GeekGame 3rd Writeup

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
import requests
import re

url = "https://prob14.geekgame.pku.edu.cn/level1"

s = set()
while True:
    response = requests.get(url).text
    emoji_pattern = re.compile(r'[\U0001F600-\U0001F64F\U0001F300-\U0001F5FF\U0001F680-\U0001F6FF\U0001F700-\U0001F77F\U0001F780-\U0001F7FF\U0001F800-\U0001F8FF\U0001F900-\U0001F9FF\U0001FA00-\U0001FA6F\U0001FA70-\U0001FAFF\U0001FAB0-\U0001FAB6\U0001FAC0-\U0001FAC2\U0001FAD0-\U0001FAD6]+', flags=re.UNICODE)
    # ChatGPT找到的范围
    emojis = emoji_pattern.findall(response)

    for letter in emojis[0]:
        s.add(letter)

    print(len(s))
    if (len(s) == 128):
        # 即使不知道大小，也可以在多次请求且len(s)未变化的情况下终止
        break

print(s)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
import requests
import re

url = 'https://prob14.geekgame.pku.edu.cn/level3'

session = requests.Session()
response = session.get(url)  # 第一次请求的 header 没有 JWT
response = session.get(url)
headers = response.request.headers

emojis = ['🐿', '👆', '👀', '👪', '👘', '🐘', '💄', '💋', '👟', '👶', 
          '👩', '🐔', '💃', '👠', '👱', '👔', '🐑', '🐶', '💁', '👺', 
          '🐒', '🐞', '👃', '🐰', '👊', '👻', '👂', '🐝', '💎', '👡', 
          '🐮', '👲', '👍', '👚', '👧', '🐲', '💈', '🐹', '👽', '🐣', 
          '🐺', '🐜', '🐸', '🐵', '💀', '👗', '🐚', '👭', '🐡', '👄', 
          '👁', '👦', '👵', '👰', '👮', '🐼', '🐟', '🐠', '👥', '🐖', 
          '🐙', '💂', '👉', '🐷', '🐫', '👌', '👤', '🐾', '👛', '👕', 
          '💏', '👈', '💇', '🐩', '👇', '🐢', '🐨', '👑', '�', '👙', 
          '💉', '👋', '💌', '🐦', '🐕', '💅', '👏', '👜', '🐥', '💆', 
          '👾', '👎', '🐱', '👹', '🐗', '👖', '👯', '👓', '🐐', '👢', 
          '🐤', '💊', '👒', '👼', '🐛', '🐬', '🐻', '🐓', '👬', '👿', 
          '👅', '👫', '👞', '🐽', '👸', '🐴', '👝', '🐯', '👳', '🐳', 
          '🐭', '🐪', '🐧', '💍', '👐', '👷', '👨', '👴']
# 我这里的 emojis 似乎不全，但是不影响通过
params = { 'guess': '' }
pattern = r'[🟩🟨🟥]+'
emoji_result = ['0'] * 64

for i in range(128):
    params['guess'] = emojis[i] * 64
    response = requests.get(url, headers=headers, params=params)
    try:
        results = re.search(pattern, response.text).group()
        print(results)
        for j in range(64):
            if results[j] == '🟩':
                emoji_result[j] = emojis[i]
        print(emoji_result)
    except:
        print(response.text)

params['guess'] = ''.join(emoji_result)
response = requests.get(url, headers=headers, params=params)
print(response.text)
session.close()

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
crt = 235182324091
mod = 256881516329

def generate_children(initial_value, max_depth):
    stack = [(initial_value, [], {'A': 0, 'E': 0, 'I': 0, 'O': 0})]
    operators = [11, 22, 33, 44]
    mapping = {
        11: 'A',
        22: 'E',
        33: 'I',
        44: 'O',
    }

    while stack:
        current_value, operation_list, char_count = stack.pop()

        if len(operation_list) == 16 and (((current_value * 13337) + 66) % mod == crt):
            mapped_array = [mapping[num] for num in operation_list]
            flag_str = ''.join(mapped_array)
            print("flag{" + flag_str + "}")
            break

        if len(operation_list) < max_depth:
            for op in operators:
                new_value = (current_value * 13337) + op
                new_operation_list = operation_list + [op]
                new_char_count = char_count.copy()
                char = mapping[op]
                new_char_count[char] += 1

                if (
                    new_char_count['A'] <= 6 and
                    new_char_count['E'] <= 3 and
                    new_char_count['I'] <= 1 and
                    new_char_count['O'] <= 6
                ):
                    stack.append((new_value, new_operation_list, new_char_count))

if __name__ == "__main__":
    max_depth = 16  # 最大深度
    initial_value = 1337
    generate_children(initial_value, max_depth)

1
2
3
4
5
6
7
8
9
import random
random.seed(1)
print(hex(random.getrandbits(32)))
# 0x2265b1f5
print(hex(random.getrandbits(32)))
random.seed(1)
# 0x91b7584a
print(random.randbytes(12).hex())
# 0xf5b165224a58b791

