469 lines
53 KiB
HTML
469 lines
53 KiB
HTML
<!DOCTYPE html>
|
||
<html lang="en"><head>
|
||
<title>GoatPr0n.farm</title>
|
||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||
<meta name="format-detection" content="telephone=no" />
|
||
<meta name="theme-color" content="#000084" />
|
||
<link rel="icon" href="https://goatpr0n.farm//favicon.ico">
|
||
<link rel="canonical" href="https://goatpr0n.farm/">
|
||
|
||
<link rel="stylesheet" href="/css/bootstrap.css">
|
||
<link rel="stylesheet" href="/css/bootstrap-responsive.css">
|
||
<link rel="stylesheet" href="/css/style.css">
|
||
|
||
</head><body>
|
||
<nav class="navbar navbar-inverse navbar-fixed-top">
|
||
<div class="navbar-inner">
|
||
<div class="container">
|
||
<button type="button" class="btn btn-navbar" data-toggle="collapse" data-target=".nav-collapse"></button>
|
||
<a class="brand" href="https://goatpr0n.farm/">GoatPr0n.farm</a>
|
||
<div class="nav-collapse collapse">
|
||
<ul class="nav">
|
||
|
||
|
||
|
||
<li>
|
||
<a href="/posts/">
|
||
|
||
<span>All posts</span>
|
||
</a>
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
</nav><div id="content" class="container">
|
||
|
||
<div class="row-fluid navmargin">
|
||
<div class="page-header">
|
||
<h1>Google CTF 2019 - FriendSpaceBookPlusAllAccessRedPremium.com - Wed, Jul 24, 2019</h1>
|
||
</div>
|
||
<p class="lead"></p>
|
||
<p><em>#MemeFreeEdition</em></p>
|
||
<h2 id="the-challenge">The Challenge</h2>
|
||
<p>You are provided a zip file containing two files.</p>
|
||
<ul>
|
||
<li><code>program</code></li>
|
||
<li><code>vm.py</code></li>
|
||
</ul>
|
||
<p>The file <code>program</code> contains instructions encoded as emojis for a virtual machine called <code>vm.py</code>. At the bottom of <code>vm.py</code> I found a list, or lets call it a translation table, with emojis and their function name counter part.</p>
|
||
<div class="highlight"><pre style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-python" data-lang="python"> OPERATIONS <span style="color:#f92672">=</span> {
|
||
<span style="color:#e6db74">'🍡'</span>: add,
|
||
<span style="color:#e6db74">'🤡'</span>: clone,
|
||
<span style="color:#e6db74">'📐'</span>: divide,
|
||
<span style="color:#e6db74">'😲'</span>: if_zero,
|
||
<span style="color:#e6db74">'😄'</span>: if_not_zero,
|
||
<span style="color:#e6db74">'🏀'</span>: jump_to,
|
||
<span style="color:#e6db74">'🚛'</span>: load,
|
||
<span style="color:#e6db74">'📬'</span>: modulo,
|
||
<span style="color:#e6db74">'⭐'</span>: multiply,
|
||
<span style="color:#e6db74">'🍿'</span>: pop,
|
||
<span style="color:#e6db74">'📤'</span>: pop_out,
|
||
<span style="color:#e6db74">'🎤'</span>: print_top,
|
||
<span style="color:#e6db74">'📥'</span>: push,
|
||
<span style="color:#e6db74">'🔪'</span>: sub,
|
||
<span style="color:#e6db74">'🌓'</span>: xor,
|
||
<span style="color:#e6db74">'⛰'</span>: jump_top,
|
||
<span style="color:#e6db74">'⌛'</span>: exit
|
||
}
|
||
</code></pre></div><p>To execute <code>program</code> with <code>vm.py</code> I ran:</p>
|
||
<div class="highlight"><pre style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash">$ python vm.py program
|
||
http://^C
|
||
</code></pre></div><p>The program started printing letters to the terminal, but became horribly slow, until I decided to terminate the execution. So the challenge seemed to be, to convince <code>program</code> to give me its secret. With the first characters looking like an URL, the flag might be hidden within the URL or on the website the URL pointing to.</p>
|
||
<p>In which way I had to convince the program to reveal its secrets to me, I had yet to decide. One way could be to optimize the VM code, the other might be optimizing the code of <code>program</code>.</p>
|
||
<h2 id="the-solutions">The Solution(s)</h2>
|
||
<h3 id="solving-the-challenge-trail-and-error">Solving the Challenge: Trail and Error</h3>
|
||
<p>The python script <code>vm.py</code> defines a class named <code>VM</code> with the following constructor:</p>
|
||
<div class="highlight"><pre style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-python" data-lang="python"><span style="color:#66d9ef">def</span> <span style="color:#f92672">**</span>init<span style="color:#f92672">**</span>(self, rom):
|
||
self<span style="color:#f92672">.</span>rom <span style="color:#f92672">=</span> rom
|
||
self<span style="color:#f92672">.</span>accumulator1 <span style="color:#f92672">=</span> <span style="color:#ae81ff">0</span>
|
||
self<span style="color:#f92672">.</span>accumulator2 <span style="color:#f92672">=</span> <span style="color:#ae81ff">0</span>
|
||
self<span style="color:#f92672">.</span>instruction_pointer <span style="color:#f92672">=</span> <span style="color:#ae81ff">1</span>
|
||
self<span style="color:#f92672">.</span>stack <span style="color:#f92672">=</span> \[\]
|
||
</code></pre></div><p>The VM stores the program code in the variable <code>self.rom</code>. It is filled on creation by reading the source file (<code>program</code>) given as argument. The source is stored as a list (returned by <code>.read().split()</code> of a <code>file</code> object). Two accumulator registers, <code>self.accumulator1</code> and <code>self.accumulator2</code>, are initialized with ‘0’. A third register is the <code>self.instruction_pointer</code>, it will the the VM which operation in <code>self.rom</code> will be executed next. It starts at ‘1’ and not at ‘0’. The list containing the rom is initialized with an empty string (<code>['']</code>) and then extended by the program code. The last variable is <code>self.stack</code> which is empty list.</p>
|
||
<p>Lists in Python can be used as a stack like structure. With <code>list.append()</code> (<code>push</code>) and <code>list.pop()</code> (<code>pop</code>) the behavior of these data structures is identical.</p>
|
||
