Title: Anxun Cup SYCCTF2023 writeup

1. MISC

1.sudoku_easy

Simple Sudoku interaction, a few small points to pay attention to, sleep 5 seconds after each level is sent, and the question will be returned to sleep

Let the shape be like

--------------------------------------------------------------------------------------------------------------------------------

800103720

023840650

410006008

300001062

000052407

072060090

160000375

205019846

000030000

--------------------------------------------------------------------------------------------------------------------------------

Convert to a two-dimensional array to solve the Sudoku and reconvert the return result to a multi-line string

def parse_input(input_list):

board=[]

for row in input_list:

nums=list(map(int, row))

board.append(nums)

return board

def format_output(board):

formatted=''

for row in board:

formatted +=''.join(map(str, row)) + '\n'

return formatted.strip()

At first, I thought that each time I got 5 points, I had to get 120 points, and I had a range of 24 times, but I kept getting problems. Later, I found that the scores were increased. At the same time, I debugged and found that if I got 120 points, I would return a getshell, so I modified the range 7 times.

Final script :

def find_empty(board):

for row in range(9):

for col in range(9):

if board[row][col]==0:

return row, col

return None

def is_valid(board, num, pos):

row, col=pos

for i in range(9):

if board[row][i]==num and col !=i:

return False

if board[i][col]==num and row !=i:

return False

box_row=row //3

box_col=col //3

for i in range(box_row * 3, box_row * 3 + 3):

for j in range(box_col * 3, box_col * 3 + 3):

if board[i][j]==num and (i, j) !=pos:

return False

return True

def solve(board):

find=find_empty(board)

If not find:

return True

else:

row, col=find

for i in range(1, 10):

if is_valid(board, i, (row, col)):

board[row][col]=i

If solve(board):

return True

board[row][col]=0

return False

def parse_input(input_list):

board=[]

for row in input_list:

nums=list(map(int, row))

board.append(nums)

return board

def format_output(board):

formatted=''

for row in board:

formatted +=''.join(map(str, row)) + '\n'

return formatted.strip()

# input_string='''---------------------

# 800103720

# 023840650

# 410006008

# 300001062

# 000052407

# 072060090

# 160000375

# 205019846

# 000030000

# ----------------------

# now give me you solve:'''

# lists=input_string.split('\n')[1:10]

# board=parse_input(lists)

# print(board)

# solve(board)

# print(board)

from pwn import *

# Create a connection

conn=remote('47.108.165.60',27539)

# Receive welcome message

for i in range(7):

msg=conn.recvuntil('Please input:').strip().decode('utf-8')

print(msg)

# Send selection

conn.sendline('1'.encode())

# Receive next prompts

msg=conn.recvuntil('Please select the level:').strip().decode('utf-8')

print(msg)

conn.sendline('5'.encode())

msg=conn.recvuntil('clock start').strip().decode('utf-8')

print(msg)

time.sleep(5)

msg=conn.recvuntil('now gives me you solve:').strip().decode('utf-8')

print(msg)

lists=msg.split('\n')[1:10]

board=parse_input(lists)

solve(board)

solved=format_output(board)

conn.sendline(solved.encode())

conn.interactive()

or

from pwn import *

def is_valid(board, row, col, num):

# Check if the line is legal

for i in range(9):

if board[row][i]==num:

return False

# Check if the column is legal

for i in range(9):

if board[i][col]==num:

return False

# Check whether the ninth square is legal

start_row=(row //3) * 3

start_col=(col //3) * 3

for i in range(3):

for j in range(3):

if board[start_row + i][start_col + j]==num:

return False

return True

def solve_sudoku(board):

for row in range(9):

for col in range(9):

if board[row][col]==0:

for num in range(1, 10):

if is_valid(board, row, col, num):

board[row][col]=num

if solve_sudoku(board):

return True

board[row][col]=0 # Backtracking

return False # All numbers have been tried, no suitable numbers were found

return True

def print_sudoku(board):

a=''

for row in range(9):

for col in range(9):

a +=str(board[row][col])

a+='\n'

return a.strip()

context.log_level='debug'

p=remote('47.108.165.60',23479)

p.recv()

for i in range(7):

p.sendline('1')

p.recvuntil('Please select the level:')

p.sendline('5')

a='---------------------\nnow give me you solve:'

content=p.recvuntil(a).decode().split(a)[0][-130:]

sudoku=content.split('---------------------')[1]

sudoku=sudoku.strip()

sudoku=sudoku.split('\n')

tmp=[]

for sudo in sudoku:

a=[int(s) for s in sudo]

tmp.append(a)

if solve_sudoku(tmp):

result=print_sudoku(tmp)

log.info(result)

for line in result.split('\n'):

p.send(line)

