Skip to content Skip to navigation

Sattelite (ppc 200)

Category: 

Task:

Connect here and find the flag:

`nc asis-ctf.ir 12435`

Solution:

Ok, task asks us to connect, let's do it:

notebook:~ hacker$ nc asis-ctf.ir 12435

hi all,  You must send a string for each level that would make the literal True
send "Sattelite"
Sattelite
(x4 ∨ x5) ∧ (¬x3 ∨ ¬x1) ∧ (¬x3 ∨ x5) ∧ (x3 ∨ ¬x4) ∧ (x1 ∨ ¬x5)

Server asks us to solve Boolean Satisfiabilit Problem also known as SAT (task's name corresponds to it). So we have to do two things: first - parse boolean equation and second - solve it.

This code solves both of them:

#!/usr/bin/env python
import socket
import math
from time import sleep

def unpack(r):
	r = r.replace('(','')
	r = r.replace(')','')
	r = r.replace('x','')
	r = r.replace('\xc2\xac', '-')
	r = r.replace('\xe2\x88\xa8', '')
	return [int(n,10) for n in r.split()]

def increment(s):
	for i in xrange(len(s)):
		if s[i] == 0:
			s[i] = 1
			break
		elif s[i] == 1:
			s[i] = 0
	return s

def brute(eq, length):
	solution = [0]*length
	while True:
		bad = False
		for b in eq:
			x = int(math.copysign(b[0],1))
			y = int(math.copysign(b[1],1))
			val = (b[0] > 0 and solution[x-1] == 1) or (b[0] < 0 and solution[x-1] == 0) or (b[1] > 0 and solution[y-1] == 1) or (b[1] < 0 and solution[y-1] == 0)
			if val == False:
				bad = True
				break
		if bad == False:
			return solution
		solution = increment(solution)
		if solution == [0]*length:
			return []

s = socket.socket()
s.connect(('asis-ctf.ir', 12435))
print s.recv(1024)
s.send('Sattelite\n')

while True:
	response = s.recv(1024).strip()
	print "Server: " + response
	blocks = [unpack(r) for r in response.split(" \xe2\x88\xa7 ")]
	solution = brute(blocks,len(blocks))
	if solution == []:
		print "No solutions found..."
		break
	answer = ''.join([str(x) for x in solution])
	print "Answer: " + answer
	s.send(answer+"\n")
	response = s.recv(1024).strip()
	print "Server: " + response
	if "OK" not in response:
		print "Bad solution..."
		break
	print ""

The flag is: ASIS_5b5e15ec25479ac8b743c6e818d75464