<p>I decided to translate the emoji code of <code>program</code> into a more human readable version as a beginning. A dictionary of all operations is at the bottom of the code.</p>
|
||
<p>The first version of my script did not translate all emojis in the code. I started digging around further in <code>vm.py</code> to find some more emojis I had to consider. As a result a almost completely emoji free version of the program could be generated. The “final” version of my script <a href="https://git.goatpr0n.de/snippets/4">emoji2mnemonic.py</a> had the following dictionary to translate <code>program</code>.</p>
|
||
<div class="highlight"><pre style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-python" data-lang="python"> OPERATIONS <span style="color:#f92672">=</span> {
|
||
<span style="color:#e6db74">'🍡'</span>: <span style="color:#e6db74">'add'</span>,
|
||
<span style="color:#e6db74">'🤡'</span>: <span style="color:#e6db74">'clone'</span>,
|
||
<span style="color:#e6db74">'📐'</span>: <span style="color:#e6db74">'divide'</span>,
|
||
<span style="color:#e6db74">'😲'</span>: <span style="color:#e6db74">'if_zero'</span>,
|
||
<span style="color:#e6db74">'😄'</span>: <span style="color:#e6db74">'if_not_zero'</span>,
|
||
<span style="color:#e6db74">'🏀'</span>: <span style="color:#e6db74">'jump_to'</span>,
|
||
<span style="color:#e6db74">'🚛'</span>: <span style="color:#e6db74">'load'</span>,
|
||
<span style="color:#e6db74">'📬'</span>: <span style="color:#e6db74">'modulo'</span>,
|
||
<span style="color:#e6db74">'⭐'</span>: <span style="color:#e6db74">'multiply'</span>,
|
||
<span style="color:#e6db74">'🍿'</span>: <span style="color:#e6db74">'pop'</span>,
|
||
<span style="color:#e6db74">'📤'</span>: <span style="color:#e6db74">'pop_out'</span>,
|
||
<span style="color:#e6db74">'🎤'</span>: <span style="color:#e6db74">'print_top'</span>,
|
||
<span style="color:#e6db74">'📥'</span>: <span style="color:#e6db74">'push'</span>,
|
||
<span style="color:#e6db74">'🔪'</span>: <span style="color:#e6db74">'sub'</span>,
|
||
<span style="color:#e6db74">'🌓'</span>: <span style="color:#e6db74">'xor'</span>,
|
||
<span style="color:#e6db74">'⛰'</span>: <span style="color:#e6db74">'jump_top'</span>,
|
||
<span style="color:#e6db74">'⌛'</span>: <span style="color:#e6db74">'exit'</span>,
|
||
<span style="color:#e6db74">'✋'</span>: <span style="color:#e6db74">';'</span>,
|
||
<span style="color:#e6db74">'🥇'</span>: <span style="color:#e6db74">'[acc=1]'</span>,
|
||
<span style="color:#e6db74">'🥈'</span>: <span style="color:#e6db74">'[acc=2]'</span>,
|
||
<span style="color:#e6db74">'💰'</span>: <span style="color:#e6db74">'@'</span>,
|
||
<span style="color:#e6db74">'😐'</span>: <span style="color:#e6db74">'end_if'</span>,
|
||
<span style="color:#e6db74">'🖋'</span>: <span style="color:#e6db74">'func_'</span>,
|
||
<span style="color:#e6db74">'🏀'</span>: <span style="color:#e6db74">'BRK<'</span>,
|
||
<span style="color:#e6db74">'⛰'</span>: <span style="color:#e6db74">'BRK!'</span>,
|
||
|
||
<span style="color:#e6db74">'💠🔶🎌🚩🏁'</span>: <span style="color:#e6db74">'Label01'</span>,
|
||
<span style="color:#e6db74">'💠🏁🎌🔶🚩'</span>: <span style="color:#e6db74">'Label02'</span>,
|
||
<span style="color:#e6db74">'🚩💠🎌🔶🏁'</span>: <span style="color:#e6db74">'Label03'</span>,
|
||
<span style="color:#e6db74">'🏁🚩🎌💠🔶'</span>: <span style="color:#e6db74">'Label04'</span>,
|
||
<span style="color:#e6db74">'🔶🎌🚩💠🏁'</span>: <span style="color:#e6db74">'Label05'</span>,
|
||
<span style="color:#e6db74">'🎌🏁🚩🔶💠'</span>: <span style="color:#e6db74">'Label06'</span>,
|
||
<span style="color:#e6db74">'🔶🚩💠🏁🎌'</span>: <span style="color:#e6db74">'Label07'</span>,
|
||
<span style="color:#e6db74">'🚩🔶🏁🎌💠'</span>: <span style="color:#e6db74">'Label08'</span>,
|
||
<span style="color:#e6db74">'🎌🚩💠🔶🏁'</span>: <span style="color:#e6db74">'Label09'</span>,
|
||
<span style="color:#e6db74">'🎌🏁💠🔶🚩'</span>: <span style="color:#e6db74">'Label10'</span>,
|
||
<span style="color:#e6db74">'🏁💠🔶🚩🎌'</span>: <span style="color:#e6db74">'Label11'</span>,
|
||
<span style="color:#e6db74">'💠🎌🏁🚩🔶'</span>: <span style="color:#e6db74">'Label12'</span>,
|
||
|
||
<span style="color:#e6db74">'0️⃣ '</span>: <span style="color:#e6db74">'0'</span>,
|
||
<span style="color:#e6db74">'1️⃣ '</span>: <span style="color:#e6db74">'1'</span>,
|
||
<span style="color:#e6db74">'2️⃣ '</span>: <span style="color:#e6db74">'2'</span>,
|
||
<span style="color:#e6db74">'3️⃣ '</span>: <span style="color:#e6db74">'3'</span>,
|
||
<span style="color:#e6db74">'4️⃣ '</span>: <span style="color:#e6db74">'4'</span>,
|
||
<span style="color:#e6db74">'5️⃣ '</span>: <span style="color:#e6db74">'5'</span>,
|
||
<span style="color:#e6db74">'6️⃣ '</span>: <span style="color:#e6db74">'6'</span>,
|
||
<span style="color:#e6db74">'7️⃣ '</span>: <span style="color:#e6db74">'7'</span>,
|
||
<span style="color:#e6db74">'8️⃣ '</span>: <span style="color:#e6db74">'8'</span>,
|
||
<span style="color:#e6db74">'9️⃣ '</span>: <span style="color:#e6db74">'9'</span>,
|
||
}
|
||
</code></pre></div><p>The language for <code>vm.py</code> also knows labels for the <code>jump_to</code> operations and a symbol to distinguish between the accumulators to use.</p>
|
||
<p>A look at the translated source was a little bit more helpful. The example below shows a cleaned up, but shortened version of my interpretation of the syntax after translation.</p>
|
||
<pre><code>load \[acc=1\] 0;
|
||
push \[acc=1\]
|
||
load \[acc=1\] 17488;
|
||
push \[acc=1\]
|
||
load \[acc=1\] 16758;
|
||
push \[acc=1\]
|
||
load \[acc=1\] 16599;
|
||
push \[acc=1\]
|
||
load \[acc=1\] 16285;
|
||
...
|
||
push \[acc=1\]
|
||
load \[acc=2\] 1;
|
||
|
||
func Label01
|
||
pop \[acc=1\]
|
||
push \[acc=2\]
|
||
push \[acc=1\]
|
||
load \[acc=1\] 389;
|
||
push \[acc=1\]
|
||
push \[acc=2\]
|
||
jump_to $\[ Label04
|
||
xor
|
||
print_top
|
||
load \[acc=1\] 1;
|
||
push \[acc=1\]
|
||
add
|
||
pop \[acc=2\]
|
||
if\_not\_zero
|
||
jump_to $\[ Label01
|
||
end_if
|
||
...
