from pwn import *
import warnings
from draw import save
def save(filename):
visited = []
temp = eval(open("from_top_visited.txt", "r").read())
temp += eval(open("from_bottom_visited.txt", "r").read())
temp += eval(open("from_left_visited.txt", "r").read())
temp += eval(open("from_right_visited.txt", "r").read())
for i in temp:
if i not in visited:
visited.append(i)
random = eval(open("random.txt", "r").read())
wall = eval(open("wall.txt", "r").read())
flag = eval(open("flags.txt", "r").read())
file = Image.new("RGBA", (600, 600))
for i in range(200):
for j in range(200):
center_x = j * 3 + 1
center_y = i * 3 + 1
if [j, i] in visited:
if [j, i] not in random:
if [j, i] not in flag:
rgba = (255, 0, 0, 255)
else:
rgba = (255, 255, 0, 255)
else:
rgba = (0, 0, 255, 255)
else:
rgba = (0, 0, 0, 0)
file.putpixel((center_x - 1, center_y - 1), rgba)
file.putpixel((center_x - 1, center_y), rgba)
file.putpixel((center_x - 1, center_y + 1), rgba)
file.putpixel((center_x, center_y - 1), rgba)
file.putpixel((center_x, center_y), rgba)
file.putpixel((center_x, center_y + 1), rgba)
file.putpixel((center_x + 1, center_y - 1), rgba)
file.putpixel((center_x + 1, center_y), rgba)
file.putpixel((center_x + 1, center_y + 1), rgba)
center_x = 100 * 3 + 1
center_y = 100 * 3 + 1
file.putpixel((center_x - 1, center_y - 1), (0, 255, 0, 255))
file.putpixel((center_x - 1, center_y), (0, 255, 0, 255))
file.putpixel((center_x - 1, center_y + 1), (0, 255, 0, 255))
file.putpixel((center_x, center_y - 1), (0, 255, 0, 255))
file.putpixel((center_x, center_y), (0, 255, 0, 255))
file.putpixel((center_x, center_y + 1), (0, 255, 0, 255))
file.putpixel((center_x + 1, center_y - 1), (0, 255, 0, 255))
file.putpixel((center_x + 1, center_y), (0, 255, 0, 255))
file.putpixel((center_x + 1, center_y + 1), (0, 255, 0, 255))
for i in range(200):
for j in range(200):
center_x = j * 3 + 1
center_y = i * 3 + 1
ds = wall[j][i]
rgba = (0, 0, 0, 255)
if ds[0] == 1:
file.putpixel((center_x - 1, center_y - 1), rgba)
file.putpixel((center_x, center_y - 1), rgba)
file.putpixel((center_x + 1, center_y - 1), rgba)
# file.putpixel((center_x - 1, center_y - 2), rgba)
# file.putpixel((center_x, center_y - 2), rgba)
# file.putpixel((center_x + 1, center_y - 2), rgba)
if ds[1] == 1:
file.putpixel((center_x - 1, center_y + 1), rgba)
file.putpixel((center_x, center_y + 1), rgba)
file.putpixel((center_x + 1, center_y + 1), rgba)
# file.putpixel((center_x - 1, center_y + 2), rgba)
# file.putpixel((center_x, center_y + 2), rgba)
# file.putpixel((center_x + 1, center_y + 2), rgba)
if ds[2] == 1:
file.putpixel((center_x - 1, center_y - 1), rgba)
file.putpixel((center_x - 1, center_y), rgba)
file.putpixel((center_x - 1, center_y + 1), rgba)
# file.putpixel((center_x - 2, center_y - 1), rgba)
# file.putpixel((center_x - 2, center_y), rgba)
# file.putpixel((center_x - 2, center_y + 1), rgba)
if ds[3] == 1:
file.putpixel((center_x + 1, center_y - 1), rgba)
file.putpixel((center_x + 1, center_y), rgba)
file.putpixel((center_x + 1, center_y + 1), rgba)
# file.putpixel((center_x + 2, center_y - 1), rgba)
# file.putpixel((center_x + 2, center_y), rgba)
# file.putpixel((center_x + 2, center_y + 1), rgba)
file.save(filename)
warnings.filterwarnings("ignore")
context.log_level = 'error'
from_left_visited = []
from_right_visited = []
from_top_visited = []
from_bottom_visited = []
stack = [[100, 100]]
# 上0 下1 左2 右3
wall = [[[0, 0, 0, 0] for i in range(200)] for j in range(200)]
paths = [[b"" for _ in range(200)] for _ in range(200)]
random = []
flags = []
