st98 の日記帳

import requests

for x in range(1000):
  if x % 100 == 0:
    print x
  r = requests.get('https://gameserver.zajebistyc.tf/admin/login.php', cookies={
    'otadmin': '{"hash": %d}' % x
  }).content
  if 'HINT XD' not in r:
    print x, r

import re

# objdump -d -M intel elementary > elementary.dis
with open('elementary.dis') as f:
  s = f.read()

# check <function\d+>
table = [None for _ in range(832)]
for func in s.split('\n\n'):
  lines = func.splitlines()
  if '<function' not in lines[0]:
    continue

  i = int(re.findall(r'<function(\d+)', lines[0])[0])

  vars = {
    'eax': 0,
    'ebx': 0,
    'ecx': 0
  }
  vars['eax'] = 0xff
  for line in lines[7:-5]:
    op, args = re.split(r'\s+', line.split('\t')[2])
    args = args.split(',')
    args[1] = int(args[1], 16) if args[1].startswith('0x') else vars[args[1]]

    if op == 'xor':
      vars[args[0]] ^= args[1]
    elif op == 'or':
      vars[args[0]] |= args[1]
    elif op == 'and':
      vars[args[0]] &= args[1]
    elif op == 'mov':
      vars[args[0]] = args[1]

  table[i] = vars['eax'] ^ 0xff

# tokuyo!
flag = [0 for _ in range(832 // 8)]
for func in s.split('\n\n'):
  lines = func.splitlines()
  if '<checkFlag' not in lines[0]:
    continue

  for chunk in func.split('je')[:-1]:
    i, j, k = 0, 0, None

    for line in chunk.splitlines():
      if 'add    rax,' in line:
        i = int(line.split('add    rax,')[1], 16)
      elif 'sar    eax,' in line:
        j = int(line.split('sar    eax,')[1], 16)
      elif ('call' in line) and ('<function' in line):
        k = int(re.findall(r'<function(\d+)', line)[0])

    flag[i] ^= table[k] << j

  break

print ''.join(chr(c) for c in flag)

import re
s = """($i$a$-map-FlagCheckerKt$checksum$1 instanceof }) ? ((Number)entry.getSecond()).intValue() - 27 : 
︙
($i$a$-map-FlagCheckerKt$checksum$1 instanceof p) ? ((Number)entry.getSecond()).intValue() - 27040 : """

flag = [None for _ in range(28)]
for line in s.splitlines():
  c = re.findall(r'instanceof (.)', line)[0]
  i = int(re.findall(r'- (\d+)', line)[0])
  tmp = []
  while i != 0:
    tmp.append(i % 32)
    i //= 32
  print(c, tmp)

import re
s = """($i$a$-map-FlagCheckerKt$checksum$1 instanceof }) ? ((Number)entry.getSecond()).intValue() - 27 : 
︙
($i$a$-map-FlagCheckerKt$checksum$1 instanceof p) ? ((Number)entry.getSecond()).intValue() - 27040 : """

flag = [None for _ in range(28)]
for line in s.splitlines():
  c = re.findall(r'instanceof (.)', line)[0]
  i = int(re.findall(r'- (\d+)', line)[0])
  while i != 0:
    flag[i % 32] = c
    i //= 32
print(''.join(flag))

import multiprocessing

from Crypto.Cipher import AES

from secret import key, flag

counter = 0
aes = AES.new(key, AES.MODE_ECB)


def chunk(input_data, size):
    return [input_data[i:i + size] for i in range(0, len(input_data), size)]


def xor(*t):
    from functools import reduce
    from operator import xor
    return [reduce(xor, x, 0) for x in zip(*t)]


def xor_string(t1, t2):
    t1 = map(ord, t1)
    t2 = map(ord, t2)
    return "".join(map(chr, xor(t1, t2)))


def pad(data):
    pad_byte = 16 - len(data) % 16
    return data + (chr(pad_byte) * pad_byte)


def worker_function(block):
    global counter
    key_stream = aes.encrypt(pad(str(counter)))
    result = xor_string(block, key_stream)
    counter += 1
    return result


def distribute_work(worker, data_list, processes=8):
    pool = multiprocessing.Pool(processes=processes)
    result = pool.map(worker, data_list)
    pool.close()
    return result


def encrypt_parallel(plaintext, workers_number):
    chunks = chunk(pad(plaintext), 16)
    results = distribute_work(worker_function, chunks, workers_number)
    return "".join(results)


def main():
    plaintext = """The Song of the Count

You know that I am called the Count
Because I really love to count
I could sit and count all day
Sometimes I get carried away
I count slowly, slowly, slowly getting faster
Once I've started counting it's really hard to stop
Faster, faster. It is so exciting!
I could count forever, count until I drop
1! 2! 3! 4!
1-2-3-4, 1-2-3-4,
1-2, i love couning whatever the ammount haha!
1-2-3-4, heyyayayay heyayayay that's the sound of the count
I count the spiders on the wall...
I count the cobwebs in the hall...
I count the candles on the shelf...
When I'm alone, I count myself!
I count slowly, slowly, slowly getting faster
Once I've started counting it's really hard to stop
Faster, faster. It is so exciting!
I could count forever, count until I drop
1! 2! 3! 4!
1-2-3-4, 1-2-3-4, 1,
2 I love counting whatever the
ammount! 1-2-3-4 heyayayay heayayay 1-2-3-4
That's the song of the Count!
""" + flag
    encrypted = encrypt_parallel(plaintext, 32)
    print(encrypted.encode("hex"))