|
||
</code></pre><p>To find out what each operation does, I looked at the source code of <code>vm.py</code>. The <code>load</code> instruction reads as follows: “Load accumulator1 with the immediate value 0”. With push the value stored in the accumulator1 is pushed to the stack. Other operations take the top two items from the stack to process them (addition, subtraction, multiplication, division, modulo, xor, …).</p>
|
||
<p>By only looking at the code I had no clue what was going on, but with all the jumps, I though about visualizing the program flow. I used my translated program and formatted the code to be a compatible <a href="https://www.graphviz.org/">Graphviz</a> <a href="https://git.goatpr0n.de/snippets/5">dot file</a>. The resulting graph was again a little bit more of an help.</p>
|
||
<p><img src="https://goatpr0n.farm/wp-content/uploads/2019/07/program.png" alt=""></p>
|
||
<p>Call graph of program</p>
|
||
<p>The graph shows a bunch of instructions to fill the stack of the VM. The right side has some more “complicated” instructions with modulo, division, xor, ….</p>
|
||
<p>When I see xor instructions, I often think of encryption and with multiplications and modulo instructions right next to it this though hardens.</p>
|
||
<p>But starring at the graph and the translated code did not help.</p>
|
||
<h3 id="solving-the-challenge-finally">Solving the Challenge: Finally</h3>
|
||
<p>It took me a while of starring until I realized, that I should try something else.</p>
|
||
<p>My next approach to solve this challenge was to write a trace log of the program execution step by step.</p>
|
||
<p>In each instruction function in <code>vm.py</code> I added some additional code to store the current status of the registers <code>self.instruction_pointer</code>, <code>self.accumulator1</code>, <code>self.accumulator2</code> and translated each operation into its human readable counter part. I also added (if possible) the parameters and the result of calculations.</p>
|
||
<pre><code>00000002 \[acc1=00000000\]\[acc2=00000000\]: load("acc1", 0)
|
||
00000006 \[acc1=00000000\]\[acc2=00000000\]: push(acc1) = 0
|
||
00000008 \[acc1=00017488\]\[acc2=00000000\]: load("acc1", 17488)
|
||
00000016 \[acc1=00017488\]\[acc2=00000000\]: push(acc1) = 17488
|
||
00000018 \[acc1=00016758\]\[acc2=00000000\]: load("acc1", 16758)
|
||
00000026 \[acc1=00016758\]\[acc2=00000000\]: push(acc1) = 16758
|
||
00000028 \[acc1=00016599\]\[acc2=00000000\]: load("acc1", 16599)
|
||
00000036 \[acc1=00016599\]\[acc2=00000000\]: push(acc1) = 16599
|
||
00000038 \[acc1=00016285\]\[acc2=00000000\]: load("acc1", 16285)
|
||
...
|
||
00000386 \[acc1=00000389\]\[acc2=00000001\]: push(acc2) = 1
|
||
00000388 \[acc1=00000389\]\[acc2=00000001\]: jump_to(Label04) @1040
|
||
00001041 \[acc1=00000002\]\[acc2=00000001\]: load("acc1", 2)
|
||
00001045 \[acc1=00000002\]\[acc2=00000001\]: push(acc1) = 2
|
||
00001048 \[acc1=00000002\]\[acc2=00000001\]: jump_to(Label08) @1098
|
||
00001099 \[acc1=00000002\]\[acc2=00000001\]: clone() = 2
|
||
00001100 \[acc1=00000002\]\[acc2=00000001\]: load("acc1", 2)
|
||
00001104 \[acc1=00000002\]\[acc2=00000001\]: push(acc1) = 2
|
||
00001107 \[acc1=00000002\]\[acc2=00000001\]: sub(b=2, a=2) = 0
|
||
00001108 \[acc1=00000002\]\[acc2=00000001\]: if_zero() = 0
|
||
00001109 \[acc1=00000002\]\[acc2=00000001\]: pop_out() // 0
|
||
00001110 \[acc1=00000001\]\[acc2=00000001\]: load("acc1", 1)
|
||
00001114 \[acc1=00000001\]\[acc2=00000001\]: push(acc1) = 1
|
||
00001115 \[acc1=00000001\]\[acc2=00000001\]: end_if = 🏀
|
||
00001115 \[acc1=00000001\]\[acc2=00000001\]: …cont… if_zero()
|
||
00001116 \[acc1=00000001\]\[acc2=00000001\]: jump_to(Label05) @1050
|
||
00001051 \[acc1=00000001\]\[acc2=00000001\]: if_zero() = 1
|
||
00001055 \[acc1=00000001\]\[acc2=00000001\]: end_if
|
||
00001057 \[acc1=00000001\]\[acc2=00000001\]: pop_out() // 1
|
||
...
|
||
</code></pre><p>There are still a few emojis left, but I did not care about them. With the trace log I could observe the program being executed and calculating the URL, or at least see the trace part where the <code>print_top</code> of the characters happens.</p>
|
||
<pre><code>00001076 \[acc1=00000002\]\[acc2=00000001\]: if_zero() = 0
|
||
00001077 \[acc1=00000002\]\[acc2=00000001\]: pop_out() // 0
|
||
00001078 \[acc1=00000002\]\[acc2=00000389\]: pop(acc2) = 389
|
||
00001080 \[acc1=00000002\]\[acc2=00000389\]: push(acc1) = 2
|
||
00001082 \[acc1=00000002\]\[acc2=00000389\]: push(acc2) = 389
|
||
00001083 \[acc1=00000002\]\[acc2=00000389\]: end_if = ⛰
|
||
00001083 \[acc1=00000002\]\[acc2=00000389\]: …cont… if_zero()
|
||
**00001084 \[acc1=00000002\]\[acc2=00000389\]: jump_top() @389
|
||
00000390 \[acc1=00000002\]\[acc2=00000389\]: xor(b=106, a=2) = 104**
|
||
00000391 \[acc1=00000002\]\[acc2=00000389\]: print_top("h")
|
||
00000392 \[acc1=00000001\]\[acc2=00000389\]: load("acc1", 1)
|
||
00000396 \[acc1=00000001\]\[acc2=00000389\]: push(acc1) = 1
|
||
00000398 \[acc1=00000001\]\[acc2=00000389\]: add(a=1, b=1) = 2
|
||
00000399 \[acc1=00000001\]\[acc2=00000002\]: pop(acc2) = 2
|
||
00000401 \[acc1=00000001\]\[acc2=00000002\]: if\_not\_zero() = 119
|
||
00000401 \[acc1=00000001\]\[acc2=00000002\]: end_if = 🏀
|
||
00000401 \[acc1=00000001\]\[acc2=00000002\]: …cont… if_zero()
|
||
00000402 \[acc1=00000001\]\[acc2=00000002\]: jump_to(Label01) @371
|
||
</code></pre><p>The <code>print_top</code> instruction takes the item from the top of the stack and prints it out. The stack only stores numbers, so the number is converted into a character before output. Right before the <code>print_top</code> is a <code>xor</code>.</p>
|
||
<p>The <code>xor</code> takes the two top items from the stack to get the result of ‘104’ which is the letter “h”. The number ‘106’ was pushed to the stack in the beginning, but where does the ‘2’ come from? This took be a while to find out. But only after letting the program run bit longer.</p>
|
||
<div class="highlight"><pre style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash">$ grep -A1 xor trace.log
|
||
<span style="color:#ae81ff">00000390</span> <span style="color:#ae81ff">\[</span>acc1<span style="color:#f92672">=</span>00000002<span style="color:#ae81ff">\]\[</span>acc2<span style="color:#f92672">=</span>00000389<span style="color:#ae81ff">\]</span>: xor<span style="color:#f92672">(</span>b<span style="color:#f92672">=</span>106, a<span style="color:#f92672">=</span>2<span style="color:#f92672">)</span> <span style="color:#f92672">=</span> <span style="color:#ae81ff">104</span>