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
from randcrack import RandomCrack
from collections import deque

cipher = ''  # 填入密文

def hex_to_int(hex_string, m, n):
    # 获得 hex 串的 int值
    hex_substring = hex_string[m:n]
    decimal_value = int(hex_substring, 16)
    return decimal_value

def reverse_hex_by_32_bits(hex_string):
    # 每 32 位颠倒一次字节序
    if len(hex_string) % 8 != 0:
        print("not fit")
        return
    j = 0
    tmp = deque()
    long_str = ""
    while True:
        if (j * 8 == len(hex_string)):
            break
        tmp.clear()
        for i in range(4):
            tmp.appendleft(hex_string[j * 8 + i * 2:j * 8 + i * 2 + 2])
        short_str = "".join(tmp)
        long_str += short_str
        j += 1

    return long_str

def xor_hex_strings(hex_str1, hex_str2):
    # 对 hex 按位异或
    if len(hex_str1) != len(hex_str2):
        return "输入字符串长度不相同"

    # 使用 zip 将两个字符串逐字符配对并进行按位异或操作
    xor_result = [hex(int(x, 16) ^ int(y, 16))[2:] for x, y in zip(hex_str1, hex_str2)]
    result_hex = ''.join(xor_result)
    return result_hex


use = reverse_hex_by_32_bits(cipher[:5000])
rc = RandCrack()
for i in range(624):
    x = hex_to_int(use, i * 8, i * 8 + 8)
    rc.submit(x)

y = hex_to_int(use, 4992, 5000)
if y == rc.predict_getrandbits(32):
    print("Match!")

key = ""
for _ in range(8):
    short_key = hex(rc.predict_getrandbits(32))[2:].zfill(8)
    key += short_key
key = reverse_hex_by_32_bits(key)[:58]
result = xor_hex_strings(cipher[5000:5058], key)
print(result)
# 得到 flag hex

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
from randcrack import RandCrack
from random import Random
from collections import deque
import secrets

cipher = '' # 填入密文

def reverse_hex_by_32_bits(hex_string):
    if len(hex_string) % 8 != 0:
        print("not fit")
        return
    j = 0
    tmp = deque()
    long_str = ""
    while True:
        if (j * 8 == len(hex_string)):
            break
        tmp.clear()
        for i in range(4):
            tmp.appendleft(hex_string[j * 8 + i * 2:j * 8 + i * 2 + 2])
        short_str = "".join(tmp)
        long_str += short_str
        j += 1

    return long_str

def xor_arrays(a, b, *args):
    # 对 binary 按位异或
    if args:
        return xor_arrays(a, xor_arrays(b, *args))
    return bytes([x ^ y for x, y in zip(a, b])

def xor_hex_strings(hex_str1, hex_str2):
    # 对 hex 按位异或
    if len(hex_str1) != len(hex_str2):
        return "输入字符串长度不相同"

    # 使用 zip 将两个字符串逐字符配对并进行按位异或操作
    xor_result = [hex(int(x, 16) ^ int(y, 16))[2:] for x, y in zip(hex_str1, hex_str2)]
    result_hex = ''.join(xor_result)
    return result_hex

def hex_to_int(hex_string, m, n):
    hex_substring = hex_string[m:n]  # 从索引 m 到 n 的子字符串
    decimal_value = int(hex_substring, 16)  # 将子字符串解释为十六进制并转换为十进制整数
    return decimal_value

seed1 = '2da5129badec89f1e34e713215d908ff0c79951538e2906307726e9515011ca9'  # 题目告诉
seed2 = 1

seed1 = int(seed1, 16)

void1 = Random(seed1)
void2 = Random(seed2)

entropy = secrets.randbits(22)
# print(entropy)

for i in range(1):
    # 原本设置的循环大小是 4194303，但没想到第一遍就出了
    void1.randbytes(i)
    void2.randbytes(i)
    rc = RandCrack()
    for j in range(624):
        s = cipher[j * 8: j * 8 + 8]
        s = bytes.fromhex(s)
        a = void1.randbytes(4)
        b = void2.randbytes(4)
        c = xor_arrays(s, a, b)
        x = reverse_hex_by_32_bits(c.hex())
        # print(x)
        x = int(x, 16)
        rc.submit(x)

    rc.predict_getrandbits(32)
    void1.randbytes(4)
    void2.randbytes(4)

    # print(x)
    keya = ""
    keyb = ""
    keyc = ""
    for _ in range(8):
        keyc += hex(rc.predict_getrandbits(32))[2:].zfill(8)
    keyc = bytes.fromhex(reverse_hex_by_32_bits(keyc))

    s = cipher[5000: 5064]
    s = bytes.fromhex(s)
    a = void1.randbytes(32)
    b = void2.randbytes(32)
    mix = xor_arrays(s, a, b, keyc)
    print(mix.hex())

# 666c61677b4372416654316e675f734565645f63416e5f62335f665555756e7d
# flag{CrAfT1ng_sEed_cAn_b3_fUUun}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
import subprocess
import re

# 启动 nc 进程，建立持续连接
p = subprocess.Popen(["nc", "prob08.geekgame.pku.edu.cn", "10008"], stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)

p.stdin.write("Your Token\n")
p.stdin.flush()

# 使用循环来持续交互
for i in range(3):
    a = ""
    for line in iter(p.stdout.readline, '\n'):
        a += line.strip()
        print(line.strip())
    if i == 0:
        for _ in range(4):
            # 程序会输出多个换行，因此手动读出
            print(p.stdout.readline())
    if i == 2:
        break
    if i == 0:
        user_input = input("Enter your message: ")  # 获取用户输入
        p.stdin.write(user_input + "\n")  # 将用户输入发送给 nc 进程
        p.stdin.flush()
    else:
        pattern = r'(.*)<(.*)>(.*)'
        result = re.sub(pattern, r'\2', a)
        print(result)
        p.stdin.write(result + "\n")
        p.stdin.flush()