#content=p.recv().decode()

p.interactive()

A separate Sudoku decryption script:

class SudoKu():

def __init__(self, sudo_ku_data):

if not isinstance(sudo_ku_data, list):

raise TypeError(f'sudo_ku_data params must a list, but {sudo_ku_data} is a {type(sudo_ku_data)}')

if len(sudo_ku_data) !=9 or len(sudo_ku_data[0]) !=9:

raise TypeError(

f'sudo_ku_data params must a 9*9 list, but {sudo_ku_data} is a {len(sudo_ku_data)}*{len(sudo_ku_data[0])} list')

self.sudo_ku=sudo_ku_data

# Store the existing data in each row

self.every_row_data={}

# The existing numbers in each column

self.every_column_data={}

# Every 3*3 number

self.every_three_to_three_data={}

#Each vacant location

self.vacant_position=[]

# Numbers tried in each vacant position

self.every_vacant_position_tried_values={}

# Initialize data

self._init()

def _add_row_data(self, row, value):

'''

When initialization

Add data to self.every_row_data

:param row:

:param value:

:return:

'''

if row not in self.every_row_data:

self.every_row_data[row]=set()

if value in self.every_row_data[row]:

raise TypeError(f'params {self.sudo_ku} is a invalid SudoKu')

self.every_row_data[row].add(value)

def _add_column_data(self, column, value):

'''

When initialization

Add data to self.every_column_data

:param column:

:param value:

:return:

'''

if column not in self.every_column_data:

self.every_column_data[column]=set()

if value in self.every_column_data[column]:

raise TypeError(f'params {self.sudo_ku} is a invalid SudoKu')

self.every_column_data[column].add(value)

def _get_three_to_three_key(self, row, column):

'''

Get every 3*3 key

:param row:

:param column:

:return:

'''

if row in [0, 1, 2]:

if column in [0, 1, 2]:

key=1

elif column in [3, 4, 5]:

key=2

else:

key=3

elif row in [3, 4, 5]:

if column in [0, 1, 2]:

key=4

elif column in [3, 4, 5]:

key=5

else:

key=6

else:

if column in [0, 1, 2]:

key=7

elif column in [3, 4, 5]:

key=8

else:

key=9

return key

def _add_three_to_three_data(self, row, column, value):

'''

When initialization

Add data to self.every_three_to_three_data

:param row:

:param column:

:param value:

:return:

'''

key=self._get_three_to_three_key(row, column)

if key not in self.every_three_to_three_data:

self.every_three_to_three_data[key]=set()

self.every_three_to_three_data[key].add(value)

def _init(self):

'''

Initialize data based on the incoming Sudoku

:return:

'''

for row, row_datas in enumerate(self.sudo_ku):

for column, value in enumerate(row_datas):

if value=='':

self.vacant_position.append((row, column))

else:

self._add_row_data(row, value)

self._add_column_data(column, value)

self._add_three_to_three_data(row, column, value)

def _judge_value_is_legal(self, row, column, value):

'''

Determine whether the data placed by the party is legal

:param row:

:param column:

:param value:

:return:

'''

# Does the value exist in this row of data

if value in self.every_row_data[row]:

return False

# Does the value exist in this column of data

if value in self.every_column_data[column]:

return False

# value does this 3*3 palace exist?

key=self._get_three_to_three_key(row, column)

If value in self.every_three_to_three_data[key]:

return False

return True

def _calculate(self, vacant_position):

'''

Calculate, start placing the value on the Sudoku

:param vacant_position:

:return:

'''

# Get the current location

row, column=vacant_position

values=set(range(1, 10))

# Create a unique key for the current location to store the data that has been tried in the current location

key=str(row) + str(column)

# If this key exists, get the difference set of values, because both are sets, just use them directly -

if key in self.every_vacant_position_tried_values:

values=values - self.every_vacant_position_tried_values[key]

# If this key does not exist, create an empty collection

else:

self.every_vacant_position_tried_values[key]=set()

for value in values:

# Add the current data to the data that has been tried at the current location

self.every_vacant_position_tried_values[key].add(value)

# If the current value is legal, it can be placed

if self._judge_value_is_legal(row, column, value):

# print(f'set {vacant_position} value is {value}')