Skip to content

Instantly share code, notes, and snippets.

@dz-root
Last active October 24, 2022 17:44
Show Gist options
  • Save dz-root/a20f6452fde54e1e8d3625e261eb01fa to your computer and use it in GitHub Desktop.
Save dz-root/a20f6452fde54e1e8d3625e261eb01fa to your computer and use it in GitHub Desktop.
RPN - Root-me CTF10K

RPN

Overview

Category: Programming

Who needs parentheses when you can use Jan's RPN to get an unambiguous formula? nc ctf10k.root-me.org 8002

Author : Elf#4541

Solve

Methodology

I was confused the first time I saw the equations to solve 😭 Ok, what is RPN? RPN means Reverse Polish notation.

Is there a lib or a script that someone made before to calculate in RPN? Of course! after a quick googling I found this tiny python script that do the job we need very well! https://gist.github.com/viebel/3d0f146484989b0c5afc29e53e3e9f2c

Now all what still for us to do is listening to the server, solving the equations and sending the results back.

Code

from pwn import *
#-------------------------------------------------------------------
# reverse_polish_evaluator.py
# https://gist.github.com/viebel/3d0f146484989b0c5afc29e53e3e9f2c
#-------------------------------------------------------------------
ops = {
  "+": (lambda a, b: a + b), "-": (lambda a, b: a - b),
  "*": (lambda a, b: a * b), "/": (lambda a, b: a / b)
}

def eval(expression):
  tokens = expression.split()
  stack = []

  for token in tokens:
    if token in ops:
      arg2 = stack.pop()
      arg1 = stack.pop()
      result = ops[token](arg1, arg2)
      stack.append(result)
    else:
      stack.append(int(token))
  return stack.pop()
# ---------------------------------------------------------------

server = remote("ctf10k.root-me.org", 8002)
while (True):
  
	try:
		# Get data from server (equation to solve)
		eq = server.recv()
		print(eq.decode('utf-8'))

    # Solve with eval(), (reverse_polish_evaluator)
		res = eval(eq[26:-2].decode('utf-8').replace('x','*'))
		print(res)

    # Send the result
		server.sendline(str(res))
		
	except EOFError as e:
		print("End\n")
		break

🚩 Flag: RM{Luk4s13wlcz_w0uld_b3_pr0ud}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment