithm Complexity#

• Binary search: O(log n) = O(log 1000) ≈ 10 guesses maximum
• Total: 30 rounds × ~10 guesses = ~300 operations