Lonely bot

Flag: HACKDAY{Y3E4H_1ZY_R1GHT!}

Challenge

Description

---

You wander through the deserted streets of the abandoned docks south of Dagenham, convinced they might serve as a hideout for criminals. After exploring ruined buildings and broken machinery, your attention is caught by a strange light shining from beneath a rusty door. Forcing it open, you are surprised to find a small robot that seems eager to communicate with you. Try to uncover the secrets it holds, though you’re beginning to realize this might take some time...

---

More instances of the challenge:

• challenges.hackday.fr:41521

• challenges.hackday.fr:41522

• challenges.hackday.fr:41523

• challenges.hackday.fr:41524

• challenges.hackday.fr:41525

---

There's an currently issue with the trailing newlines handling in the buffer from the server side. The challenge can still be solved. You have to send your answers without any trailing newlines added in the buffer. We are looking for a hotfix.

---

The use of socket and send() method can help to solve the challenge.

challenges.hackday.fr:41521

Ce challenge tourne sur un docker et n'est pas disponible

Solution

J'ai eu des problèmes avec pwntools (à cause de leur serveur notamment). Donc j'ai recodé les fonctions principales pour gérer l'échange client-serveur. C'est-à-dire l'envoi de données ainsi que la lecture par ligne.

Le code est commenté à chaque étape.

import socket
import hashlib
from deep_translator import GoogleTranslator
import re
from rich.console import Console
from datetime import datetime

console = Console()

# Une classe, parce qu'on pète la classe.
class Solver:
  def __init__(self, host, port):
    self.sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    self.sock.settimeout(2)
    self.sock .connect(((host, port)))
    self.answers = []

  # Fonction pour l'envoie de str, elle permet également de gérer un historique
  # des réponses envoyées ainsi que de leur print.
  def send(self, data: str, save: bool = True, newline: bool = False):
    if save:
      self.answers.append(data)
    console.print(f'[green]>[/green] {data}')
    self.sock.send(data.encode() + (b'\n' if newline else b''))

  # Fonction basique pour lire jusqu'à la détection d'un pattern
  def recvuntil(self, data: bytes) -> bytes:
    received = b''
    while True:
      received += self.sock.recv(1)
      if received == b'' or received.endswith(data):
        return received

  # Fonction pour lire une ligne complète (jusqu'à recevoir un \n)
  # Permet aussi de les afficher
  def recvline(self) -> bytes:
    line = self.recvuntil(b'\n')[:-1].decode()
    console.print(f'[red]<[/red] {line}')
    return line

  # Fonction de plus haut niveau, pour lire plusieurs lignes d'un coup
  # Ajoutant une ligne de vide après la réception pour la clareté des logs
  def recvlines(self, n = 1) -> list[bytes]:
    lines = []
    for _ in range(n):
      lines.append(self.recvline())
    console.print('')
    return lines

  # Résolution du chall
  def run(self):
    lines = self.recvlines(5)
    self.send('yes', save=False)
    
    # Flag 1
    # Question sur notre prénom. On retient aussi le sien par politesse
    lines = self.recvlines(3)
    name = lines[-2].split('is ')[1].strip()
    self.send('ThaySan')
    
    # Demande la température de fusion du laiton
    # https://fr.wikipedia.org/wiki/Laiton -> 932°C
    # Ensuite on calcule pour les autres 
    lines = self.recvlines(2)
    if 'Celsius' in lines[1]:
      self.send('932')
    elif 'Fahrenheit' in lines[1]:
      self.send('1709')
    elif 'Kelvin' in lines[1]:
      self.send('1205')
      
    # On nous demande la date d'invention
    # -> "invention du train à diesel" sur google
    # -> https://fr.wikipedia.org/wiki/Locomotive_électrique
    # -> "invention du train vapeur" sur google
    # -> https://fr.wikipedia.org/wiki/Train_à_sustentation_magnétique
    lines = self.recvlines(2)
    if 'diesel' in lines[1]:
      self.send('1923')
    elif 'electric' in lines[1]:
      self.send('1879')
    elif 'vapor' in lines[1]:
      self.send('1804')
    elif 'magnetic' in lines[1]:
      self.send('1979')
   
    # On nous demande de quelle base il s'agit. Le message ne change jamais
    # Un tour sur CyberChef permet de savoir si on reconnaît pas
    lines = self.recvlines(2)
    if lines[1].startswith('Ng!)(Z+9SVV'):
      self.send('base85')
    elif lines[1].startswith('SSBrbm93I'):
      self.send('base64')
    elif lines[1].startswith('JEQGW3TPO'):
      self.send('base32')
    
    # Il faut hasher nos anciennes réponses en suivant un format
    # Heureusement qu'on a créé un historique ;)
    lines = self.recvlines(3)
    answers = ','.join(self.answers).encode()
    if 'md5' in lines[-1]:
      h = hashlib.md5
    elif 'sha1' in lines[-1]:
      h = hashlib.sha1
    elif 'sha256' in lines[-1]:
      h = hashlib.sha256
    elif 'sha512' in lines[-1]:
      h = hashlib.sha512
    self.send(h(answers).hexdigest())
    
    # Le flag est là
    lines = self.recvlines(15)
    return True

while True:
  try:
    solver = Solver('challenges.hackday.fr', 41521)
    if solver.run():
      break
  except TimeoutError:
    break
  except KeyboardInterrupt:
    break
  except Exception as e:
    print(e.with_traceback())
    pass

< I'm feeling so lonely in this dead city...
< Since this industrial revolution, no one has come to talk to me...
< If only there was someone to talk to...
< OH wait, YOU ... YES YOU!
< Would you care to spend some time with me ...?

> yes
< Excellent, so we can start talking!
< Starting with the basics, the name! Mine is Zebulon Mavromichali Parsons
< What's yours?

> ThaySan
< Nice to meet you ThaySan!
< What's the fusion temperature of brass? Give it to me in Fahrenheit and strip off decimals

> 1709
< Nice, you're good in physics!
< But, what about history? When was the first vapor train built? Give me the year please!

> 1804
< Can't have you on this point, you know your basics! We'll see if you can keep up!
< 
Ng!)(Z+9SVVQzUKWo~0{WNB_^AYx&2WpgYbVs&&NcW7y2XdrKHWguxMZ6I}XX>MmOE-pVHD0gycbY&oUZ*_7YVQzDGWpW^CZXj%LcV
%*8VRL05Y-wv{ASYsBb7eL(Cn*

> base85
< Even in the encoding, you're good! Let's move on!
< I'm preparing the other questions...
< While you wait, can you hash the previous answers in sha1?

> 6fb318ac88a7f457a82dfe50a858fc314a4791eb
< You start with your name (format: hash(1,2,3,4))
< Good memory, nice for you!
< You make me feel like I'm not alone anymore, and you seem to be quite skilled!
< Here's the first flag: HACKDAY{Y3E4H_1ZY_R1GHT!}
< Let's keep talking!
< Now, I would like to play a little game with you, something more interactive!
<  I hope you know the game rock-paper-scissors!
<  I modified it a little bit, i'll explain.
<  I'm going to give you my first move, and you'll answer with your two moves.
<  My second move will be drawn randomly, and we'll see who wins!
<  In case of draw, we play another pair of moves in the same way.
<  To be simple, we're going to use R for Rock, P for Paper and S for Scissors.
<  The format of your answer should be: R,P
< Let's play together!
< My first move is R! What are yours?