Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
import hashlib
import itertools
from tqdm import tqdm
import datetime
def stepn(flag, parent_hash, author, date, positions, target_commit_hash):
l = len(positions)
for flag_chars in tqdm(itertools.product(range(0x20, 0x80), repeat=l), total=0x60**l):
# Guess in the flag
content = bytearray(flag)
for i, cc in zip(positions, flag_chars): content[5 + i] = cc
flag = bytes(content)
content = f'blob {len(content)}\x00'.encode() + bytes(content)
file_hash = hashlib.sha1(content).hexdigest()
# 2. Tree hash (git cat-file -p HEAD^{tree})
content = b'100644 flag.txt' + b'\x00' + bytes.fromhex(file_hash)
content = f'tree {len(content)}\x00'.encode() + content
tree_hash = hashlib.sha1(content).hexdigest()
# 1. Commit hash (git cat-file commit HEAD)
content = f'tree {tree_hash}\n'.encode()
content += f'parent {parent_hash}\n'.encode()
content += f'author {author} {date} +0000\n'.encode()
content += f'committer Flag-deciding Committee <committee@legal.committee> {date} +0000\n'.encode()
content += b'\n'
content += f'Proceedings of the flag-deciding committee: {", ".join(map(str, positions))}\n'.encode()
content = f'commit {len(content)}\x00'.encode() + content
commit_hash = hashlib.sha1(content).hexdigest()
if commit_hash == target_commit_hash:
return flag
with open('dist/log.txt') as f:
data = f.read().strip().split('\n')
flag = 'union{**********************************************}\n'.encode()
# flag = 'union{c0mm1t*3*_d3*1deD_bu7**H*_d3t3rm1n3d_***c26***}\n'.encode() # i = 12
for i in range(16):
parent_hash = data[96-6*i][7:]
target_commit_hash = data[90-6*i][7:]
author = data[91-6*i][8:]
date = data[92-6*i][12:-6]
date = datetime.datetime.strptime(date, "%b %d %H:%M:%S %Y")
date = int(datetime.datetime.timestamp(date)) + 28800 # A workaround for me, someone who lives in GMT+8.
positions = list(map(int, data[94-6*i][48:].split(', ')))
print(f'{i = }')
print(f'{flag = }')
print(f'{parent_hash = }')
print(f'{author = }')
print(f'{date = }')
print(f'{positions = }')
print(f'{target_commit_hash = }')
print()
flag = stepn(flag, parent_hash, author, date, positions, target_commit_hash)
print(f'Done! {flag = }')
# union{c0mm1tt33_d3c1deD_bu7_SHA_d3t3rm1n3d_6a7c2619a}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment