强网杯 2025 quals
fight as a member@来自东方的神秘力量
我们是冠军！！！！！
以下记录全程聊天的内容，包含wp：
misc
The_Interrogation_Room
算法题，不大会
有啥思路吗，我思路就是那个最小距离不小于5
快了，差处理一下gift逻辑
吗的这个pow有问题
#!/usr/bin/env python3
from pwn import *
import hashlib
import random
import itertools
import string
import re
context.log_level = 'info'
context.timeout = 30
# def generate_G():
# while True:
# G = [[random.randint(0, 1) for _ in range(17)] for _ in range(8)]
# min_weight = 100
# for s_val in range(1, 256):
# vec = [(s_val >> i) & 1 for i in range(8)]
# codeword = [0] * 17
# for j in range(17):
# for i in range(8):
# codeword[j] ^= vec[i] & G[i][j]
# weight = sum(codeword)
# if weight < min_weight:
# min_weight = weight
# if min_weight >= 5:
# return G
def solve_linear_system(A, b):
m = len(A)
n = len(A[0])
M = [A[i][:] for i in range(m)]
for i in range(m):
M[i].append(b[i])
r = 0
pivots = []
for col in range(n):
pivot_row = -1
for row in range(r, m):
if M[row][col] == 1:
pivot_row = row
break
if pivot_row == -1:
continue
M[r], M[pivot_row] = M[pivot_row], M[r]
pivots.append(col)
for row in range(r + 1, m):
if M[row][col] == 1:
for k in range(col, n + 1):
M[row][k] ^= M[r][k]
r += 1
for row in range(r, m):
if M[row][n] != 0:
return None
x = [0] * n
for i in range(r - 1, -1, -1):
col = pivots[i]
value = M[i][n]
for j in range(col + 1, n):
value ^= M[i][j] & x[j]
x[col] = value
return x
def generate_query(v):
indices = [i for i in range(8) if v[i] == 1]
if len(indices) == 0:
return "0"
elif len(indices) == 1:
return f"S{indices[0]}"
else:
parts = [f"S{i}" for i in indices]
expr = parts[0]
for i in range(1, len(parts)):
expr = f"( {expr} == {parts[i]} )"
if len(parts) % 2 == 0:
expr += " == 0"
return expr
def decode_secret(R, G, GT):
for error_count in range(3):
for error_positions in itertools.combinations(range(17), error_count):
correct_positions = [i for i in range(17) if i not in error_positions]
# s × G[:,correct_positions] = R[correct_positions]
A = [GT[i] for i in correct_positions]
b = [R[i] for i in correct_positions]
s_candidate = solve_linear_system(A, b)
if s_candidate is not None:
valid = True
for j in range(17):
computed = 0
for i in range(8):
computed ^= s_candidate[i] & G[i][j]
if j in error_positions:
if computed == R[j]:
valid = False
break
else:
if computed != R[j]:
valid = False
break
if valid:
return s_candidate
return None
def check_xxxx(suffix, target_hash):
possible_list = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
for i in possible_list:
for j in possible_list:
for k in possible_list:
for l in possible_list:
xxxx = i + j + k + l
if hashlib.sha256((xxxx + suffix).encode()).hexdigest() == target_hash:
return xxxx
def handle_pow(conn):
pow_line = conn.recvline().decode().strip()
log.info(f"PoW challenge: {pow_line}")
match = re.search(r"sha256\(XXXX\+([a-zA-Z0-9]+)\) == ([0-9a-f]+)", pow_line)
print(match)
if not match:
log.error("PoW format error")
return False
suffix = match.group(1)
target_hash = match.group(2)
xxxx = check_xxxx(suffix, target_hash)
if xxxx:
conn.sendlineafter(b': ', xxxx.encode())
log.success(f"PoW solved: {xxxx}")
return True
else:
log.error("PoW failed")
return False
def complete_round(conn, G, GT, round_num):
"""
完成一轮审讯
"""
log.info(f"Starting round {round_num}")
responses = []
for i in range(17):
try:
print(conn.recvuntil(b"Ask your question:", timeout=context.timeout))
print(conn.recvline().decode().strip())
except:
log.error("Timeout waiting for question prompt")
return False
query_vector = [G[j][i] for j in range(8)]
query_expr = generate_query(query_vector)
conn.sendline(query_expr.encode())
try:
response = conn.recvline().decode()
log.debug(f"Query {i+1}: {query_expr} -> {response.strip()}")
if "True" in response:
responses.append(True)
elif "False" in response:
responses.append(False)
else:
log.error(f"Unexpected response: {response}")
return False
except:
log.error("Timeout receiving response")
return False
R = [1 if r else 0 for r in responses]
secret_vector = decode_secret(R, G, GT)
if secret_vector is None:
log.error("Failed to decode secret")
return False
try:
conn.recvuntil(b"reveal the true secrets", timeout=context.timeout)
except:
log.error("Timeout waiting for secret submission prompt")
return False
secret_str = ' '.join(str(bit) for bit in secret_vector)
conn.sendline(secret_str.encode())
log.info(f"Submitted secrets: {secret_str}")
try:
result = conn.recvline().decode()
log.info(f"Round result: {result.strip()}")
if "scowls" in result or "next" in result:
log.success(f"Round {round_num} completed successfully")
return True
else:
log.warning(f"Unexpected round result: {result}")
return True
except:
log.warning("Could not receive round result, continuing...")
return True
def main():
log.info("Generating G matrix...")
G = [[1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 0, 1, 1, 0, 0], [1, 0, 1, 1, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 1, 1], [0, 0, 1, 0, 0, 0, 1, 0, 1, 0, 0, 0, 1, 1, 0, 1, 0], [1, 1, 1, 0, 0, 1, 1, 0, 1, 1, 0, 0, 0, 1, 1, 1, 1], [1, 1, 0, 1, 0, 0, 0, 1, 1, 1, 1, 0, 1, 0, 1, 0, 0], [1, 0, 1, 0, 1, 1, 1, 1, 1, 1, 1, 0, 0, 0, 0, 1, 1], [0, 1, 1, 1, 0, 0, 0, 1, 1, 0, 1, 1, 1, 1, 1, 0, 0], [1, 1, 0, 1, 1, 1, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 0]]
GT = [[G[j][i] for j in range(8)] for i in range(17)]
log.success("G matrix generated")
log.info(f"Connecting to server...")
# 47.94.214.30 26668
conn = remote('47.94.214.30', 26668)
if not handle_pow(conn):
conn.close()
return
try:
welcome = conn.recvuntil(b"The prisoner has agreed to answer your questions, but be warned - he will lie exactly twice during this session.", timeout=context.timeout).decode()
print(welcome)
log.info("Received welcome message")
except:
log.error("Timeout waiting for welcome message")
conn.close()
return
for round_num in range(25):
if not complete_round(conn, G, GT, round_num + 1):
log.error(f"Failed at round {round_num + 1}")
break
if round_num == 9:
try:
gift = conn.recvline(timeout=5).decode()
log.info(f"Gift: {gift.strip()}")
print(conn.recvline().decode())
except:
log.warning("No gift received")
try:
final = conn.recvall(timeout=5).decode()
log.success(f"Final result: {final}")
except:
log.info("Connection closed")
conn.close()
if __name__ == '__main__':
main()