HGAME2019 - Week 2 writeup

<?php
//admin.php
highlight_file(__FILE__);
$str1 = (string)@$_GET['str1'];
$str2 = (string)@$_GET['str2'];
$str3 = @$_GET['str3'];
$str4 = @$_GET['str4'];
$str5 = @$_GET['H_game'];
$url = @$_GET['url'];
if( $str1 == $str2 ){
    die('step 1 fail');
}
if( md5($str1) != md5($str2) ){
    die('step 2 fail');
}
if( $str3 == $str4 ){
    die('step 3 fail');
}
if ( md5($str3) !== md5($str4)){
    die('step 4 fail');
}
if (strpos($_SERVER['QUERY_STRING'], "H_game") !==false) {
    die('step 5 fail');
}
if(is_numeric($str5)){
    die('step 6 fail');
}
if ($str5<9999999999){
    die('step 7 fail');
}
if ((string)$str5>0){
    die('step 8 fial');
}
if (parse_url($url, PHP_URL_HOST) !== "www.baidu.com"){
    die('step 9 fail');
}
if (parse_url($url,PHP_URL_SCHEME) !== "http"){
    die('step 10 fail');
}
$ch = curl_init();
curl_setopt($ch,CURLOPT_URL,$url);
$output = curl_exec($ch);
curl_close($ch);
if($output === FALSE){
    die('step 11 fail');
}
else{
    echo $output;
}

<?php  

include 'secret.php'; 

#echo $flag; 
#echo $secret; 

if (empty($_POST['gate']) || empty($_POST['key'])) { 
    highlight_file(__FILE__); 
    exit; 
} 

if (isset($_POST['door'])){ 
    $secret = hash_hmac('sha256', $_POST['door'], $secret); 
} 

$gate = hash_hmac('sha256', $_POST['key'], $secret); 

if ($gate !== $_POST['gate']) { 
    echo "Hacker GetOut!!"; 
    exit; 
} 

if ((md5($_POST['key'])+1) == (md5(md5($_POST['key'])))+1) { 
    echo "Wow!!!"; 
    echo "</br>"; 
    echo $flag; 
} 
else { 
    echo "Hacker GetOut!!"; 
} 

?> 

import requests
import re

arialiMap = ['1', '0', '2', '6', '9', '4', '3', '5', '8', '7']
questionPattern = re.compile(r'<div\s+class="question-container"><span>([^<]*)</span></div>')
questionPatternForStyleSheet = re.compile(r'content:"([^"]*)";')

r = requests.Session()
r.headers.update({'User-Agent': 'Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)'})

r.get('http://[REDACTED]/')
response = r.post('http://[REDACTED]/', data={'token': '3rWm1tMecTNfiWdP7IxE840CQq9TVQip'})

questionNumber = 1

while True:
    styleSheet = r.get('http://[REDACTED]/statics/style.css').text
    question = questionPattern.findall(response.text)

    if questionNumber < 11:
        question = question[0].strip('=?')

    elif 10 < questionNumber < 21:
        question = question[0].strip('=?')
        question = list(question)
        for i in range(len(question)):
            if 47 < ord(question[i]) < 58:
                question[i] = arialiMap[int(question[i])]
        question = ''.join(question)

    elif 20 < questionNumber < 31:
        question = questionPatternForStyleSheet.findall(styleSheet)[0].strip('=?')

    else:
        print(response.text)
        break

    answer = str(eval(question))
    print('No. %d\tQuestion: %s\tAnswer: %s' % (questionNumber, question, answer))
    questionNumber = questionNumber + 1
    response = r.post('http://[REDACTED]/solution', data={'answer': answer})

$ python2
>>> import marshal, dis
>>> with open('third.pyc', 'rb') as f:
...     f.seek(8)
...     code = marshal.load(f)
>>> dis.dis(code)
  2           0 JUMP_ABSOLUTE            3
        >>    3 JUMP_ABSOLUTE            9
              6 LOAD_CONST              15 ("You're Wrong! ")
        >>    9 JUMP_ABSOLUTE           14

  3          12 PRINT_ITEM
             13 LOAD_CONST             100
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "C:\python2\lib\dis.py", line 43, in dis
    disassemble(x)
  File "C:\python2\lib\dis.py", line 95, in disassemble
    print '(' + repr(co.co_consts[oparg]) + ')',
IndexError: tuple index out of range

#!/usr/bin/env python2
import string

letters = list(string.letters) + list(string.digits) + ['+', '/']
dec = 'FcjTCgD1EffEm2rPC3bTyL5Wu2bKBI9KAZrwFgrUygHN'

def encode(input_str):
    global letters
    str_ascii_list = ['{:0>8}'.format(str(bin(ord(i)))).replace('0b', '') for i in input_str]
    output_str = ''
    equal_num = 0
    while str_ascii_list:
        temp_list = str_ascii_list[:3]
        if len(temp_list) != 3:
            while len(temp_list) < 3:
                equal_num = equal_num + 1
                temp_list += ['00000000']
        temp_str = ''.join(temp_list)
        temp_str_list = [temp_str[x:x+6] for x in [0, 6, 12, 18]]
        temp_str_list = [int(x, 2) for x in temp_str_list]
        if equal_num:
            temp_str_list = temp_str_list[0:4 - equal_num]
        output_str += ''.join([letters[x] for x in temp_str_list])
        str_ascii_list = str_ascii_list[3:]
    output_str = output_str + '=' * equal_num
    return output_str

print("Welcome to Processor's Python Classroom Part 3&4!\n")
print('qi shi wo jiu shi lan cai ba liang dao ti fang zai yi qi.')
print("Now let's start the origin of Python!\n")
print('Plz Input Your Flag:\n')

enc = raw_input()
lst = list(enc)
lst.reverse()
llen = len(lst)

for i in range(llen):
    if i % 2 == 0:
        lst[i] = chr(ord(lst[i]) - 2)
    lst[i] = chr(ord(lst[i]) + 1)

enc2 = ''
enc2 = enc2.join(lst)
enc3 = encode(enc2)

if enc3 == dec:
    print("You're right! ")
else:
    print("You're wrong! ")

#!/usr/bin/env python2
import string
from base64 import b64decode

dec = 'FcjTCgD1EffEm2rPC3bTyL5Wu2bKBI9KAZrwFgrUygHN'

standard_alphabet = string.ascii_uppercase + string.ascii_lowercase + string.digits + '+/'
custom_alphabet = string.letters + string.digits + '+/'
decode_trans = string.maketrans(custom_alphabet, standard_alphabet)

enc2 = b64decode(dec.translate(decode_trans))
lst = list(enc2)
lst.reverse()

for i in range(len(lst)):
    lst[i] = chr(ord(lst[i]) - 1)
    if i % 2 == 0:
        lst[i] = chr(ord(lst[i]) + 2)

print(''.join(lst))

print "Welcome to Processor's Python Classroom Part 2!\n"
print "Now let's start the origin of Python!\n"
print 'Plz Input Your Flag:\n'
enc = raw_input()
len = len(enc)
enc1 = []
enc2 = ''
aaa = 'ioOavquaDb}x2ha4[~ifqZaujQ#'
for i in range(len):
    if i % 2 == 0:
        enc1.append(chr(ord(enc[i]) + 1))
    else:
        enc1.append(chr(ord(enc[i]) + 2))

s1 = []
for x in range(3):
    for i in range(len):
        if (i + x) % 3 == 0:
            s1.append(enc1[i])

enc2 = enc2.join(s1)
if enc2 in aaa:
    print "You 're Right!"
else:
    print "You're Wrong!"
    exit(0)