# 加载缓存
# from_top_visited = eval(open("from_top_visited.txt", "r").read())
# from_bottom_visited = eval(open("from_bottom_visited.txt", "r").read())
# from_left_visited = eval(open("from_left_visited.txt", "r").read())
# from_right_visited = eval(open("from_right_visited.txt", "r").read())
# stack = eval(open("stack.txt", "r").read())
# wall = eval(open("wall.txt", "r").read())
# paths = eval(open("paths.txt", "r").read())
# random = eval(open("random.txt", "r").read())
# flags = eval(open("flags.txt", "r").read())
directions = [(0, -1), (0, 1), (-1, 0), (1, 0)]
direct = [b"w", b"s", b"a", b"d"]
visited = [from_bottom_visited, from_top_visited, from_right_visited, from_left_visited]
while stack:
x, y = stack.pop()
# visited.append([x, y])
path = bytes(paths[x][y])
for d in range(len(directions)):
new_x = x + directions[d][0]
new_y = y + directions[d][1]
if [new_x, new_y] not in visited[d] and wall[x][y][d] == 0 and [new_x, new_y] not in random:
r = remote("202.112.238.82", 13370)
r.recvuntil(b"> ")
r.sendline(path)
r.recvuntil(b"> ")
r.sendline(direct[d])
res = r.recvuntil(b"> ").decode()
p = path + direct[d]
if "flag" in res or "Nothing" in res:
stack.append([new_x, new_y])
visited[d].append([new_x, new_y])
paths[new_x][new_y] = p
if "flag" in res:
flags.append([new_x, new_y])
if "wall" in res:
visited[d].append([new_x, new_y])
wall[x][y][d] = 1
if "random" in res:
visited[d].append([new_x, new_y])
random.append([new_x, new_y])
paths[new_x][new_y] = p
r.close()
print("总探索次数: ", sum([len(i) for i in visited]))
# 记录进程，防止中途爆炸
open("from_top_visited.txt", "w").write(str(from_top_visited))
open("from_bottom_visited.txt", "w").write(str(from_bottom_visited))
open("from_left_visited.txt", "w").write(str(from_left_visited))
open("from_right_visited.txt", "w").write(str(from_right_visited))
open("wall.txt", "w").write(str(wall))
open("random.txt", "w").write(str(random))
open("paths.txt", "w").write(str(paths))
open("stack.txt", "w").write(str(stack))
open("flags.txt", "w").write(str(flags))
save("map.png")
黑色和白色为从不同方向访问的墙
根据墙的特征，画出特殊点位的图
unknown = []
wall = eval(open("wall.txt", "r").read())
for i in range(1, 199):
for j in range(1, 199):
if wall[j][i][0] == 1 and wall[j][i - 1][1] == 0:
unknown.append([(j, i), (j, i - 1)])
if wall[j][i][1] == 1 and wall[j][i + 1][0] == 0:
unknown.append([(j, i), (j, i + 1)])
if wall[j][i][2] == 1 and wall[j - 1][i][3] == 0:
unknown.append([(j, i), (j - 1, i)])
if wall[j][i][3] == 1 and wall[j + 1][i][2] == 0:
unknown.append([(j, i), (j + 1, i)])
a = [i[0] for i in unknown]
file = Image.new("RGB", (200, 200))
for i in range(200):
for j in range(200):
if (j, i) in a:
file.putpixel((j, i), (0, 0, 0))
else:
file.putpixel((j, i), (255, 255, 255))
file.save("unknown2.png")
能看，但不完全能看
后续有空再写个脚本完整的画出来
题目后端
server.py
BANNER = '''
$$\ $$\ $$\
$$ | $$ | \__|
$$$$$$$\ $$$$$$\ $$$$$$$\ $$$$$$\ $$ | $$ |$$$$$$$\ $$\ $$\ $$\ $$$$$$\ $$$$$$\ $$$$$$$\ $$$$$$\
$$ __$$\ \____$$\ $$ __$$\ $$ __$$\ $$ | $$ |$$ __$$\ $$ |\$$\ $$ |$$ __$$\ $$ __$$\ $$ _____|$$ __$$\
$$ | $$ | $$$$$$$ |$$ | $$ |$$ / $$ |$$ | $$ |$$ | $$ |$$ | \$$\$$ / $$$$$$$$ |$$ | \__|\$$$$$$\ $$$$$$$$ |
$$ | $$ |$$ __$$ |$$ | $$ |$$ | $$ |$$ | $$ |$$ | $$ |$$ | \$$$ / $$ ____|$$ | \____$$\ $$ ____|
$$ | $$ |\$$$$$$$ |$$ | $$ |\$$$$$$ |\$$$$$$ |$$ | $$ |$$ | \$ / \$$$$$$$\ $$ | $$$$$$$ |\$$$$$$$\
\__| \__| \_______|\__| \__| \______/ \______/ \__| \__|\__| \_/ \_______|\__| \_______/ \_______|
Caught in the Dark ......
You're piloting a spaceship in a dark, two-dimensional universe. Your ship can only move in four directions: north(W), south(S), east(D) and west(A). You can't see anything, but you can feel the walls around you if you touch them.
