1. We started with netcat connecting to the host via WSL.
2. Then we started to identify the code.
3. We noticed that the message "Something has leaked" was popping up at generation request.

It turned out that before the request in the encryption script, there was a line of code that checked whether all characters of the encoded message differed from the key characters.

`if all(a != b for a, b in zip(cipher, key)):`

4. We analyzed the code and started writing an exploit.

If any character was the same at a particular position in both the key and the encoded message, we got the info "Something has leaked". In the opposite situation, we obtained hexadecimal notation of characters that certainly did not fit in the given key position. By repeating the operation in loop many times (10,000), we were able to exclude all characters at a specific position in the key. We tested everything locally, after analyzing how everything works, we wrote an exploit using Python and the `pwntools` library.

The entire exploit:

```python
from pwn import *

connection = remote('52.149.135.130',4869)
# request first header
header = connection.recv(timeout=5).decode()
hex_flag = header[57:]
print("FLAG:",hex_flag)

# initialize index and sets for forbidden chars
index = 0
delim = "\n"
whole_set = set(list(range(0,255)))
forbidden_characters = {}
for i in range(32):
forbidden_characters[i] = set([])

while True:
# increase index
index += 1

# request options
connection.recv()

# sendline to encrypt
connection.sendline(b'1')
encrypted_message = connection.recvline().decode()
print(index)
encrypted_message = encrypted_message.replace('\n', '')
if "Something" in encrypted_message:
continue
for i in range(32):
forbidden_characters[i].add(bytes.fromhex(encrypted_message)[i])
if index > 10000:
print("Possible characters: ")
byte_list = [list(whole_set.difference(forbidden_characters[i]))[0] for i in range(32)]
print(byte_list)
raw_bytes = bytes([int(hex(x),0) for x in byte_list])
print(raw_bytes.hex())
print("DECRYPTING...")
connection.sendline(b'2')
connection.sendline(raw_bytes.hex().encode())
connection.sendline(hex_flag.encode())
connection.interactive()
```

It's not the best solution, but it works.
Next time, remember to analyze the XOR. pepesad