|
||
<span style="color:#ae81ff">00000391</span> <span style="color:#ae81ff">\[</span>acc1<span style="color:#f92672">=</span>00000002<span style="color:#ae81ff">\]\[</span>acc2<span style="color:#f92672">=</span>00000389<span style="color:#ae81ff">\]</span>: print_top<span style="color:#f92672">(</span><span style="color:#e6db74">"h"</span><span style="color:#f92672">)</span>
|
||
<span style="color:#ae81ff">00000390</span> <span style="color:#ae81ff">\[</span>acc1<span style="color:#f92672">=</span>00000003<span style="color:#ae81ff">\]\[</span>acc2<span style="color:#f92672">=</span>00000389<span style="color:#ae81ff">\]</span>: xor<span style="color:#f92672">(</span>b<span style="color:#f92672">=</span>119, a<span style="color:#f92672">=</span>3<span style="color:#f92672">)</span> <span style="color:#f92672">=</span> <span style="color:#ae81ff">116</span>
|
||
<span style="color:#ae81ff">00000391</span> <span style="color:#ae81ff">\[</span>acc1<span style="color:#f92672">=</span>00000003<span style="color:#ae81ff">\]\[</span>acc2<span style="color:#f92672">=</span>00000389<span style="color:#ae81ff">\]</span>: print_top<span style="color:#f92672">(</span><span style="color:#e6db74">"t"</span><span style="color:#f92672">)</span>
|
||
<span style="color:#ae81ff">00000390</span> <span style="color:#ae81ff">\[</span>acc1<span style="color:#f92672">=</span>00000005<span style="color:#ae81ff">\]\[</span>acc2<span style="color:#f92672">=</span>00000389<span style="color:#ae81ff">\]</span>: xor<span style="color:#f92672">(</span>b<span style="color:#f92672">=</span>113, a<span style="color:#f92672">=</span>5<span style="color:#f92672">)</span> <span style="color:#f92672">=</span> <span style="color:#ae81ff">116</span>
|
||
<span style="color:#ae81ff">00000391</span> <span style="color:#ae81ff">\[</span>acc1<span style="color:#f92672">=</span>00000005<span style="color:#ae81ff">\]\[</span>acc2<span style="color:#f92672">=</span>00000389<span style="color:#ae81ff">\]</span>: print_top<span style="color:#f92672">(</span><span style="color:#e6db74">"t"</span><span style="color:#f92672">)</span>
|
||
<span style="color:#ae81ff">00000390</span> <span style="color:#ae81ff">\[</span>acc1<span style="color:#f92672">=</span>00000007<span style="color:#ae81ff">\]\[</span>acc2<span style="color:#f92672">=</span>00000389<span style="color:#ae81ff">\]</span>: xor<span style="color:#f92672">(</span>b<span style="color:#f92672">=</span>119, a<span style="color:#f92672">=</span>7<span style="color:#f92672">)</span> <span style="color:#f92672">=</span> <span style="color:#ae81ff">112</span>
|
||
<span style="color:#ae81ff">00000391</span> <span style="color:#ae81ff">\[</span>acc1<span style="color:#f92672">=</span>00000007<span style="color:#ae81ff">\]\[</span>acc2<span style="color:#f92672">=</span>00000389<span style="color:#ae81ff">\]</span>: print_top<span style="color:#f92672">(</span><span style="color:#e6db74">"p"</span><span style="color:#f92672">)</span>
|
||
<span style="color:#ae81ff">00000390</span> <span style="color:#ae81ff">\[</span>acc1<span style="color:#f92672">=</span>00000011<span style="color:#ae81ff">\]\[</span>acc2<span style="color:#f92672">=</span>00000389<span style="color:#ae81ff">\]</span>: xor<span style="color:#f92672">(</span>b<span style="color:#f92672">=</span>49, a<span style="color:#f92672">=</span>11<span style="color:#f92672">)</span> <span style="color:#f92672">=</span> <span style="color:#ae81ff">58</span>
|
||
<span style="color:#ae81ff">00000391</span> <span style="color:#ae81ff">\[</span>acc1<span style="color:#f92672">=</span>00000011<span style="color:#ae81ff">\]\[</span>acc2<span style="color:#f92672">=</span>00000389<span style="color:#ae81ff">\]</span>: print_top<span style="color:#f92672">(</span><span style="color:#e6db74">":"</span><span style="color:#f92672">)</span>
|
||
<span style="color:#ae81ff">00000390</span> <span style="color:#ae81ff">\[</span>acc1<span style="color:#f92672">=</span>00000101<span style="color:#ae81ff">\]\[</span>acc2<span style="color:#f92672">=</span>00000389<span style="color:#ae81ff">\]</span>: xor<span style="color:#f92672">(</span>b<span style="color:#f92672">=</span>74, a<span style="color:#f92672">=</span>101<span style="color:#f92672">)</span> <span style="color:#f92672">=</span> <span style="color:#ae81ff">47</span>
|
||
<span style="color:#ae81ff">00000391</span> <span style="color:#ae81ff">\[</span>acc1<span style="color:#f92672">=</span>00000101<span style="color:#ae81ff">\]\[</span>acc2<span style="color:#f92672">=</span>00000389<span style="color:#ae81ff">\]</span>: print_top<span style="color:#f92672">(</span><span style="color:#e6db74">"/"</span><span style="color:#f92672">)</span>
|
||
<span style="color:#ae81ff">00000390</span> <span style="color:#ae81ff">\[</span>acc1<span style="color:#f92672">=</span>00000131<span style="color:#ae81ff">\]\[</span>acc2<span style="color:#f92672">=</span>00000389<span style="color:#ae81ff">\]</span>: xor<span style="color:#f92672">(</span>b<span style="color:#f92672">=</span>172, a<span style="color:#f92672">=</span>131<span style="color:#f92672">)</span> <span style="color:#f92672">=</span> <span style="color:#ae81ff">47</span>
|
||
<span style="color:#ae81ff">00000391</span> <span style="color:#ae81ff">\[</span>acc1<span style="color:#f92672">=</span>00000131<span style="color:#ae81ff">\]\[</span>acc2<span style="color:#f92672">=</span>00000389<span style="color:#ae81ff">\]</span>: print_top<span style="color:#f92672">(</span><span style="color:#e6db74">"/"</span><span style="color:#f92672">)</span>
|
||
<span style="color:#ae81ff">00000390</span> <span style="color:#ae81ff">\[</span>acc1<span style="color:#f92672">=</span>00000151<span style="color:#ae81ff">\]\[</span>acc2<span style="color:#f92672">=</span>00000389<span style="color:#ae81ff">\]</span>: xor<span style="color:#f92672">(</span>b<span style="color:#f92672">=</span>242, a<span style="color:#f92672">=</span>151<span style="color:#f92672">)</span> <span style="color:#f92672">=</span> <span style="color:#ae81ff">101</span>
|
||
<span style="color:#ae81ff">00000391</span> <span style="color:#ae81ff">\[</span>acc1<span style="color:#f92672">=</span>00000151<span style="color:#ae81ff">\]\[</span>acc2<span style="color:#f92672">=</span>00000389<span style="color:#ae81ff">\]</span>: print_top<span style="color:#f92672">(</span><span style="color:#e6db74">"e"</span><span style="color:#f92672">)</span>
|
||
