HGAME2018 - Week 4 writeup

<?php
    error_reporting(0);
    include("sql.php");
    $waf="/(union|group by|=|>|<|hex| |lower|strcmp|updatexml|xmlelement|extractvalue|concat|bin|sleep|mid\(|substr|left|ascii|\/\*|\*\/)/i";
    if(isset($_GET['user'])){
        if(preg_match_all($waf,$_GET['user'])!=0){
            $user="admin";
        }else{
            $user = str_replace("'","\'",$_GET['user']);
        }
        //echo $user."<br>";
        $sqli = new mysqli($host,$username,$passwd,$database);
        $sqli->set_charset("gbk");
        $query="select * from users where username='".$user."'";
        $result = $sqli->query($query);
        //echo $sqli->error;
        $num=0;
        @$num = $result->num_rows;
        if($num>0){
            while($row = $result->fetch_row()){
                echo $row[0]."&nbsp;&nbsp;&nbsp;&nbsp;".$row[1]."&nbsp;&nbsp;&nbsp;".$row[2]."<br>";
            }
        }
    }

$ git log
# ...[OMITTED]...
commit 18c294dc7b3dbb82d8d52e7aa84de0a66a1bf88f
Author: week4 <[REDACTED]>
Date:   Sun Feb 25 06:52:02 2018 +0000

    Revert "add php"

    This reverts commit 39f5ffd3d4fdd124bc93f52d72f561817b6f8fd9.

commit 39f5ffd3d4fdd124bc93f52d72f561817b6f8fd9
Author: week4 <[REDACTED]>
Date:   Sun Feb 25 06:51:57 2018 +0000

    add php
# ...[OMITTED]...
$ git reset --hard 39f5ffd3d4fdd124bc93f52d72f561817b6f8fd9
HEAD is now at 39f5ffd add php

import itertools
import requests
import re

response = requests.get('http://www.bixinshui.com/city/12').content
prefixes = re.findall(r'>(\d{7})<', response)

dic = open('dic.txt', 'a')
suffixes = list(itertools.product('0123456789', repeat=4))

for i in prefixes:
    for j in suffixes:
        number = i + ''.join(j)
        print(number)
        dic.write(number + '\n')

dic.close()

from PIL import Image
import base64
import cStringIO
import urllib
import requests
import json
import random

r = requests.Session()
r.headers.update({'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36'})
url = 'http://[REDACTED]/sojbezcaptcha?token='
token = random.randint(0, 100)

while 1:
    while 1:
        response = r.get(url + token, headers=headers).content
        if 'Error' not in response:
            break
    imgstring = json.loads(response)['captcha_png_base64']
    pic = cStringIO.StringIO()
    image_string = cStringIO.StringIO(base64.b64decode(imgstring))
    image = Image.open(image_string).resize((20, 30), Image.ANTIALIAS)
    buffer = cStringIO.StringIO()
    image.save(buffer, format='PNG')
    postData = urllib.urlencode({'access_token': '[REDACTED]', 'image': base64.b64encode(buffer.getvalue())})
    response = requests.post('https://aip.baidubce.com/rest/2.0/ocr/v1/general_basic', verify=False, headers={'Content-Type': 'application/x-www-form-urlencoded'}, data=postData).content
    captcha = json.loads(response)['words_result'][0]['words']
    print(captcha)
    while 1:
        response = r.get(url + token + '&submit=' + captcha, headers=headers).content
        if 'Error' not in response:
            break
    print(response)
    if json.loads(response)['flag'] != None:
        break

from libnum import *

n = '...[OMITTED]...'
g = '...[OMITTED]...'
c = '...[OMITTED]...'

sols = {(0, 0)}

for m in range(1111):
    sols2 = set()
    mask = (2 << m) - 1

    for p, q in sols:
        if p * q == n:
            d = invmod(65537, (p - 1) * (q - 1))
            print(n2s(pow(c, d, n)))
            quit()

        for bp in range(2):
            for bq in range(2):
                pp = p + (bp << m)
                qq = q + (bq << m)

                if (pp * qq) & mask != n & mask:
                    continue
                gg = (pp * qq) - (pp ^ qq)
                if gg & mask != g & mask:
                    continue
                sols2.add((pp, qq))

    sols = sols2