๋ณธ๋ฌธ ๋ฐ”๋กœ๊ฐ€๊ธฐ

๐Ÿด‍โ˜ ๏ธ CTF ๐Ÿด‍โ˜ ๏ธ/๐Ÿงฎ ์•”ํ˜ธํ•™ ๐Ÿงฎ

[Dream Hack - Crypto] fuzzy flag

๋ฐ˜์‘ํ˜•

ํ’€์ด ๋ฐฉ๋ฒ•

1. flag์— 0~51 ์ค‘ ํ•˜๋‚˜์˜ ์ˆซ์ž๊ฐ€ ๋žจ๋˜์œผ๋กœ ๋”ํ•ด์ง€๋Š” ํ˜•ํƒœ์ด๋‹ค. ๋”ฐ๋ผ์„œ flag์˜ ascii ์ฝ”๋“œ ๊ฐ’ ๋ณด๋‹ค ์ž‘์€ ๊ฐ’์€ ์ถœ๋ ฅ๋  ์ˆ˜ ์žˆ๋‹ค.

fuzzy = [c + randbelow(len(string.ascii_letters)) for c in flag]

 

2. ์—ฌ๋Ÿฌ๋ฒˆ ๋ฐ˜๋ณตํ•˜์—ฌ ๊ฐ index์˜ ๊ฐ€์žฅ ์ž‘์€ ๊ฐ’๋งŒ ์ €์žฅํ•œ๋‹ค.

3. ์ž‘์€ ๊ฐ’๋งŒ ์ €์žฅ๋œ ๋ฆฌ์ŠคํŠธ๋ฅผ ๋ณ€ํ™˜ํ•˜๋ฉด! flag๋ฅผ ์–ป์„ ์ˆ˜ ์žˆ๋‹ค.

 

ํ’€์ด ์ฝ”๋“œ

from pwn import *
import time

## 185 ๊ธ€์ž 
min_data_list = [255] * 185

for count in range(0, 216) :
    p = remote("host3.dreamhack.games", 21384)
        
    data = p.recvline().decode('utf-8').split("[")[1].split("]")[0].split(", ")
    cur_data_list = [int(data[i]) for i in range(len(data))]
    for index in range(0, len(data)) :
        min_data_list[index] = min(cur_data_list[index], min_data_list[index])

    print("## count: ", count , " ##")
    print(min_data_list)
    p.close()

 

ํ’€์ด ๊ฒฐ๊ณผ

flag = [89, 73, 83, 70, 123, 109, 121, 95, 116, 119, 111, 95, 115, 48, 108, 117, 116, 105, 48, 110, 115, 58, 95, 48, 110, 101, 95, 119, 104, 101, 114, 101, 95, 116, 104, 101, 95, 97, 118, 101, 114, 97, 103, 101, 95, 48, 102, 95, 114, 97, 110, 100, 48, 109, 95, 110, 117, 109, 98, 101, 114, 115, 95, 114, 101, 109, 97, 105, 110, 115, 95, 99, 111, 110, 115, 116, 97, 110, 116, 44, 95, 97, 110, 100, 95, 97, 110, 48, 116, 104, 101, 114, 95, 119, 104, 101, 114, 101, 95, 116, 104, 101, 95, 117, 112, 112, 101, 114, 95, 97, 110, 100, 95, 49, 111, 119, 101, 114, 95, 98, 111, 117, 110, 100, 115, 95, 111, 102, 95, 114, 97, 110, 100, 111, 109, 95, 110, 117, 109, 98, 101, 114, 115, 95, 114, 101, 109, 97, 105, 110, 95, 99, 48, 110, 115, 116, 97, 110, 116, 46, 87, 104, 97, 116, 95, 109, 101, 116, 104, 111, 100, 95, 100, 49, 100, 95, 121, 111, 117, 95, 117, 115, 101, 63, 125]
print(bytes(flag).decode('utf-8'))

๋ฐ˜์‘ํ˜•