<span style="color:#ae81ff">00000390</span> <span style="color:#ae81ff">\[</span>acc1<span style="color:#f92672">=</span>00000181<span style="color:#ae81ff">\]\[</span>acc2<span style="color:#f92672">=</span>00000389<span style="color:#ae81ff">\]</span>: xor<span style="color:#f92672">(</span>b<span style="color:#f92672">=</span>216, a<span style="color:#f92672">=</span>181<span style="color:#f92672">)</span> <span style="color:#f92672">=</span> <span style="color:#ae81ff">109</span>
|
||
<span style="color:#ae81ff">00000391</span> <span style="color:#ae81ff">\[</span>acc1<span style="color:#f92672">=</span>00000181<span style="color:#ae81ff">\]\[</span>acc2<span style="color:#f92672">=</span>00000389<span style="color:#ae81ff">\]</span>: print_top<span style="color:#f92672">(</span><span style="color:#e6db74">"m"</span><span style="color:#f92672">)</span>
|
||
<span style="color:#ae81ff">00000390</span> <span style="color:#ae81ff">\[</span>acc1<span style="color:#f92672">=</span>00000191<span style="color:#ae81ff">\]\[</span>acc2<span style="color:#f92672">=</span>00000389<span style="color:#ae81ff">\]</span>: xor<span style="color:#f92672">(</span>b<span style="color:#f92672">=</span>208, a<span style="color:#f92672">=</span>191<span style="color:#f92672">)</span> <span style="color:#f92672">=</span> <span style="color:#ae81ff">111</span>
|
||
<span style="color:#ae81ff">00000391</span> <span style="color:#ae81ff">\[</span>acc1<span style="color:#f92672">=</span>00000191<span style="color:#ae81ff">\]\[</span>acc2<span style="color:#f92672">=</span>00000389<span style="color:#ae81ff">\]</span>: print_top<span style="color:#f92672">(</span><span style="color:#e6db74">"o"</span><span style="color:#f92672">)</span>
|
||
<span style="color:#ae81ff">00000390</span> <span style="color:#ae81ff">\[</span>acc1<span style="color:#f92672">=</span>00000313<span style="color:#ae81ff">\]\[</span>acc2<span style="color:#f92672">=</span>00000389<span style="color:#ae81ff">\]</span>: xor<span style="color:#f92672">(</span>b<span style="color:#f92672">=</span>339, a<span style="color:#f92672">=</span>313<span style="color:#f92672">)</span> <span style="color:#f92672">=</span> <span style="color:#ae81ff">106</span>
|
||
<span style="color:#ae81ff">00000391</span> <span style="color:#ae81ff">\[</span>acc1<span style="color:#f92672">=</span>00000313<span style="color:#ae81ff">\]\[</span>acc2<span style="color:#f92672">=</span>00000389<span style="color:#ae81ff">\]</span>: print_top<span style="color:#f92672">(</span><span style="color:#e6db74">"j"</span><span style="color:#f92672">)</span>
|
||
<span style="color:#ae81ff">00000390</span> <span style="color:#ae81ff">\[</span>acc1<span style="color:#f92672">=</span>00000353<span style="color:#ae81ff">\]\[</span>acc2<span style="color:#f92672">=</span>00000389<span style="color:#ae81ff">\]</span>: xor<span style="color:#f92672">(</span>b<span style="color:#f92672">=</span>264, a<span style="color:#f92672">=</span>353<span style="color:#f92672">)</span> <span style="color:#f92672">=</span> <span style="color:#ae81ff">105</span>
|
||
<span style="color:#ae81ff">00000391</span> <span style="color:#ae81ff">\[</span>acc1<span style="color:#f92672">=</span>00000353<span style="color:#ae81ff">\]\[</span>acc2<span style="color:#f92672">=</span>00000389<span style="color:#ae81ff">\]</span>: print_top<span style="color:#f92672">(</span><span style="color:#e6db74">"i"</span><span style="color:#f92672">)</span>
|
||
<span style="color:#ae81ff">00000390</span> <span style="color:#ae81ff">\[</span>acc1<span style="color:#f92672">=</span>00000373<span style="color:#ae81ff">\]\[</span>acc2<span style="color:#f92672">=</span>00000389<span style="color:#ae81ff">\]</span>: xor<span style="color:#f92672">(</span>b<span style="color:#f92672">=</span>344, a<span style="color:#f92672">=</span>373<span style="color:#f92672">)</span> <span style="color:#f92672">=</span> <span style="color:#ae81ff">45</span>
|
||
<span style="color:#ae81ff">00000391</span> <span style="color:#ae81ff">\[</span>acc1<span style="color:#f92672">=</span>00000373<span style="color:#ae81ff">\]\[</span>acc2<span style="color:#f92672">=</span>00000389<span style="color:#ae81ff">\]</span>: print_top<span style="color:#f92672">(</span><span style="color:#e6db74">"-"</span><span style="color:#f92672">)</span>
|
||
<span style="color:#ae81ff">00000390</span> <span style="color:#ae81ff">\[</span>acc1<span style="color:#f92672">=</span>00000383<span style="color:#ae81ff">\]\[</span>acc2<span style="color:#f92672">=</span>00000389<span style="color:#ae81ff">\]</span>: xor<span style="color:#f92672">(</span>b<span style="color:#f92672">=</span>267, a<span style="color:#f92672">=</span>383<span style="color:#f92672">)</span> <span style="color:#f92672">=</span> <span style="color:#ae81ff">116</span>
|
||
<span style="color:#ae81ff">00000391</span> <span style="color:#ae81ff">\[</span>acc1<span style="color:#f92672">=</span>00000383<span style="color:#ae81ff">\]\[</span>acc2<span style="color:#f92672">=</span>00000389<span style="color:#ae81ff">\]</span>: print_top<span style="color:#f92672">(</span><span style="color:#e6db74">"t"</span><span style="color:#f92672">)</span>
|
||
</code></pre></div><p>Again after a long round of starring at the output, it hit me. The argument <code>a</code> is always a prime number, but these are special primes. All primes are palindromes. The argument <code>b</code> is the value from the stack.</p>
|
||
<p>In my next step I wrote a script to calculate the palindrome primes and xor them with the values from the stack. I also discarded the idea to optimize the one of the components to solve this challenge.</p>
|
||
<p>As my final solution does not use the next code blocks anymore I will only highlight some ideas and problems I encountered.</p>
|
||
<p>I found a algorithm to calculate palindrome prime numbers on <a href="https://stackoverflow.com/questions/22699625/palindromic-prime-number-in-python">Stackoverflow</a> and modified it to my needs.</p>
|
||
<div class="highlight"><pre style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-python" data-lang="python"><span style="color:#66d9ef">def</span> <span style="color:#a6e22e">gen</span>\_pal\_prime(a, b):
|
||
<span style="color:#66d9ef">for</span> i <span style="color:#f92672">in</span> range(a, b):
|
||
y <span style="color:#f92672">=</span> True
|
||
<span style="color:#66d9ef">if</span> str(i) <span style="color:#f92672">==</span> str(i)\[::<span style="color:#f92672">-</span><span style="color:#ae81ff">1</span>\]:
|
||
