Exploit code for "Mind Calculator"

gistfile1.txt

#!/usr/bin/python3

import os
import base64
import time

import speech_recognition as sr

from selenium import webdriver
from selenium.webdriver.support.ui import WebDriverWait
from selenium.webdriver.support import expected_conditions as EC
from selenium.webdriver.common.by import By
from pydub import AudioSegment  # uses FFMPEG

URL = "http://mind-calculator.ctf.sekai.team/"

houndify_client_id = "XXX"
houndify_client_key = "XXX"


def get_file_content_chrome(driver, uri):
    result = driver.execute_async_script(
        """
    var uri = arguments[0];
    var callback = arguments[1];
    var toBase64 = function(buffer){for(var r,n=new Uint8Array(buffer),t=n.length,a=new Uint8Array(4*Math.ceil(t/3)),i=new Uint8Array(64),o=0,c=0;64>c;++c)i[c]="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charCodeAt(c);for(c=0;t-t%3>c;c+=3,o+=4)r=n[c]<<16|n[c+1]<<8|n[c+2],a[o]=i[r>>18],a[o+1]=i[r>>12&63],a[o+2]=i[r>>6&63],a[o+3]=i[63&r];return t%3===1?(r=n[t-1],a[o]=i[r>>2],a[o+1]=i[r<<4&63],a[o+2]=61,a[o+3]=61):t%3===2&&(r=(n[t-2]<<8)+n[t-1],a[o]=i[r>>10],a[o+1]=i[r>>4&63],a[o+2]=i[r<<2&63],a[o+3]=61),new TextDecoder("ascii").decode(a)};
    var xhr = new XMLHttpRequest();
    xhr.responseType = 'arraybuffer';
    xhr.onload = function(){ callback(toBase64(xhr.response)) };
    xhr.onerror = function(){ callback(xhr.status) };
    xhr.open('GET', uri);
    xhr.send();
    """,
        uri,
    )
    if type(result) == int:
        raise Exception("Request failed with status %s" % result)
    return base64.b64decode(result)


def process(filepath, chunksize=60000):

    basefile = os.path.splitext(filepath)[0]

    sound = AudioSegment.from_mp3(filepath)

    def divide_chunks(sound, chunksize):
        for i in range(0, len(sound), chunksize):
            yield sound[i : i + chunksize]

    chunks = list(divide_chunks(sound, chunksize))

    r = sr.Recognizer()
    string_index = {}
    for index, chunk in enumerate(chunks):
        chunk.export(f"{basefile}.wav", format="wav")
        with sr.AudioFile(f"{basefile}.wav") as source:
            audio = r.record(source)
        s = r.recognize_houndify(
            audio_data=audio,
            client_id=houndify_client_id,
            client_key=houndify_client_key,
            show_all=True,
        )
        string_index[index] = s
        break
    return string_index


DRIVER_PATH = "/usr/bin/chromedriver"
driver = webdriver.Chrome(executable_path=DRIVER_PATH)
driver.get(URL)

wait = WebDriverWait(driver, 10)

elem = wait.until(EC.element_to_be_clickable((By.ID, "start")))
elem.click()

time.sleep(2)  # urgh

text = "Error"
expr = "Error"
oldsoundblob = "Error"
soundblob = "Error"

for counter in range(1, 120):
    print("--------------------------------")
    time.sleep(1)  # urgh
    print(f"Round #{counter}:")
    elem = wait.until(
        EC.presence_of_element_located((By.XPATH, "/html/body/div/fieldset/div/audio"))
    )

    while True:
        soundblob = elem.get_attribute("src")
        if soundblob != oldsoundblob:
            break
    oldsoundblob = soundblob

    blobbytes = get_file_content_chrome(driver, soundblob)

    with open(f"./{counter}.mp3", "wb") as f:
        f.write(blobbytes)

    text = process(f"./{counter}.mp3")

    try:
        expr = text[0]["AllResults"][0]["TemplateData"]["Subtitle"]
        output = text[0]["AllResults"][0]["TemplateData"]["Title"]
        print(f"Expr: {expr}")
        print(f"Total = {output}")
    except:
        print("Couldn't solve")
        output = 0

    driver.find_element(By.ID, "fieldset").click()
    driver.find_element(By.ID, "answer").send_keys(str(output))
    driver.find_element(By.ID, "submit").click()
    time.sleep(1)  # urgh

    elem = driver.find_element(By.XPATH, '//*[@id="counter"]')
    print(elem.text)
    print("")