用nc链接靶机：
root@kali:~/Desktop# nc 220.249.52.133 37944
Can you match these regexes?
B+v*(clementine|sloth)*Q*eO(clinton|alien)*(cat|elephant)(cat|trump)[a-zA-Z]*(dolphin|clementine)\W*(table|apple)*
大致上是服务端给出一个正则表达式，要求输入符合该表达式的字符串。这里可以使用Python中的rstr库，该库主要用于根据条件生成随机字符串（参见rstr · PyPI），其中的xeger函数可以从正则表达式生成随机字符串。例如：
import rstr
print(rstr.xeger(r'B+v*(clementine|sloth)*Q*eO(clinton|alien)*(cat|elephant)(cat|trump)[a-zA-Z]*(dolphin|clementine)\W*(table|apple)*'))
输出：
BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvclementineclementineclementineclementineclementineclementineclementineslothslothclementineslothclementineclementineslothslothslothclementineslothslothclementineslothslothclementineclementineslothclementineslothclementineclementineslothclementineslothQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQeOalienclintonalienalienclintonclintonalienalienalienalienalienclintonalienclintonclintonclintonclintonalienalienalienalienalienalienclintonclintonalienclintonalienelephanttrumpGwSPaPqNKdPpccXBlHYxrhwyMjRdzSzSKELLUekKJVYGpdKxQapzainTuYuWclementine|;appletableappletableappletabletabletabletableappletabletabletableappletableappleappletabletabletabletabletableappletableappleappletableappleappletableappleappletableappleappletableappleappletabletableappleappletableappleappleappleappletableappleappleappleappleappletableappletableappletabletableappleappletableappleappletableappleappletableappleappletableappletabletableappleapple
注意xeger适用于大多数简单的正则表达式，但并不完整支持Python中所有正则表达式功能
利用Python的pwntool库来自动完成获取正则表达式和提交答案的过程：
from pwn import *
import rstr
from time import sleepr = remote('220.249.52.133', 37944)
print(bytes.decode(r.recvline()))i = 1
while True:question = bytes.decode(r.recvline()[:-1])if 'Irregular' in question:breakif 'flag' in question:print('flag is:', question)breakprint('No.', i, ':\n', question, '\n')answer = rstr.xeger(question)while '\n' in answer[:-1]:answer = rstr.xeger(question)print(answer, '\n')r.sendline(answer)i += 1sleep(0.2)同时有一个需要特别注意的地方。如果提交的答案中包含有换行符\n，服务端会认为这标识了一段答案提交结束，导致所提交的答案只有\n前的半段，无法通过正则表达式判断。因此，若生成的答案字符串中包含\n，需要通过一个循环来判断并重复生成，直到答案中不包含\n为止再提交。
运行该脚本，回答正确1000次后服务端返回flag。
flag：flag{^regularly_express_yourself$}