<span style="color:#66d9ef">if</span>(i <span style="color:#f92672">></span> <span style="color:#ae81ff">2</span>):
|
||
<span style="color:#66d9ef">for</span> a <span style="color:#f92672">in</span> range(<span style="color:#ae81ff">2</span>, i):
|
||
<span style="color:#66d9ef">if</span> i <span style="color:#f92672">%</span> a <span style="color:#f92672">==</span> <span style="color:#ae81ff">0</span>:
|
||
y <span style="color:#f92672">=</span> False
|
||
<span style="color:#66d9ef">break</span>
|
||
<span style="color:#66d9ef">if</span> y:
|
||
<span style="color:#66d9ef">yield</span> i
|
||
|
||
palindromes <span style="color:#f92672">=</span> \[_ <span style="color:#66d9ef">for</span> _ <span style="color:#f92672">in</span> gen\_pal\_prime(<span style="color:#ae81ff">0</span>, <span style="color:#ae81ff">999999</span>)\]
|
||
</code></pre></div><p>The problem with this was, depending on the second parameter it takes a long time to calculate all primes and the other problem was, it did not work. Or it stopped working after the 39th character.</p>
|
||
<p>The algorithm failed to calculate the correct xor value for ‘93766’. As the string read until it broke “<a href="http://emoji-t0anaxnr3nacpt4na.web.ctfco">http://emoji-t0anaxnr3nacpt4na.web.ctfco</a>” my guess was, that the next character has to be a ‘m’ (ctfcompetition).</p>
|
||
<p>Brute forcing the prime number for ‘93766’ returned ‘93739’. What left me puzzled again. The previous prime number was ‘17471’. So I split up the whole blocks of pushing numbers to the stack into three blocks.</p>
|
||
<pre><code>+-----------+-----------+-----------+
|
||
| Block 1 | Block 2 | Block3 |
|
||
+-----------+-----------+-----------+
|
||
| 17488 | 98426 | 101141058 |
|
||
| 16758 | 97850 | 101060206 |
|
||
| 16599 | 97604 | 101030055 |
|
||
| 16285 | 97280 | 100998966 |
|
||
| 16094 | 96815 | 100887990 |
|
||
| 15505 | 96443 | 100767085 |
|
||
| 15417 | 96354 | 100707036 |
|
||
| 14832 | 95934 | 100656111 |
|
||
| 14450 | 94865 | 100404094 |
|
||
| 13893 | 94952 | 100160922 |
|
||
| 13926 | 94669 | 100131019 |
|
||
| 13437 | 94440 | 100111100 |
|
||
| 12833 | 93969 | 100059926 |
|
||
| 12741 | 93766 | 100049982 |
|
||
| 12533 | 99 | 100030045 |
|
||
| 11504 | | 9989997 |
|
||
| 11342 | | 9981858 |
|
||
| 10503 | | 9980815 |
|
||
| 10550 | | 9978842 |
|
||
| 10319 | | 9965794 |
|
||
| 975 | | 9957564 |
|
||
| 1007 | | 9938304 |
|
||
| 892 | | 9935427 |
|
||
| 893 | | 9932289 |
|
||
| 660 | | 9931494 |
|
||
| 743 | | 9927388 |
|
||
| 267 | | 9926376 |
|
||
| 344 | | 9923213 |
|
||
| 264 | | 9921394 |
|
||
| 339 | | 9919154 |
|
||
| 208 | | 9918082 |
|
||
| 216 | | 9916239 |
|
||
| 242 | | 765 |
|
||
| 172 | | |
|
||
| 74 | | |
|
||
| 49 | | |
|
||
| 119 | | |
|
||
| 113 | | |
|
||
| 119 | | |
|
||
| 106 | | |
|
||
| 1 | | |
|
||
+-----------+-----------+-----------+
|
||
</code></pre><p>The purpose of the last number of each block opened up to me, when I finally found the correct prime for the third block. To decode the correct URL I ignored these numbers (‘1’, ‘99’, ‘765’) and started building special cases into my decoding function.</p>
|
||
<p>The code below almost worked fine. Each block would be separately being decoded, after a certain number of iterations (<code>i</code>). I tried to make some sense of these numbers at the bottom of each block.</p>
|
||
<div class="highlight"><pre style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-python" data-lang="python"><span style="color:#66d9ef">print</span>(<span style="color:#e6db74">'Palindrome Primes #1'</span>)
|
||
palindromes1 <span style="color:#f92672">=</span> \[_ <span style="color:#66d9ef">for</span> _ <span style="color:#f92672">in</span> gen\_pal\_prime(<span style="color:#ae81ff">1</span>, <span style="color:#ae81ff">18000</span>)\]
|
||
palindromes1<span style="color:#f92672">.</span>insert(<span style="color:#ae81ff">0</span>, <span style="color:#ae81ff">2</span>) <span style="color:#75715e"># manually add the number 2.</span>
|
||
<span style="color:#66d9ef">print</span>(<span style="color:#e6db74">'Palindrome Primes #2'</span>)
|
||
palindromes2 <span style="color:#f92672">=</span> \[_ <span style="color:#66d9ef">for</span> _ <span style="color:#f92672">in</span> gen\_pal\_prime(<span style="color:#ae81ff">93766</span> <span style="color:#f92672">-</span> <span style="color:#ae81ff">99</span>, <span style="color:#ae81ff">999999</span>)\]
|
||
<span style="color:#66d9ef">print</span>(<span style="color:#e6db74">'Palindrome Primes #3'</span>)
|
||
palindromes3 <span style="color:#f92672">=</span> \[_ <span style="color:#66d9ef">for</span> _ <span style="color:#f92672">in</span> gen\_pal\_prime(<span style="color:#ae81ff">9916239</span> <span style="color:#f92672">-</span> <span style="color:#ae81ff">765</span>, <span style="color:#ae81ff">19916239</span>)\]
|
||
|
||
palindromes <span style="color:#f92672">=</span> palindromes1
|
||
stack<span style="color:#f92672">.</span>reverse()
|
||
<span style="color:#66d9ef">for</span> i, val <span style="color:#f92672">in</span> enumerate(stack):
|
||
<span style="color:#66d9ef">if</span> i <span style="color:#f92672">==</span> <span style="color:#ae81ff">40</span>:
|
||
mode <span style="color:#f92672">=</span> <span style="color:#e6db74">'stack2'</span>
|
||
palindromes <span style="color:#f92672">=</span> palindromes2
|
||
<span style="color:#66d9ef">if</span> mode <span style="color:#f92672">==</span> <span style="color:#e6db74">'stack2'</span>:
|
||
i <span style="color:#f92672">-=</span> <span style="color:#ae81ff">40</span>
|
||
<span style="color:#66d9ef">if</span> i <span style="color:#f92672">==</span> <span style="color:#ae81ff">14</span>:
|
||
mode <span style="color:#f92672">=</span> <span style="color:#e6db74">'stack3'</span>
|
||
palindromes <span style="color:#f92672">=</span> palindromes3
|
||
<span style="color:#66d9ef">if</span> mode <span style="color:#f92672">==</span> <span style="color:#e6db74">'stack3'</span>:
|
||
i <span style="color:#f92672">-=</span> <span style="color:#ae81ff">13</span>
|
||
c <span style="color:#f92672">=</span> val <span style="color:#f92672">^</span> palindromes\[i\]
|
||
<span style="color:#66d9ef">print</span>(f<span style="color:#e6db74">'{i:<8d}| {val:8d} ^ {palindromes\[i\]:<8} = {c:3d}'</span>, chr(c))
|
||
</code></pre></div><p>While my program ran, I encountered yet again a problem but this time during decoding the third block of numbers. The calculation of my palindrome primes took quite some time and did not result in printable/human readable characters.</p>
