idekCTF 2022* -- Manager Of The Year 2

idek2022_manager2_solve.py

from pwn import *

r = remote('manager-of-the-year-2.chal.idek.team', 1337)
r.sendlineafter(b'Press any key to continue...', b'')

n = 365
close_values = []

for i in range(n):
    
    preds = ['0'] * n
    bounds = [0,100]    # lower and upper bounds

    # type 0: need to guess twice for 50% range cut
    # type 1: only need to guess once for 50% range cut
    guess_type = 0
    attempt_count = 0

    while bounds[1]-bounds[0] > 0.14:
        
        if guess_type == 0:
            
            # first guess (lower bound)
            preds[i] = str(bounds[0])
            r.sendlineafter(b'Enter your predictions for \'Revenue\' (in thousands) for 2023:\n', 
                            ' '.join(preds).encode())

            # second guess (upper bound)
            preds[i] = str(bounds[1])
            r.sendlineafter(b'Enter your predictions for \'Revenue\' (in thousands) for 2023:\n', 
                            ' '.join(preds).encode())
            response = r.recvline()
            closer_than_prev = b'Are you sure your model is working?' not in response

            # comparison + change boounds
            if closer_than_prev:
                bounds[0] = sum(bounds)/2   # change lower bound
            else:
                bounds[1] = sum(bounds)/2   # change upper bound
                
            attempt_count += 2

        elif guess_type == 1:
            
            # guess
            idx_to_guess = not bounds.index(float(preds[i]))
            preds[i] = str(bounds[idx_to_guess])
            r.sendlineafter(b'Enter your predictions for \'Revenue\' (in thousands) for 2023:\n', 
                            ' '.join(preds).encode())
            response = r.recvline()
            closer_than_prev = b'Are you sure your model is working?' not in response

            # comparison + change boounds
            if closer_than_prev == idx_to_guess:
                bounds[0] = sum(bounds)/2   # change lower bound
            else:
                bounds[1] = sum(bounds)/2   # change upper bound
                
            attempt_count += 1

        # if the previous guess is upper/lower bound, we only need to guess once
        within_range = float(preds[i]) in bounds
        guess_type = within_range
    
    print(f'Done {i+1} with {attempt_count} attempts')
    close_values.append(str(sum(bounds)/2))

r.recvuntil(b'Enter your predictions for \'Revenue\' (in thousands) for 2023:\n')
r.sendline(' '.join(close_values).encode())

r.interactive()