Hackergame 2024 Writeup

import requests

cookie_dict = {
    "session":"cited"
}
s = requests.Session()
s.get("http://202.38.93.141:13030/",cookies=cookie_dict)
q4 = 250
while True: #submit form
    ret = s.post("http://202.38.93.141:13030/", {
        "q1": "2017-03",
        "q2": "Kdenlive",
        "q3": "12",
        "q4": q4,
        "q5": "sdf.org",
        "q6": ""
    },cookies=cookie_dict)
    if "本次测验总得分为 0。没有达到 60 分，不能给你 flag（摊手）" in ret.text:
        print(q4, "❌")
    else:
        print(q4, "✅", ret.text)
        break
    q4+=1

import requests

cookie_dict = {
    "session":"cited"
}
s = requests.Session()
s.get("http://202.38.93.141:13030/",cookies=cookie_dict)
q6 = 1800
while True: #submit form
    ret = s.post("http://202.38.93.141:13030/", {
        "q1": "2017-03",
        "q2": "Kdenlive",
        "q3": "12",
        "q4": "dcd46d897adb70d63e025f175a00a89797d31a43",
        "q5": "sdf.org",
        "q6": q6
    },cookies=cookie_dict)
    if "本次测验总得分为 0。没有达到 60 分，不能给你 flag（摊手）" in ret.text:
        print(q6, "❌")
    else:
        print(q6, "✅", ret.text)
        break
    q6+=1

import requests
from selenium import webdriver
from selenium.webdriver.common.by import By
import time

def compare(a,b):
    if a>b:
        return '>'
    else:
        return '<'

url = 'http://202.38.93.141:12122/'

cookie = {'name': 'session', 'value':'cited'}

driver = webdriver.Chrome()

driver.get(url)

input('✨Make sure the site open: ')
driver.add_cookie(cookie)
driver.refresh()

js = 'return state.values;'
data = driver.execute_script(js)

print(data)
input('✨Make sure the site open: ')
result_arr = []
cnt = 0
for value in data:
    res = compare(value[0],value[1])
    result_arr.append(res)
    cnt +=1
    if cnt <= 99:
        driver.execute_script("state.inputs.push('" + res + "');")

print(result_arr)
driver.execute_script('state.score1 = 99;')

#这边按理来说应该更新一下score1与score2，使之与最后一个比大小的数字相等，但是我就喜欢有概率能过（p = 1/4）的，就不改了（

if result_arr[99] == '>':
    button = driver.find_element(By.ID, 'greater-than')
    button.click()
elif result_arr[99] == '<':
    button = driver.find_element(By.ID, 'less-than')
    button.click()
input('✨Make sure the site open: ')

b'theflag\x00'.decode('utf-16-le') 

# Payload：桴晥慬g

allowed_chars = "0123456789()|*"
max_len = 1000000
num_tests = 300

if difficulty == 1:
    test_string = str(t)  # decimal
    if (t % 16 == 0) == expected_result:  # mod 16
        break

b = ''
for j in range(1,625):
    a = j*16
    a = str(a)
    print(a)
    if len(a)<2:
        b+="|000"+str(a)
    elif len(a)<3:
        b+="|00"+str(a)
    elif len(a)<4:
        b+="|0"+str(a)
    else:
        b+="|"+str(a)
print("(0|1|2|3|4|5|6|7|8|9)*(0000" + b +')')

# res = (0|1|2|3|4|5|6|7|8|9)*(0000|0016|0032|0048|0064|0080|0096|...
# res.length = 3148

print('(0|1|2|3|4|5|6|7|8|9)*' + '(' + '|'.join(f'{i:04d}' for i in range(0, 10000, 16)) + ')')

elif difficulty == 2:
    test_string = bin(t)[2:]  # binary
    if (t % 13 == 0) == expected_result:  # mod 13
        break

# pip install greenery
# pip install regex
from greenery import Fsm, Charclass, rxelems
import regex as re
import random

m = 13
d = 2

digits = [Charclass(str(i)) for i in range(d)]
other = ~Charclass("".join(str(i) for i in range(d)))
alphabet = set(digits + [other])
states = set(range(m + 1))  # m is the dead state
initial_state = 0
accepting_states = {0}
transition_map = dict()
for s in range(m):
    transition_map[s] = {digits[i]: (s * d + i) % m for i in range(d)}
    transition_map[s][other] = m
transition_map[m] = {digits[i]: m for i in range(d)}
transition_map[m][other] = m

dfa = Fsm(
    alphabet=alphabet,
    states=states,
    initial=initial_state,
    finals=accepting_states,
    map=transition_map,
)

def convert_regex(regex):
    # `(...)?` -> `((...)|)`
    while '?' in regex:
        regex = re.sub(r'\((.*?)\)\?', r'(\1|)', regex)
    # Handle `{n}` quantifier
    n = 1
    while '{' in regex:
        while '{' + str(n) + '}' in regex:
            regex = re.sub(r'(\((.*?)\)|\w)\{n\}'.replace('n', str(n)), r'\1' * n, regex)
        n += 1
    # [abc] -> (a|b|c)
    while '[' in regex:
        def convert_charset(match):
            chars = match.group(1)
            return '(' + '|'.join(chars) + ')'
        regex = re.sub(r'\[([^\]]+)\]', convert_charset, regex)
    assert set(regex) <= set("0123456789|()*")
    return regex

dfa = dfa.reduce()
regex = rxelems.from_fsm(dfa)
regex = regex.reduce()
regex = convert_regex(str(regex))
print(regex)

# res.length = 7279

elif difficulty == 3:
    test_string = str(t)  # decimal
    if (libscrc.gsm3(test_string.encode()) == 0) == expected_result:  # crc
        break

# pip install greenery
# pip install regex
# pip install libscrc
from greenery import Fsm, Charclass, rxelems
import regex as re
import libscrc

digits = [Charclass(str(i)) for i in range(10)]
other = ~Charclass(''.join(str(i) for i in range(10)))
alphabet = set(digits + [other])
states = set(range(9))  # 8 is the dead state
initial_state = libscrc.gsm3(b'')  # 7 (111)
accepting_states = {0}
transition_map = {s:dict() for s in states}
for s in states:
    transition_map[s][other] = 8
for prefix in range(1000):
    for i in range(10):
        s_1 = libscrc.gsm3(str(prefix).encode())
        s_2 = libscrc.gsm3(str(prefix).encode() + str(i).encode())
        transition_map[s_1][digits[i]] = s_2
for i in range(10):
    transition_map[8][digits[i]] = 8

dfa = Fsm(
    alphabet=alphabet,
    states=states,
    initial=initial_state,
    finals=accepting_states,
    map=transition_map,
)

def convert_regex(regex):
    # `(...)?` -> `((...)|)`
    while '?' in regex:
        regex = re.sub(r'\((.*?)\)\?', r'(\1|)', regex)
    # Handle `{n}` quantifier
    n = 1
    while '{' in regex:
        while '{' + str(n) + '}' in regex:
            regex = re.sub(r'(\((.*?)\)|\w)\{n\}'.replace('n', str(n)), r'\1' * n, regex)
        n += 1
    # [abc] -> (a|b|c)
    while '[' in regex:
        def convert_charset(match):
            chars = match.group(1)
            return '(' + '|'.join(chars) + ')'
        regex = re.sub(r'\[([^\]]+)\]', convert_charset, regex)
    assert set(regex) <= set("0123456789|()*")
    return regex

dfa = dfa.reduce()
regex = rxelems.from_fsm(dfa)
regex = regex.reduce()
regex = convert_regex(str(regex))
print(regex)