|
||
<p>Talking to a colleague of mine, he came up with the idea to look up lists of precalculated prime numbers and I found a website which provides lists of the first 2 billion prime numbers as downloadable files.</p>
|
||
<p>The site <a href="http://www.primos.mat.br/2T_en.html">http://www.primos.mat.br/2T_en.html</a> provides individual compressed text files, with 10 million primes each file. For this challenge the prime numbers from 2 to 179424673 should suffice.</p>
|
||
<p>After decompressing the file I had to convert the file from columns separated by tabs to a easier to read format for my Python programs. To remove the columns and only have one prime per line I used the program <code>tr</code>.</p>
|
||
<div class="highlight"><pre style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash">$ tr <span style="color:#e6db74">'\\t'</span> <span style="color:#e6db74">'\\n'</span> < 2T_part1.txt > primes.txt
|
||
</code></pre></div><p>I wrote a function to read this file to only return the palindrome primes as a list. The <code>str(_.rstrip()) == str(_.rstrip())[::-1]</code> part of the condition will check if the number is a palindrome, by comparing the number as string against it reversed counterpart.</p>
|
||
<div class="highlight"><pre style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-python" data-lang="python"><span style="color:#66d9ef">def</span> <span style="color:#a6e22e">load_primes</span>(filename):
|
||
<span style="color:#66d9ef">with</span> open(filename, <span style="color:#e6db74">'rt'</span>) <span style="color:#66d9ef">as</span> handle:
|
||
<span style="color:#66d9ef">return</span> \[int(_) <span style="color:#66d9ef">for</span> _ <span style="color:#f92672">in</span> handle<span style="color:#f92672">.</span>readlines()
|
||
<span style="color:#66d9ef">if</span> str(_<span style="color:#f92672">.</span>rstrip()) <span style="color:#f92672">==</span> str(_<span style="color:#f92672">.</span>rstrip())\[::<span style="color:#f92672">-</span><span style="color:#ae81ff">1</span>\]\]
|
||
</code></pre></div><p>With this list of palindrome primes I wrote a short brute force solution to find the correct prime number to decode the third block, or to be more precise, where in this list of primes can I find it.</p>
|
||
<p>As a constraint I iterated through all primes until the prime <code>p</code> from <code>primes</code> is greater than the number (‘9916239’) I am looking for. Then I know, that my prime had to be within the first 765 primes.</p>
|
||
<div class="highlight"><pre style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-python" data-lang="python"><span style="color:#f92672">>></span>\<span style="color:#f92672">></span> primes <span style="color:#f92672">=</span> solver<span style="color:#f92672">.</span>load_primes(<span style="color:#e6db74">'primes.txt'</span>)
|
||
<span style="color:#f92672">>></span>\<span style="color:#f92672">></span> <span style="color:#66d9ef">for</span> i, p <span style="color:#f92672">in</span> enumerate(primes):
|
||
<span style="color:#f92672">...</span> <span style="color:#66d9ef">if</span> p <span style="color:#f92672">></span> <span style="color:#ae81ff">9916239</span>:
|
||
<span style="color:#f92672">...</span> <span style="color:#66d9ef">print</span>(i)
|
||
<span style="color:#f92672">...</span> <span style="color:#66d9ef">break</span>
|
||
<span style="color:#f92672">...</span>
|
||
<span style="color:#ae81ff">765</span>
|
||
</code></pre></div><p>At this point the 3 numbers I could not figure out until now, now made sense. These are the n-th number prime from a list of consecutive palindrome primes. The first block begins at the the 1st prime from my list of primes, the second block begins at the 99th prime number and the third block at the 765th prime number from my list.</p>
|
||
<p>And now it also makes sense, why <code>program</code> becomes slower with each iteration. The code block (see the call graph above) calculates palindrome prime numbers, which becomes more and more of a problem regarding performance when it hits greater numbers.</p>
|
||
<p>How does my final solution look like? I wrote a script called <code>solver.py</code>, put all numbers from all three blocks into a single list and wrote my decryption function.</p>
|
||
<div class="highlight"><pre style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-python" data-lang="python"><span style="color:#75715e">#! /usr/bin/env python</span>
|
||
<span style="color:#75715e">#\-\*\- coding: utf-8 -*-</span>
|
||
|
||
stack <span style="color:#f92672">=</span> \[<span style="color:#ae81ff">101141058</span>, <span style="color:#ae81ff">101060206</span>, <span style="color:#ae81ff">101030055</span>, <span style="color:#ae81ff">100998966</span>, <span style="color:#ae81ff">100887990</span>,
|
||
<span style="color:#ae81ff">100767085</span>, <span style="color:#ae81ff">100707036</span>, <span style="color:#ae81ff">100656111</span>, <span style="color:#ae81ff">100404094</span>, <span style="color:#ae81ff">100160922</span>,
|
||
<span style="color:#ae81ff">100131019</span>, <span style="color:#ae81ff">100111100</span>, <span style="color:#ae81ff">100059926</span>, <span style="color:#ae81ff">100049982</span>, <span style="color:#ae81ff">100030045</span>,
|
||
<span style="color:#ae81ff">9989997</span>, <span style="color:#ae81ff">9981858</span>, <span style="color:#ae81ff">9980815</span>, <span style="color:#ae81ff">9978842</span>, <span style="color:#ae81ff">9965794</span>, <span style="color:#ae81ff">9957564</span>,
|
||
<span style="color:#ae81ff">9938304</span>, <span style="color:#ae81ff">9935427</span>, <span style="color:#ae81ff">9932289</span>, <span style="color:#ae81ff">9931494</span>, <span style="color:#ae81ff">9927388</span>, <span style="color:#ae81ff">9926376</span>,
|
||
<span style="color:#ae81ff">9923213</span>, <span style="color:#ae81ff">9921394</span>, <span style="color:#ae81ff">9919154</span>, <span style="color:#ae81ff">9918082</span>, <span style="color:#ae81ff">9916239</span>, <span style="color:#75715e"># Block 3</span>
|
||
<span style="color:#ae81ff">98426</span>, <span style="color:#ae81ff">97850</span>, <span style="color:#ae81ff">97604</span>, <span style="color:#ae81ff">97280</span>, <span style="color:#ae81ff">96815</span>, <span style="color:#ae81ff">96443</span>, <span style="color:#ae81ff">96354</span>, <span style="color:#ae81ff">95934</span>,
|
||
