union-ctf-2021-committee.py

import hashlib
import itertools
from tqdm import tqdm
import datetime

def stepn(flag, parent_hash, author, date, positions, target_commit_hash):
    l = len(positions)
    for flag_chars in tqdm(itertools.product(range(0x20, 0x80), repeat=l), total=0x60**l):
        # Guess in the flag
        content = bytearray(flag)
        for i, cc in zip(positions, flag_chars): content[5 + i] = cc
        flag = bytes(content)

        content = f'blob {len(content)}\x00'.encode() + bytes(content)

        file_hash = hashlib.sha1(content).hexdigest()

        # 2. Tree hash (git cat-file -p HEAD^{tree})

        content  = b'100644 flag.txt' + b'\x00' + bytes.fromhex(file_hash)
        content = f'tree {len(content)}\x00'.encode() + content

        tree_hash = hashlib.sha1(content).hexdigest()

        # 1. Commit hash (git cat-file commit HEAD)

        content  = f'tree {tree_hash}\n'.encode()
        content += f'parent {parent_hash}\n'.encode()
        content += f'author {author} {date} +0000\n'.encode()
        content += f'committer Flag-deciding Committee <committee@legal.committee> {date} +0000\n'.encode()
        content += b'\n'
        content += f'Proceedings of the flag-deciding committee: {", ".join(map(str, positions))}\n'.encode()

        content = f'commit {len(content)}\x00'.encode() + content

        commit_hash = hashlib.sha1(content).hexdigest()
        
        if commit_hash == target_commit_hash:
            return flag

with open('dist/log.txt') as f:
    data = f.read().strip().split('\n')

flag = 'union{**********************************************}\n'.encode()
# flag = 'union{c0mm1t*3*_d3*1deD_bu7**H*_d3t3rm1n3d_***c26***}\n'.encode() # i = 12
for i in range(16):
    parent_hash = data[96-6*i][7:]
    target_commit_hash = data[90-6*i][7:]
    author = data[91-6*i][8:]

    date = data[92-6*i][12:-6]
    date = datetime.datetime.strptime(date, "%b %d %H:%M:%S %Y")
    date = int(datetime.datetime.timestamp(date)) + 28800 # A workaround for me, someone who lives in GMT+8.
    
    positions = list(map(int, data[94-6*i][48:].split(', ')))

    print(f'{i = }')
    print(f'{flag = }')
    print(f'{parent_hash = }')
    print(f'{author = }')
    print(f'{date = }')
    print(f'{positions = }')
    print(f'{target_commit_hash = }')
    print()

    flag = stepn(flag, parent_hash, author, date, positions, target_commit_hash)


print(f'Done! {flag = }')
# union{c0mm1tt33_d3c1deD_bu7_SHA_d3t3rm1n3d_6a7c2619a}