if __name__ == '__main__':
    multiprocessing.freeze_support()
    main()

import binascii
import sys

# parse
table = " p4{krule_ctf}"
s = """        4 {4pp   
       p {k4{ E  
      p 44p{ p   
       4 p       
        S        
                 
                 
                 
                 """

m = []
start, end = None, None
for y, line in enumerate(s.splitlines()):
  tmp = []
  for x, c in enumerate(line):
    if c == 'S':
      start = x, y
      tmp.append(0)
    elif c == 'E':
      end = x, y
      tmp.append(0)
    else:
      tmp.append(table.index(c))
  m.append(tmp)

def check():
  for line in m:
    for x in line:
      if x != 0:
        return False
  return True

# solve
convert_table = {
  (-1, 1):  0b10,
  (-1, 0):  0b00,
  (-1, -1): 0b00,
  (1, 0):   0b01,
  (1, -1):  0b01,
  (1, 1):   0b11
}
def convert(qq):
  flag = [0 for _ in range(9)]
  i = 0
  px, py = start
  for x, y in qq:
    tmp = convert_table[x - px, y - py]
    flag[i // 4] |= tmp << (2 * (i % 4))
    px, py = x, y
    i += 1
  flag = ''.join(hex(c)[2:].zfill(2) for c in flag)
  return flag

x, y = start
target = end
q = []

# init
for c in b'p4{':
  for _ in range(4):
    # x
    if c & 1 == 0:
      if x != 0:
        x -= 1
    else:
      if x != 16:
        x += 1

    # y
    if c & 2 == 0:
      if y > 0:
        y -= 1
    else:
      if y < 8:
        y += 1

    q.append((x, y))
    m[y][x] -= 1
    c >>= 2

def solve(x, y):
  if check() and (x, y) == target:
    # solved
    flag = convert(q)
    tmp = binascii.unhexlify(flag)
    if flag.endswith('7d') and all((ord('0') <= c <= ord('9')) or (ord('a') <= c <= ord('z')) for c in tmp[3:-1]):
      print(tmp.decode())
      sys.exit(0)
    return

  dxs = []
  if x != 0:
    dxs.append(-1)
  else:
    dxs.append(0)
  if x != 16:
    dxs.append(1)
  else:
    dxs.append(0)

  dys = []
  if y != 0:
    dys.append(-1)
  else:
    dys.append(0)

  if y != 8:
    dys.append(1)
  else:
    dys.append(0)

  for dy in dys:
    for dx in dxs:
      if m[y + dy][x + dx] > 0 or (x + dx, y + dy) in (start, end):
        q.append((x + dx, y + dy))

        if (x + dx, y + dy) not in (start, end):
          m[y + dy][x + dx] -= 1

        solve(x + dx, y + dy)

        # clean up
        q.pop()
        if (x + dx, y + dy) not in (start, end):
          m[y + dy][x + dx] += 1

solve(x, y)

# coding: utf-8
import binascii
import string
import itertools
import re

def convert(s):
  res = [0 for _ in range(162)]
  i = 0x50

  for c in s:
    for _ in range(4):
      # x
      if c & 1 == 0:
        if i != 0 and i % 0x12 != 0: # 一番最初でなく、かつ改行箇所の直後でない
          i -= 1
      else:
        if i == 0 or i % 0x12 != 0x10: # 一番最初か、または改行箇所でない
          i += 1

      # y
      if c & 2 == 0:
        if i > 0x11: # 最初の行でない
          i -= 0x12
      else:
        if i < 0x8f: # 最後の行でない
          i += 0x12

      c >>= 2
      res[i] += 1

  return res, i

table = " p4{krule_ctf}"
def arr_to_str(a, k):
  res = ''

  for i in range(162):
    if a[i] > 0xd:
      res += '^'
    elif i == 0x50:
      res += 'S'
    elif i == k:
      res += 'E'
    else:
      res += table[a[i]]

  return '\n'.join(re.findall(r'.{18}', res))

s = """        4 {4pp   
       p {k4{ E  
      p 44p{ p   
       4 p       
        S        
                 
                 
                 
                 """.replace(' ', '').replace('\n', '')

for x in itertools.product('0123456789abcdefghijklmnopqrstuvwxyz', repeat=5):
  tmp = '70347b' + binascii.hexlify(''.join(x).encode()).decode() + '7d'
  m, i = convert(binascii.unhexlify(tmp))
  if arr_to_str(m, i).replace(' ', '').replace('\n', '') == s:
    print(tmp)