MFCTF 2021 – judgement

因為賽後才寫，比賽早就關了，所以沒圖
丟個 watame 鎮樓

---

太晚寫 write up ，也沒備份原題目，source code 已經被我改的面目全非了….
大致上就是給了加密的 code

cand = string.ascii_letters + string.digits + '_{}'
charset = string.printable[:93]

def ency(stri):
    enc = ''
    for c in stri:
        assert(c in cand)
        enc += charset[int(sha256(c.encode()).hexdigest(), 16) % len(charset)]
    return encCode language: JavaScript (javascript)

給了 output

''')g;Fk@>2g;2V2J?d5G3_8V2<dR2i5GZ@<?2)g\j_2V&?2;@[F@ek2_3"=k&;2)\F2J9LL4g[W2"[2<)RZ23@<?2elFZ?2=@jZ23@=F2Yi52;lL5Vj2J?2J8\e@eW23e2lF330'''Code language: JavaScript (javascript)

求原 flag

這題麻煩的是在於 flag 是 leet 後的通順文句
而純粹的暴力解會解出有問題的文
如下面這種除了 leet 外還有一堆看起來錯的答案

"AIS3{iT_IS_L_Beau215U4_cay_0u2siKe_AIrDF_LRe_SiN3inx_q1owxRS_Arv_BlOOmIN6_oN_cAys_1iKe_nhvse_kiDs_1ikv_Y0u_ShOZ4D_Be_BUr7in6_17_hv11}"Code language: JSON / JSON with Comments (json)

我的作法是在爆開的同時加入人工確認的方式以檢查 flag 的正確性

script 如下

from hashlib import sha256
import string

flag = 'AIS3{'

true_flag = ''')g;Fk@>2g;2V2J?d5G3_8V2<dR2i5GZ@<?2)g\j_2V&?2;@[F@ek2_3"=k&;2)\F2J9LL4g[W2"[2<)RZ23@<?2elFZ?2=@jZ23@=F2Yi52;lL5Vj2J?2J8\e@eW23e2lF330'''

cand = string.ascii_letters + string.digits + '_{}'
charset = string.printable[:93]

def ency(stri):
    enc = ''
    for c in stri:
        assert(c in cand)
        enc += charset[int(sha256(c.encode()).hexdigest(), 16) % len(charset)]
    return enc

while True:
    for i in cand:
        if true_flag.startswith(ency(flag + i)):
            print(flag + i)
            c = input()
            if(c == 'y'):
                flag += i
                breakCode language: JavaScript (javascript)

最後的 flag

"AIS3{iT_IS_4_Beaut1FUL_day_0utside_8IrD5_4Re_SiNGin9_F1owERS_Ar3_BlOOmIN6_oN_dAys_1iKe_7h3se_kiDs_1ik3_Y0u_ShOuLD_Be_BUrnin6_1n_h311}"Code language: JSON / JSON with Comments (json)