'''
import random
w = 75
h = 51
MAP = [list(x) for x in open('map.txt', 'r').read().strip().split('\n')]
FLAG_1 = "TPCTF{NO7icE-And-HELP-THe-vIsUALLy-1MP@IR3d-ar0unD-US}"
flag_chips = [[0 for _ in range(w)] for _ in range(h)]
flag_chips_id = [x+1 for x in range(len(FLAG_1))]
random.Random(FLAG_1).shuffle(flag_chips_id)
for i in range(h):
for j in range(w):
if MAP[i*2+1][j*2+1] == '$':
flag_chips[i][j] = flag_chips_id[-1]
del flag_chips_id[-1]
assert len(flag_chips_id) == 0
flag = ['_' for _ in range(len(FLAG_1))]
# flag is: ______________________________________________________
x, y, c = (25, 37, 0)
fuel = 1000
print(BANNER)
while fuel > 0:
print(f'Fuel: {fuel}')
print()
def move(d):
global x, y, c, fuel
__x = x * 2 + 1 + [-1, 1, 0, 0][d]
__y = y * 2 + 1 + [0, 0, -1, 1][d]
# print(x, y, __x, __y)
if MAP[__x][__y] in '-|':
fuel -= 3
print("Sorry you hit the wall.")
return
if MAP[__x][__y] in 'AB':
if c and (c == 1) != (MAP[__x][__y] == 'A'):
fuel -= 3
print("Sorry you hit the wall.")
return
__c = 1 if MAP[__x][__y] == 'A' else 2
__x = x * 2 + 1 + [-1, 1, 0, 0][d] * 2
__y = y * 2 + 1 + [0, 0, -1, 1][d] * 2
x += [-1, 1, 0, 0][d]
y += [0, 0, -1, 1][d]
# print(__x, __y, MAP[__x][__y])
if MAP[__x][__y] == ' ' or MAP[__x][__y] == 'x':
c = 0
fuel -= 1
print("Nothing happened.")
return
if MAP[__x][__y] == '$':
c = 0
fuel -= 1
if flag[flag_chips[__x//2][__y//2] - 1] == '_':
fuel += 50
flag[flag_chips[__x//2][__y//2] - 1] = FLAG_1[flag_chips[__x//2][__y//2] - 1]
print("You get the flag fragment!", 'Now the flag is ' + ''.join(flag))
else:
print("Nothing happened.")
return
if MAP[__x][__y] == '#':
c = 0
fuel -= 1
x = random.randint(0, h-1)
y = random.randint(0, w-1)
while MAP[x*2+1][y*2+1] != ' ':
x = random.randint(0, h-1)
y = random.randint(0, w-1)
print("It seems you've been randomly transported somewhere.")
return
if MAP[__x][__y] == '*':
c = __c if c == 0 else c
fuel -= 1
print("Nothing happened.")
return
raise RuntimeError('anything wrong?')
for d in input("> ").strip().upper():
if d in 'WSAD':
move('WSAD'.index(d))
if fuel <= 0:
break
print()
print('Your spaceship crashed.')
# pip install urllib3==1.25.6
import time, urllib3, signal
signal.signal(signal.SIGALRM, lambda x, y: 1/0)
normalize=lambda url:urllib3.util.parse_url(url).url.lower()
def test(n,b):
a=b'TPCTF{n0t_a_1inear_a1g0}'
if b==b'':
b=b'\x00'
url="http://flag/"+''.join([chr(a[i%len(a)]^b[i%len(b)]) for i in range(n)])
t=time.time()
#print("Before normalization:",url[:18]+("..." if len(url)>18 else ""))
url=normalize(url)
url=normalize(url)
#print("After normalization:",url[:18]+("..." if len(url)>18 else ""))
return time.time()-t
def run():
n=int(input("Length of the path after domain to test: "))
assert 0<=n<=1000000, "Invalid length"
key=bytes.fromhex(input("XOR key used to generate the URL to test (in hex): "))
try:
signal.alarm(5)
print(f"Time used: {test(n,key)}s")
signal.alarm(0)
except Exception as e:
print("Timeout")
print(f"Here you can test my service based on urllib3 {urllib3.__version__} which also normalizes your URL to lowercase. Why on earth is URL normalized TWICE?")
while 1:
run()
> put a.flag 0 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa a
> mv a.flag b
> get b 0 100 a
61b5bb87de53f5bc4425a0396b9038354889ad0dd25e3387d46da50c884ba97f61b5bb87de53f5bc4425a0396b9038354889ad0dd25e3387d46da50c884b
> rm b
> putflag a a
> mv a.flag b
> get b 0 100 a
54a49d7ac36dc4a84a23a5f95662361c36747fd0d0352456be51a31e6750ad564facd7
exp.py
test = list(bytes.fromhex("61b5bb87de53f5bc4425a0396b9038354889ad0dd25e3387d46da50c884ba97f61b5bb87de53f5bc4425a0396b9038354889ad0dd25e3387d46da50c884b"))
a = list(bytes.fromhex("54a49d7ac36dc4a84a23a5f95662361c36747fd0d0352456be51a31e6750ad564facd7"))
a = [(a[i] - test[i] + ord("a")) % 256 for i in range(len(a))]
print(bytes(a))