<span style="color:#ae81ff">94865</span>, <span style="color:#ae81ff">94952</span>, <span style="color:#ae81ff">94669</span>, <span style="color:#ae81ff">94440</span>, <span style="color:#ae81ff">93969</span>, <span style="color:#ae81ff">93766</span>, <span style="color:#75715e"># Block 2</span>
|
||
<span style="color:#ae81ff">17488</span>, <span style="color:#ae81ff">16758</span>, <span style="color:#ae81ff">16599</span>, <span style="color:#ae81ff">16285</span>, <span style="color:#ae81ff">16094</span>, <span style="color:#ae81ff">15505</span>, <span style="color:#ae81ff">15417</span>, <span style="color:#ae81ff">14832</span>,
|
||
<span style="color:#ae81ff">14450</span>, <span style="color:#ae81ff">13893</span>, <span style="color:#ae81ff">13926</span>, <span style="color:#ae81ff">13437</span>, <span style="color:#ae81ff">12833</span>, <span style="color:#ae81ff">12741</span>, <span style="color:#ae81ff">12533</span>, <span style="color:#ae81ff">11504</span>,
|
||
<span style="color:#ae81ff">11342</span>, <span style="color:#ae81ff">10503</span>, <span style="color:#ae81ff">10550</span>, <span style="color:#ae81ff">10319</span>, <span style="color:#ae81ff">975</span>, <span style="color:#ae81ff">1007</span>, <span style="color:#ae81ff">892</span>, <span style="color:#ae81ff">893</span>, <span style="color:#ae81ff">660</span>,
|
||
<span style="color:#ae81ff">743</span>, <span style="color:#ae81ff">267</span>, <span style="color:#ae81ff">344</span>, <span style="color:#ae81ff">264</span>, <span style="color:#ae81ff">339</span>, <span style="color:#ae81ff">208</span>, <span style="color:#ae81ff">216</span>, <span style="color:#ae81ff">242</span>, <span style="color:#ae81ff">172</span>, <span style="color:#ae81ff">74</span>, <span style="color:#ae81ff">49</span>, <span style="color:#ae81ff">119</span>,
|
||
<span style="color:#ae81ff">113</span>, <span style="color:#ae81ff">119</span>, <span style="color:#ae81ff">106</span>\] <span style="color:#75715e"># Block 1</span>
|
||
|
||
|
||
<span style="color:#66d9ef">def</span> <span style="color:#a6e22e">load_primes</span>(filename):
|
||
<span style="color:#66d9ef">with</span> open(filename, <span style="color:#e6db74">'rt'</span>) <span style="color:#66d9ef">as</span> handle:
|
||
<span style="color:#66d9ef">return</span> \[int(_) <span style="color:#66d9ef">for</span> _ <span style="color:#f92672">in</span> handle<span style="color:#f92672">.</span>readlines()
|
||
<span style="color:#66d9ef">if</span> str(_<span style="color:#f92672">.</span>rstrip()) <span style="color:#f92672">==</span> str(_<span style="color:#f92672">.</span>rstrip())\[::<span style="color:#f92672">-</span><span style="color:#ae81ff">1</span>\]\]
|
||
|
||
|
||
<span style="color:#66d9ef">if</span> \_\_name\_\_ <span style="color:#f92672">==</span> <span style="color:#e6db74">'\_\_main\_\_'</span>:
|
||
palindromes <span style="color:#f92672">=</span> load_primes(<span style="color:#e6db74">'primes.txt'</span>)
|
||
stack<span style="color:#f92672">.</span>reverse()
|
||
offset <span style="color:#f92672">=</span> <span style="color:#ae81ff">0</span>
|
||
<span style="color:#66d9ef">for</span> i, val <span style="color:#f92672">in</span> enumerate(stack):
|
||
<span style="color:#66d9ef">if</span> i <span style="color:#f92672">==</span> <span style="color:#ae81ff">40</span>:
|
||
offset <span style="color:#f92672">=</span> <span style="color:#ae81ff">98</span> <span style="color:#f92672">-</span> <span style="color:#ae81ff">40</span>
|
||
<span style="color:#66d9ef">if</span> i <span style="color:#f92672">==</span> <span style="color:#ae81ff">54</span>:
|
||
offset <span style="color:#f92672">=</span> <span style="color:#ae81ff">764</span> <span style="color:#f92672">-</span> <span style="color:#ae81ff">54</span>
|
||
c <span style="color:#f92672">=</span> val <span style="color:#f92672">^</span> palindromes\[i <span style="color:#f92672">+</span> offset\]
|
||
<span style="color:#66d9ef">print</span>(chr(c), end<span style="color:#f92672">=</span><span style="color:#e6db74">''</span>)
|
||
<span style="color:#66d9ef">print</span>()
|
||
</code></pre></div><p>Running this script will produce the URL “<code>http://emoji-t0anaxnr3nacpt4na.web.ctfcompetition.com/humans_and_cauliflowers_network/</code>”. Visiting this URL gives a choice for three sub pages of different people. The flag is stored in the personal page of Amber within a picture. The flag reads “<code>CTF{Peace_from_Cauli!}</code>”.</p>
|
||
<h2 id="lessons-learned">Lessons learned</h2>
|
||
<p>Doing CTFs sometimes require you to think out of the box and/or ignore the first possible solutions which might seem to be the obvious ones, but might lead you nowhere or are just there to keep you side tracked.</p>
|
||
<p>This challenge first got me thinking about modifying and changing the behavior of the provided files <code>program</code> and <code>vm.py</code>. While working through the challenge, which kept me busy for quite some time, I found a different solution.</p>
|
||
<p>The previous tries to solve this challenge were not for nothing, especially the addition of my trace log addition, which finally helped me understanding the problem and getting my on the right track to the solution.</p>
|
||
|
||
<h4><a href="https://goatpr0n.farm/">Back to Home</a></h4>
|
||
</div>
|
||
|
||
|
||
</div><footer class="container">
|
||
<hr class="soften">
|
||
<p>
|
||
©
|
||
|
||
Julian Knauer
|
||
|
||
<span id="thisyear">2020</span>
|
||
|
||
</p>
|
||
<p class="text-center">
|
||
|
||
|
||
|
||
|
||
|
||
</p>
|
||
</footer>
|
||
|
||
<script src="/js/jquery.js"></script>
|
||
<script src="/js/bootstrap-386.js"></script>
|
||
<script src="/js/bootstrap-transition.js"></script>
|
||
<script src="/js/bootstrap-alert.js"></script>
|
||
<script src="/js/bootstrap-modal.js"></script>
|
||
<script src="/js/bootstrap-dropdown.js"></script>
|
||
<script src="/js/bootstrap-scrollspy.js"></script>
|
||
<script src="/js/bootstrap-tab.js"></script>
|
||
<script src="/js/bootstrap-tooltip.js"></script>
|
||
<script src="/js/bootstrap-popover.js"></script>
|
||
<script src="/js/bootstrap-button.js"></script>
|
||
<script src="/js/bootstrap-collapse.js"></script>
|
||
<script src="/js/bootstrap-carousel.js"></script>
|
||
<script src="/js/bootstrap-typeahead.js"></script>
|
||
<script src="/js/bootstrap-affix.js"></script>
|
||
<script>
|
||
_386 = {
|
||
fastLoad: false ,
|
||
onePass: false ,
|
||
speedFactor: 1
|
||
};
|
||
|
||
|
||
function ThisYear() {
|
||
document.getElementById('thisyear').innerHTML = new Date().getFullYear();
|
||
};
|
||
</script></body>
|
||
</html>
|