asisctf 2020

merry.py

#!/usr/bin/env python3.8

import os
from pwn import *


target = open("flag.enc.orig", "rb").read()

pc = b"""
#include <stdio.h>
#include <stdlib.h>
#include <time.h>

time_t time(time_t *tloc){return 0x0;}
void srand(unsigned int seed){}
int rand(void){return 9;}
"""

def try_char(c, prefix=b""):
    idx = len(prefix)
    with open("flag.txt", "wb") as f:
        m = bytearray(prefix)
        m.append(c)
        f.write(m)

    os.system("LD_PRELOAD=./p.so ./mgr")

    with open("flag.enc", "rb") as f:
        out = f.read()

    return out[idx] == target[idx]

def bf(idx):
    charset = b'0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!"#$%&\'()*+,-./:;<=>?@[\\]^_`{|}~ \t\n\r\x0b\x0c'
    candidates = []
    for c in charset:
        if try_char(c, out):
            candidates.append(c)

    if len(candidates) == 1:
        return candidates[0]

    raise Exception


out = bytearray(b"")
for idx in range(30):
    c = bf(idx)
    out.append(c)
    print(out)
    
# bytearray(b'ASIS{Kn0w_7h4t_th3_l1fe')