AlpacaHack Round 13: Jerry's flag checker Upsolve

Jerry's flag checker

authored by soon-haari

Jerry will verify your flag for you!

import os
from Crypto.Util.number import bytes_to_long, long_to_bytes

FLAG = os.environ.get("FLAG", "Alpaca{***** REDACTED *****}").encode()
assert len(FLAG) <= 30 and FLAG.startswith(b"Alpaca{") and FLAG.endswith(b"}") and all(0x20 <= c <= 0x7f for c in FLAG)

while True:
    try:
        if long_to_bytes(int(input("Guess the flag in integer: ")) - bytes_to_long(FLAG)).decode():
            print("Wrong flag. :P")
        else:
            print("Yay, you found the flag! :3")
    except:
        print("Weird... :/") 

解法

ここで、気になるのはlong_to_bytes(int(input("Guess the flag in integer: ")) - bytes_to_long(FLAG)).decode()という処理です。
try-exceptであることと、assertの条件から、ある文字がASCIIかどうかをチェックすることで解けます。
後は、これを実装しましょう。

from pwn import *
from Crypto.Util.number import bytes_to_long

HOST = "34.170.146.252"
PORT = 16055
io = remote(HOST, PORT)

candidates = bytearray([0x7f for _ in range(30)])
for i in range(len(candidates)):
    for c in range(0x20, 0x7f):
        candidates[i] = c
        now = bytes_to_long(candidates)
        io.sendlineafter(b"Guess the flag in integer: ", str(now).encode())
        res = io.recvline()

        if b"Wrong flag. :P" in res:
            break

    print(candidates.decode())

Flag: Alpaca{ASCII_oracle_attack!!}