CTFHub

Writeup

Friends

发表于 分类于 ， ， ，
Challenge | 2020 | CSICTF | Misc | Friends

点击此处获得更好的阅读体验

WriteUp来源

https://dunsp4rce.github.io/csictf-2020/miscellaneous/2020/07/22/Friends.html

by shreyas-sriram

题目描述

I made a really complicated math function. Check it out.

题目考点

解题思路

  • Go through the given source code to realize that the input entered goes through a set of manipulations

  • And to get the flag, the result of manipulations should not be equal to the input number

  • It can also be seen that the input should be between 3 and 100

  • Running the code locally with different inputs tells us that there is no way to meet the necessary conditions to get the flag by entering a number

  • One interesting thing to note is that the input lands inside float()

1
x = round(float(input()), 0)

  • Reading up on float(), we realize that it takes nan as input

  • Using nan as input, we meet the necessary conditions and namo.txt is obtained

  • namo.txt is basically a conditional statement-expanded-code-snippet of the flag written in namo

  • Flag can be obtained by parsing the file

Response File

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
Mitrooon
bhaiyo aur behno "Enter a number"
mann ki baat nambar

agar nambar barabar 1 hai {
  bhaiyo aur behno "s"
}

nahi toh agar nambar barabar 13 hai {
  bhaiyo aur behno "_"
}


nahi toh agar nambar barabar 15 hai {
  bhaiyo aur behno "5"
}


nahi toh agar nambar barabar 22 hai {
  bhaiyo aur behno "4"
}


nahi toh agar nambar barabar 28 hai {
  bhaiyo aur behno "k"
}


nahi toh agar nambar barabar 8 hai {
  bhaiyo aur behno "y"
}


nahi toh agar nambar barabar 17 hai {
  bhaiyo aur behno "4"
}


nahi toh agar nambar barabar 9 hai {
  bhaiyo aur behno "_"
}


nahi toh agar nambar barabar 4 hai {
  bhaiyo aur behno "t"
}


nahi toh agar nambar barabar 3 hai {
  bhaiyo aur behno "c"
}


nahi toh agar nambar barabar 20 hai {
  bhaiyo aur behno "r"
}


nahi toh agar nambar barabar 12 hai {
  bhaiyo aur behno "n"
}


nahi toh agar nambar barabar 0 hai {
  bhaiyo aur behno "c"
}


nahi toh agar nambar barabar 23 hai {
  bhaiyo aur behno "t"
}


nahi toh agar nambar barabar 27 hai {
  bhaiyo aur behno "0"
}


nahi toh agar nambar barabar 10 hai {
  bhaiyo aur behno "n"
}


nahi toh agar nambar barabar 11 hai {
  bhaiyo aur behno "4"
}


nahi toh agar nambar barabar 7 hai {
  bhaiyo aur behno "m"
}


nahi toh agar nambar barabar 25 hai {
  bhaiyo aur behno "c"
}


nahi toh agar nambar barabar 24 hai {
  bhaiyo aur behno "_"
}


nahi toh agar nambar barabar 6 hai {
  bhaiyo aur behno "{"
}


nahi toh agar nambar barabar 16 hai {
  bhaiyo aur behno "_"
}


nahi toh agar nambar barabar 18 hai {
  bhaiyo aur behno "_"
}


nahi toh agar nambar barabar 2 hai {
  bhaiyo aur behno "i"
}


nahi toh agar nambar barabar 5 hai {
  bhaiyo aur behno "f"
}


nahi toh agar nambar barabar 19 hai {
  bhaiyo aur behno "g"
}


nahi toh agar nambar barabar 14 hai {
  bhaiyo aur behno "1"
}


nahi toh agar nambar barabar 21 hai {
  bhaiyo aur behno "3"
}


nahi toh agar nambar barabar 26 hai {
  bhaiyo aur behno "0"
}


nahi toh agar nambar barabar 29 hai {
  bhaiyo aur behno "}"
}

nahi toh {
  bhaiyo aur behno ""
}

achhe din aa gaye

Solution File

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
#!/bin/bash

touch namo.txt
touch temp.txt

echo "nan" > payload.txt

# get nc response
cat payload.txt | nc chall.csivit.com 30425 > namo.txt

# get indexes
index=($(grep -o " [0-9]\{1,2\} " namo.txt))

# get bits of flag
bits=($(grep -o "\".\"" namo.txt))

# match the indexes with the flag and store in file
for(( j=0 ; j<${#index[@]} ; j++ ))
do
  printf -v s "%02d" ${index[$j]} # format index
  echo "$s:${bits[$j]}" >> temp.txt
done

# sort file and get flag
flag=($(sort temp.txt | cut -d '"' -f 2))

# remove files
rm namo.txt
rm temp.txt
rm payload.txt

printf %s "${flag[@]}" $'\n'

Flag

1
csictf{my_n4n_15_4_gr34t_c00k}