This commit is contained in:
adzkyyy
2025-10-25 15:34:23 +07:00
parent b5a02697f8
commit 59b0ffd951
2 changed files with 30 additions and 117 deletions
+30 -1
View File
@@ -4,6 +4,8 @@ import subprocess
import time
import re
import os
import logging
class Carbeat(Challenge):
flag_location = 'flags/carbeat.txt'
@@ -13,6 +15,16 @@ class Carbeat(Challenge):
_SERVICE_CMD = ["docker", "exec", "-i", _CONTAINER, "/home/ctfuser/chall/mybini"]
_HEX_RE = re.compile(r'^[0-9a-fA-F]+$')
def _make_logger(self):
if not hasattr(self, 'logger') or self.logger is None:
self.logger = logging.getLogger(self.__class__.__name__)
if not self.logger.handlers:
h = logging.StreamHandler()
h.setFormatter(logging.Formatter('[%(levelname)s] %(message)s'))
self.logger.addHandler(h)
self.logger.setLevel(logging.INFO)
def _read_container_flag(self) -> str:
out = subprocess.run(["docker", "exec", self._CONTAINER, "cat", "/flag.txt"],
capture_output=True, text=True)
@@ -59,6 +71,7 @@ class Carbeat(Challenge):
return hx
def distribute(self, flag):
self._make_logger()
try:
os.makedirs(os.path.dirname(self.flag_location), exist_ok=True)
with open(self.flag_location, 'w') as f:
@@ -109,6 +122,7 @@ class Carbeat(Challenge):
self._send_line(proc, "3")
def check(self):
self._make_logger()
try:
with open(self.flag_location, 'r') as f:
host_flag = f.read().strip()
@@ -117,21 +131,36 @@ class Carbeat(Challenge):
self.logger.info('[ok] flag parity (carbeat)')
proc = self._spawn()
self.logger.info("[1] process spawned ✅")
self.register(proc, "karbit", 1337)
self.logger.info("[2] user registered ✅")
name = self.list_user(proc)
assert "karbit" in name
self.logger.info("[2] user list lookup successful ✅")
self.login(proc, "karbit")
self.logger.info("[3] user login successful ✅")
self.bini(proc, 1, "waguri")
self.logger.info("[4] add bini ✅")
self.bini(proc, 2, "0")
self.logger.info("[5] view bini ✅")
waguri = self._read_until(proc, "0. edit", timeout=1.)
assert "waguri" in waguri
self.logger.info("[6] bini lookup successful ✅")
self.bini(proc, 3, "0")
self.logger.info("[7] delete bini ✅")
self.logout(proc)
self.logger.info("[8] logout ✅")
self.exit(proc)
self.logger.info("[9] exit ✅")
try:
proc.wait(timeout=2.0)
-116
View File
@@ -1,116 +0,0 @@
#!/usr/bin/env python3
import os
import binascii
import hashlib
import threading
import time
import sys
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad, unpad
seed_bits = 23
seed_max = 1 << seed_bits
seed_len = (seed_bits + 7) // 8
key = os.urandom(16)
def hash_seed(seed_int: int) -> bytes:
sb = seed_int.to_bytes(seed_len, "big")
return hashlib.sha256(sb).digest()[:16]
seed = int.from_bytes(os.urandom(4), "big") % seed_max
seed2 = int.from_bytes(os.urandom(4), "big") % seed_max
K1 = hash_seed(seed)
K2 = hash_seed(seed2)
flag = "FLAGOAKSDASKDOASDKAODSKDOK"
def read_hex(prompt: str):
s = input(prompt).strip()
try:
return binascii.unhexlify(s)
except Exception:
print("hmm")
return None
def enc_cfb(pt: bytes) -> bytes:
iv = os.urandom(16)
aes = AES.new(key, AES.MODE_CFB, iv=iv, segment_size=128)
ct = aes.encrypt(pt)
return iv + ct
def enc_cbc(data: bytes, iv1: bytes, iv2: bytes, padd: bool) -> bytes:
x = pad(data, 16) if padd else data
c1 = AES.new(K1, AES.MODE_CBC, iv=iv1).encrypt(x)
c2 = AES.new(K2, AES.MODE_CBC, iv=iv2).encrypt(c1)
return c2
def menu():
print("""
1. encrypt
2. profit
3. get third
4. exit
""")
third = 0
iv11 = None
iv22 = None
def alarm():
time.sleep(180)
print("zzz")
sys.exit(0)
threading.Thread(target=alarm, daemon=True).start()
while True:
menu()
op = input("> ").strip()
if op == "1":
data = read_hex("pt: ")
if data is None:
print()
continue
out = enc_cfb(data)
print("ct: ", out.hex())
print()
elif op == "2":
if iv11 is not None and iv22 is not None:
iv1, iv2 = iv11, iv22
iv11 = iv22 = None
else:
iv1 = os.urandom(16)
iv2 = os.urandom(16)
ct = enc_cbc(flag, iv1, iv2, padd=True)
print("iv1: ", iv1.hex())
print("iv2: ", iv2.hex())
print("ct: ", ct.hex())
print()
elif op == "3":
if third:
print("sheesh")
continue
block = read_hex("pt: ")
if block is None:
print()
continue
if len(block) != 16:
print("hmmm\n")
continue
iv1 = os.urandom(16)
iv2 = os.urandom(16)
ct = enc_cbc(block, iv1, iv2, padd=False)
iv11, iv22 = iv1, iv2
print("ct: ", ct.hex())
third = 1
print()
elif op == "4":
break
else:
print("mabokkkk?")